Verified Answers

If an answer to your question is correct, click on "Verify Answer" under the "More" button. The answer will now appear with a checkmark. Please be sure to always mark answers that resolve your issue as verified. Your fellow Community members will appreciate it! Learn more

  • State Verified Answer
  • Replies replies
    3
  • Subscribers subscribers
    44
  • Views views
    133
  • Users 0 members are here
Related
Options

Veeam Backup and Malware detection on ZENworks Appliance

dmantz

I am currently running Veeam 12.2 and have started using its malware detection feature. During last night's scan, it identified several files on my ZENworks Appliance 23.4 (fully patched) as being known malware. Knowing this is an appliance, I have not installed our Bitdefender Enterprise software (Our AV/Malware suite) on it as I have done with OES and GW.  My question deals with the three extensions that caused the flag. Are .lr, .com2, and .bd legitimate extensions? Any insight would be greatly appreciated. 

Here are the files identified in the Veeam malware detection log.

[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/vastorage/iprint/var/opt/novell/orientdb/databases/iprintauth/config_1313823923.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/vastorage/iprint/var/opt/novell/orientdb/databases/iprintauth/config_581006817.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/vastorage/iprint/var/opt/novell/orientdb/databases/iprint/config_1884197551.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/vastorage/iprint/var/opt/novell/orientdb/databases/OSystem/config_1041659763.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/vastorage/iprint/var/opt/novell/orientdb/databases/OSystem/config_1339863727.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/var/opt/novell/orientdb_local/databases/OSystem/config_1041659763.bd
[08.10.2024 01:10:58.592] <77> Warning (3) iPrint-Appliance5:fc144630-2567-4774-8729-d2a3c91385dc:/opt/novell/datamodel-service/iprint.usd376.com2
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e6ea356df61df7ab6574309849bc34ae1ddd89b7f8c1d3394592fd0ae9fcb86b/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e6ea356df61df7ab6574309849bc34ae1ddd89b7f8c1d3394592fd0ae9fcb86b/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e6ea356df61df7ab6574309849bc34ae1ddd89b7f8c1d3394592fd0ae9fcb86b/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e08c68f1a73b98779c2092ba13afeb0c7a2da4526dd82f256a925e2ffdc56bc3/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e08c68f1a73b98779c2092ba13afeb0c7a2da4526dd82f256a925e2ffdc56bc3/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/e08c68f1a73b98779c2092ba13afeb0c7a2da4526dd82f256a925e2ffdc56bc3/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d88e9263d0ed78acf1186e272160a47294e7dda1894151b91e502f14e6bb513f/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d88e9263d0ed78acf1186e272160a47294e7dda1894151b91e502f14e6bb513f/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d88e9263d0ed78acf1186e272160a47294e7dda1894151b91e502f14e6bb513f/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d3ca973d36b03f08c585eab90f4bde2dfc48c6c7332fd8647ea6bcd271356a6b/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d3ca973d36b03f08c585eab90f4bde2dfc48c6c7332fd8647ea6bcd271356a6b/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/d3ca973d36b03f08c585eab90f4bde2dfc48c6c7332fd8647ea6bcd271356a6b/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/b6edfb4a276de055151e899393e26cd1c49ce241bba6639427af7d607d9170fe/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/b6edfb4a276de055151e899393e26cd1c49ce241bba6639427af7d607d9170fe/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/b6edfb4a276de055151e899393e26cd1c49ce241bba6639427af7d607d9170fe/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/adeea7b07f18980466c52ea13e93e89e06bbdd3b6525a6b61f591b6dc7c04236/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/adeea7b07f18980466c52ea13e93e89e06bbdd3b6525a6b61f591b6dc7c04236/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/adeea7b07f18980466c52ea13e93e89e06bbdd3b6525a6b61f591b6dc7c04236/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/a03a6dbdcb74baf3a9ccaecc34b23fe890934771f218998115aa513d9f31b812/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/a03a6dbdcb74baf3a9ccaecc34b23fe890934771f218998115aa513d9f31b812/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/a03a6dbdcb74baf3a9ccaecc34b23fe890934771f218998115aa513d9f31b812/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/920acc7a0c16b7aefca168f547a1c1aeff994810a6b5b6367d21550c35fd1d6a/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/920acc7a0c16b7aefca168f547a1c1aeff994810a6b5b6367d21550c35fd1d6a/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/920acc7a0c16b7aefca168f547a1c1aeff994810a6b5b6367d21550c35fd1d6a/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/86a0ab720851228f12d86d2146f5008935bad6dfb917a2b382f1d92ca639d2d8/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/86a0ab720851228f12d86d2146f5008935bad6dfb917a2b382f1d92ca639d2d8/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/86a0ab720851228f12d86d2146f5008935bad6dfb917a2b382f1d92ca639d2d8/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/67151f8f8062b20c5f7055911771a5d7b1a1551b8777d86baab588069a72d7a9/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/67151f8f8062b20c5f7055911771a5d7b1a1551b8777d86baab588069a72d7a9/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/67151f8f8062b20c5f7055911771a5d7b1a1551b8777d86baab588069a72d7a9/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/4e409aa7df7c00ab324777fe1e511e4258da55ba0b96777b18361f64a9ca3bdb/diff/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/4e409aa7df7c00ab324777fe1e511e4258da55ba0b96777b18361f64a9ca3bdb/diff/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/4e409aa7df7c00ab324777fe1e511e4258da55ba0b96777b18361f64a9ca3bdb/diff/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/2d0904c59617ce0364335bd5986f2534c46274ed1bcf57ad1aee8f6274c58026/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/2d0904c59617ce0364335bd5986f2534c46274ed1bcf57ad1aee8f6274c58026/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/2d0904c59617ce0364335bd5986f2534c46274ed1bcf57ad1aee8f6274c58026/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/17c4f3cc0a3df69858d6bec7fab6f7ab7c440205f612d784d994e4948452052c/merged/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/17c4f3cc0a3df69858d6bec7fab6f7ab7c440205f612d784d994e4948452052c/merged/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/var/lib/docker/overlay2/17c4f3cc0a3df69858d6bec7fab6f7ab7c440205f612d784d994e4948452052c/merged/etc/logrotate.d/zypper.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/etc/logrotate.d/zypp-history.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/etc/logrotate.d/zypp-refresh.lr
[08.10.2024 02:20:16.053] <93> Warning (3) ZENworks2020_Update2:8d02714e-7a27-49cc-9662-2c8573234684:/etc/logrotate.d/zypper.lr 

Parents
  • 0  

    Unfortunately, there is no description in the post of how the malware scan is performed and, above all, how VEEAM secures the appliance. A snapshot of an appliance in which a database is online may not be consistent and may be unusable for a restore as an entire VM. I keep seeing snapshot backups of VMs in the field that are unusable because there is no API for databases or file systems that create a consistent snapshot.

    “You can't teach a person anything, you can only help them to discover it within themselves.” Galileo Galilei

Reply
  • 0  

    Unfortunately, there is no description in the post of how the malware scan is performed and, above all, how VEEAM secures the appliance. A snapshot of an appliance in which a database is online may not be consistent and may be unusable for a restore as an entire VM. I keep seeing snapshot backups of VMs in the field that are unusable because there is no API for databases or file systems that create a consistent snapshot.

    “You can't teach a person anything, you can only help them to discover it within themselves.” Galileo Galilei

Children
No Data

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.