---
title: "Restore Point Marked as Infected"
description: "Sent when a user marks a restore point as infected. For more information, see Managing Malware Status. Event ID: 42220 Event message details: Restore point has been marked as infected by <UserName> Severity: Warning"
canonical: "https://helpcenter.veeam.com/docs/vbr/events/event_42220.html"
breadcrumb: "Event Reference > Malware Detection > Restore Point Marked as Infected"
dateModified: "2026-10-01"
---

# Restore Point Marked as Infected

Sent when a user marks a restore point as infected. For more information, see [Managing Malware Status](https://helpcenter.veeam.com/docs/backup/vsphere/malware_detection_managing_status.html).

## General Information

**Event ID**: 42220

**Event message details**: Restore point has been marked as infected by `<UserName>`

**Severity**: Warning

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">PointID</span></p>
    </td>
    <td>
      <p>Restore point ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">PointID="2eec1a91-7202-49a9-b60b-1436793c2502"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">UserName</span></p>
    </td>
    <td>
      Name of the user who performed an operation.
    </td>
    <td>
      <p><span class="T_Filenames">UserName="TECH\user1"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">ObjectName</span></p>
    </td>
    <td>
      <p>Object name.</p>
    </td>
    <td>
      <p><span class="T_Filenames">ObjectName="VM01"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">RestorePointTimeStamp</span></p>
    </td>
    <td>
      <p>Date and time when a restore point has been created.</p>
    </td>
    <td>
      <p><span class="T_Filenames">RestorePointTimeStamp="07/25/2026 07:00:53"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VbrHostName</span></p>
    </td>
    <td>
      Backup server name. Can be a DNS name, an FQDN or an IP address.
    </td>
    <td>
      <p><span class="T_Filenames">VbrHostName="vbrsrv01.tech.local"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VbrVersion</span></p>
    </td>
    <td>
      Veeam Backup & Replication version.
    </td>
    <td>
      <p><span class="T_Filenames">VbrVersion="13.1.0.411"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">Version</span></p>
    </td>
    <td>
      Event version (service parameter).
    </td>
    <td>
      <p><span class="T_Filenames">Version="1"</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">Description</span></p>
    </td>
    <td>
      Event message details.
    </td>
    <td>
      <p><span class="T_Filenames">Description="Restore point has been marked as infected by TECH\user1."</span></p>
    </td>
  </tr>
</table>

## Syslog Message Example

```
1 2026-07-26T05:15:57.141518-07:00 VBRSRV01 Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=42220 PointID="2eec1a91-7202-49a9-b60b-1436793c2502" UserName="TECH\user1" ObjectName="VM01" RestorePointTimeStamp="07/25/2026 07:00:53" VbrHostName="vbrsrv01.tech.local" VbrVersion="13.1.0.411" Version="1" Description="Restore point has been marked as infected by TECH\user1."]
```