BA8001: A possible ransomware infection has been detected¶
| Error code | Product | Applies to |
|---|---|---|
| BA8001 | BackupAssist | For BackupAssist 10.1.0 or later. |
Description¶
CryptoSafeGuard is BackupAssist's built-in ransomware protection. During each backup its Scanner scans the files being backed up for signs of crypto-ransomware activity and rates how likely an infection is.
BA8001 is the Scanner's medium-confidence result - it rated a ransomware infection as possible. To preserve your last known-good backup, the backup is failed and BackupAssist blocks all jobs (a red banner appears in CryptoSafeGuard) until the detection has been reviewed and cleared. (CryptoSafeGuard protects your backups; it does not remove ransomware from the system itself.)
One exception: during a job's initial grace period - the first scans after CryptoSafeGuard is enabled for that job, while it establishes a baseline of clean scans - the detection is softened to a warning (yellow banner) and does not block that run. The same detection will block the job once the grace period has passed.
BA8001 is the middle of three graded results from the same Scanner: BA8000 reports an actual ransomware infection (higher confidence - it also blocks jobs outside the grace period), and BA8011 reports an unlikely detection (low confidence, "some signs", which only ever warns and never blocks). All three are resolved through the same review workflow below.
Resolution¶
Follow the CryptoSafeGuard workflow from the alert banner in the BackupAssist console. First decide whether this is a genuine infection or a false positive.
Resolution 1 - Review the detection (recommended)¶
- In the BackupAssist console, click the CryptoSafeGuard alert banner to open the detection.
- Review the listed files and decide whether they indicate a genuine ransomware infection. Respond Yes (infection) or No (no infection).
If this is a genuine ransomware infection (select Yes)¶
Leave BackupAssist blocked - do not run backups over your good data. Treat it as a security incident: isolate the affected machine and remove the ransomware using your security tools (CryptoSafeGuard alerts on and protects backups, but does not remove ransomware from the system). Once the system is clean, recover the affected data from your last known-good backup, which BackupAssist has preserved. Only clear the block when you are confident the system is clean.
If these are false positives (select No)¶
The Scanner errs on the side of caution and can flag safe files. If the listed files are legitimate, remove them, or whitelist them - by file path, file name, file extension, or directory - using the CryptoSafeGuard interface, then choose Unblock jobs.
Only whitelist files you trust. Do not click Unblock jobs until every listed file has been whitelisted, deleted or restored.
Reduce false positives (advanced)¶
For the first few clean scans of a job, CryptoSafeGuard shows a warning without blocking (a grace period); after that, detections block jobs. You can run an on-demand Scan Now, and manage entries under Manage CryptoSafeGuard Whitelist, to clear expected false positives before they block a job.
For the full step-by-step workflow, see the BackupAssist CryptoSafeGuard guide, and CryptoSafeGuard Scanner.
Note on the backup report¶
The backup report shows: A possible ransomware infection has been detected. Outside the grace period this is a critical condition that blocks jobs; during the grace period it is softened to a warning. It comes from the CryptoSafeGuard Scanner.
| Last updated | Created | Further assistance |
|---|---|---|
| 15th Sep 2026 | 5th July 2017 | BackupAssist Support page |