BA8011: Some signs of a ransomware infection have been detected¶
| Error code | Product | Applies to |
|---|---|---|
| BA8011 | BackupAssist | For BackupAssist 10.3.0 or later. |
Description¶
CryptoSafeGuard is BackupAssist's built-in ransomware protection. During each backup its Scanner scans the files being backed up for signs of crypto-ransomware activity and rates how likely an infection is.
BA8011 is the Scanner's lowest-confidence result: it found some signs of ransomware but rated an actual infection as unlikely. It is always reported as a major warning - the backup still runs and no jobs are blocked (a yellow banner appears in CryptoSafeGuard, not a red one), regardless of the job's grace period. It is frequently a false positive, but it should still be reviewed.
Important: a yellow-banner warning is not always an "unlikely" result. A higher-confidence detection - BA8000 (a ransomware infection) or BA8001 (a possible infection) - that occurs during a job's initial grace period is also softened to a warning for that run, and will block the job once the grace period ends. Check which condition your backup report actually shows: if it is BA8000 or BA8001, treat it as the more serious case and follow that article.
Resolution¶
Use the yellow CryptoSafeGuard banner in the BackupAssist console to review the detection and decide whether the listed files indicate a genuine infection.
If the files are legitimate (deny)¶
The Scanner errs on the side of caution and can flag safe files. If the listed files are legitimate, remove them, or whitelist them - by file path, file name, file extension, or directory - using the CryptoSafeGuard interface, so future scans are clean. Only whitelist files you trust.
If it may be genuine (investigate)¶
Because BA8011 is low-confidence it does not block the backup, but do not simply dismiss it. Review the listed files and check the machine for ransomware with your security tools. If the signs strengthen on later runs the result can escalate to BA8001 or BA8000 and block the job, so it is best to confirm now that the detection is benign and that you have a known-good backup.
To learn more about CryptoSafeGuard and how to whitelist files, see the BackupAssist CryptoSafeGuard guide, and CryptoSafeGuard Scanner.
Note on the backup report¶
The backup report shows: Some signs of a ransomware infection have been detected. This is a major warning; the backup completes and no jobs are blocked. It comes from the CryptoSafeGuard Scanner.
| Last updated | Created | Further assistance |
|---|---|---|
| 15th Sep 2026 | 21st Dec 2017 | BackupAssist Support page |