BA8000: A ransomware infection has been detected¶
| Error code | Product | Applies to |
|---|---|---|
| BA8000 | BackupAssist | For BackupAssist 10.1.0 or later. |
Description¶
CryptoSafeGuard is BackupAssist's built-in ransomware protection. Its Scanner scans the files being backed up during each job for signs of crypto-ransomware activity, and its Shield protects existing backups from being altered or deleted by unauthorised processes.
BA8000 is the Scanner's highest-confidence result - it rated an actual ransomware infection in the data being backed up. To preserve your last known-good backup, the backup is failed and BackupAssist blocks all jobs (a red banner appears in CryptoSafeGuard) until the detection has been reviewed and cleared. (CryptoSafeGuard protects your backups; it does not remove ransomware from the system itself.)
One exception: during a job's initial grace period - the first scans after CryptoSafeGuard is enabled for that job, while it establishes a baseline of clean scans - a detection is softened to a warning (yellow banner) and does not block that run. The same detection will block the job once the grace period has passed.
BA8000 is the strongest of three graded results from the same Scanner: BA8001 reports a possible infection (medium confidence - it also blocks jobs outside the grace period), and BA8011 reports an unlikely detection (low confidence, "some signs", which only ever warns and never blocks). All three are resolved through the same review workflow below.
Resolution¶
Follow the CryptoSafeGuard workflow from the alert banner in the BackupAssist console. First decide whether this is a genuine infection or a false positive.
Resolution 1 - Review the detection (recommended)¶
- In the BackupAssist console, click the CryptoSafeGuard alert banner to open the detection.
- Review the listed files and decide whether they indicate a genuine ransomware infection. Respond Yes (infection) or No (no infection).
If this is a genuine ransomware infection (select Yes)¶
Leave BackupAssist blocked - do not run backups over your good data. Treat it as a security incident: isolate the affected machine and remove the ransomware using your security tools (CryptoSafeGuard alerts on and protects backups, but does not remove ransomware from the system). Once the system is clean, recover the affected data from your last known-good backup, which BackupAssist has preserved. Only clear the block when you are confident the system is clean.
If these are false positives (select No)¶
The Scanner errs on the side of caution and can flag safe files. If the listed files are legitimate, remove them, or whitelist them - by file path, file name, file extension, or directory - using the CryptoSafeGuard interface, then choose Unblock jobs.
Only whitelist files you trust. Do not click Unblock jobs until every listed file has been whitelisted, deleted or restored.
Reduce false positives (advanced)¶
For the first few clean scans of a job, CryptoSafeGuard shows a warning without blocking (a grace period); after that, detections block jobs. You can run an on-demand Scan Now, and manage entries under Manage CryptoSafeGuard Whitelist, to clear expected false positives before they block a job.
For the full step-by-step workflow, see the BackupAssist CryptoSafeGuard guide, and CryptoSafeGuard Scanner.
Note on the backup report¶
The backup report shows: A ransomware infection has been detected. Email and SMS notifications for a detection may reference BA8000, BA8001 or BA8002. These come from the CryptoSafeGuard Scanner; the CryptoSafeGuard Shield separately blocks unauthorised changes to existing backups.
| Last updated | Created | Further assistance |
|---|---|---|
| 15th Sep 2026 | 5th July 2017 | BackupAssist Support page |