BA8002: BackupAssist is blocked because of a ransomware detection¶
| Error code | Product | Applies to |
|---|---|---|
| BA8002 | BackupAssist | For BackupAssist 10.1.0 or later. |
Description¶
CryptoSafeGuard is BackupAssist's built-in ransomware protection. When its Scanner makes a blocking detection during a backup, BackupAssist enters a blocked state and stops all backup jobs from running, to preserve your last known-good backups until the detection has been reviewed.
BA8002 is reported on a job that could not run because BackupAssist is currently in that blocked state following an earlier ransomware detection. It is not a detection by this job - the job was skipped because the whole installation is blocked. No jobs will run until BackupAssist is unblocked.
The block is triggered by a BA8000 (ransomware infection) or BA8001 (possible infection) detection outside the grace period; a BA8011 (unlikely) detection only warns and does not block. To clear BA8002, resolve the original detection that caused the block.
Resolution¶
Unblock BackupAssist by clearing the original detection (recommended)¶
Go to the job that triggered the block and work through its CryptoSafeGuard detection:
- In the BackupAssist console, click the red CryptoSafeGuard banner to open the detection.
- Review the listed files and decide whether they indicate a genuine ransomware infection. Respond Yes (infection) or No (no infection).
- If it is genuine, treat it as a security incident - isolate the machine and remove the ransomware with your security tools, then recover the affected data from your last known-good backup (which BackupAssist has preserved). Keep BackupAssist blocked until the system is clean.
- If the files are false positives, remove them or whitelist them (by file path, file name, file extension, or directory) using the CryptoSafeGuard interface, then choose Unblock jobs.
Only whitelist files you trust. Do not click Unblock jobs until every listed file has been whitelisted, deleted or restored. Once BackupAssist is unblocked, the jobs that were blocked - including this one - run again on their next schedule.
For the full step-by-step workflow, see the BackupAssist CryptoSafeGuard guide, and CryptoSafeGuard Scanner.
Note on the backup report¶
The backup report shows: BackupAssist is blocked because of a ransomware detection. This is a critical condition and the job did not run. It is not a detection by this job - it means BackupAssist is still blocked from an earlier CryptoSafeGuard detection.
| Last updated | Created | Further assistance |
|---|---|---|
| 15th Sep 2026 | 5th July 2017 | BackupAssist Support page |