---
title: "Malware Activity Detected"
description: "Sent when malware activity is detected. For more information, see Malware Detection. Event ID: 41600 Event message details: Potential malware activity detected: <Details> Severity: Warning"
canonical: "https://helpcenter.veeam.com/docs/vbr/events/event_41600.html"
breadcrumb: "Event Reference > Malware Detection > Malware Activity Detected"
dateModified: "2026-10-01"
---

# Malware Activity Detected

Sent when malware activity is detected. For more information, see [Malware Detection](https://helpcenter.veeam.com/docs/backup/vsphere/malware_detection.html).

## General Information

**Event ID**: 41600

**Event message details**: Potential malware activity detected: `<Details>`

**Severity**: Warning

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">DetectionTimeUTC</span></p>
    </td>
    <td>
      <p>Date and time when malware activity has been detected.</p>
    </td>
    <td>
      <p><span class="T_Filenames">DetectionTimeUTC="07/25/2026 13:05:41"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">OibID</span></p>
    </td>
    <td>
      <p>Machine ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">OibID="0e54d3bf-add8-48eb-9122-fad3ac1e8fb3"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">ActivityType</span></p>
    </td>
    <td>
      <p>Malware activity type. Possible values:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">DeletedUsefulFiles</span> — Deleted files</li>
        <li class="Table_List"><span class="T_Filenames">SuspiciousFilesInDelta</span> — Indicators of compromise</li>
        <li class="Table_List"><span class="T_Filenames">RansomwareNotes</span> — Ransom notes and onion links</li>
        <li class="Table_List"><span class="T_Filenames">RansomwareExtensions</span> — Known suspicious files and extensions</li>
        <li class="Table_List"><span class="T_Filenames">EncryptedData</span> — Encrypted files</li>
        <li class="Table_List"><span class="T_Filenames">YaraScan</span> — Malware activity specified in the YARA rule</li>
        <li class="Table_List"><span class="T_Filenames">AntivirusScan</span> — Malware activity specified in the antivirus configuration file</li>
        <li class="Table_List"><span class="T_Filenames">RenamedFiles</span> — Renamed files</li>
        <li class="Table_List"><span class="T_Filenames">Unknown</span> — Malware activity detected by a third-party solution</li>
      </ul>
    </td>
    <td>
      <p><span class="T_Filenames">ActivityType="EncryptedData"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">UserName</span></p>
    </td>
    <td>
      Name of the user who performed an operation.
    </td>
    <td>
      <p><span class="T_Filenames">UserName="TECH\user1"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">UserFullInfo</span></p>
    </td>
    <td>
      <p>Detailed information about the user who performed an operation. Includes the following data:</p>
      <ul>
      <li><code>fullName</code> — the user name</li>
      <li><code>loginType</code></li>
      </ul>
    </td>
    <td>
      <p><span class="T_Filenames">UserFullInfo="&lt;ModifiedUserInfo fullName="TECH\user1" loginType="0" /&gt;"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">ObjectName</span></p>
    </td>
    <td>
      <p>Object name.</p>
    </td>
    <td>
      <p><span class="T_Filenames">ObjectName="VM01"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">CreationTimeUTC</span></p>
    </td>
    <td>
      <p>Date and time when a malware detection event has been created.</p>
    </td>
    <td>
      <p><span class="T_Filenames">CreationTimeUTC="07/25/2026 13:10:02"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VbrHostName</span></p>
    </td>
    <td>
      Backup server name. Can be a DNS name, an FQDN or an IP address.
    </td>
    <td>
      <p><span class="T_Filenames">VbrHostName="vbrsrv01.tech.local"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VbrVersion</span></p>
    </td>
    <td>
      Veeam Backup & Replication version.
    </td>
    <td>
      <p><span class="T_Filenames">VbrVersion="13.1.0.411"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">Version</span></p>
    </td>
    <td>
      Event version (service parameter).
    </td>
    <td>
      <p><span class="T_Filenames">Version="1"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">Description</span></p>
    </td>
    <td>
      Event message details.
    </td>
    <td>
      <p><span class="T_Filenames">Description="Potential malware activity detected for OIB: 0e54d3bf-add8-48eb-9122-fad3ac1e8fb3 (VM01), rule: Encrypted data by user: TECH\user1."</span></p>
    </td>
  </tr>
</table>

## Syslog Message Example

```
1 2026-07-26T14:06:09.662307+02:00 VBRSRV01 Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=41600 DetectionTimeUTC="07/25/2026 13:05:41" OibID="0e54d3bf-add8-48eb-9122-fad3ac1e8fb3" ActivityType="EncryptedData" UserName="TECH\user1" UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />" ObjectName="VM01" CreationTimeUTC="07/25/2026 13:10:02" VbrHostName="vbrsrv01.tech.local" VbrVersion="13.1.0.411" Version="1" Description="Potential malware activity detected for OIB: 0e54d3bf-add8-48eb-9122-fad3ac1e8fb3 (VM01), rule: Encrypted data by user: TECH\user1."]
```