Skip to main content

Acronis Active Protection flagging Windows Robocopy as possible ransomware?

Thread needs solution
Beginner
Posts: 1
Comments: 1

I've been copying files from a Windows command prompt using Robocopy and after running for some time (more than an hour) Acronis Active Protection pops up a message saying:

 

Possible ransomware detected - Acronis Active Protection paused the program that modified your files. File content has been changed by using a know suspicious pattern.

 

I'm assuming this is some type of false alarm as Robocopy is part of windows and scanning Robocopy.exe doesn't turn up anything. What's strange is I haven't seen this before when using Robocopy?

 

 

0 Users found this helpful
Legend
Posts: 110
Comments: 28569

Welcome to these public User Forums.

The clue here is in the warning message you are seeing:  "Acronis Active Protection paused the program that modified your files. File content has been changed by using a known suspicious pattern."

The repetitive nature of how Robocopy works when copying lots of files is indicative of potential ransomware activity.

Robocopy is not malware / ransomware by nature but it could be used by the same if a machine was infected.  If you are confident that the warning is a false positive, then you can whitelist Robocopy within the AAP settings.

KB 60193: Acronis True Image 2018, 2019 and 2020: Active Protection blocks legitimate applications

Beginner
Posts: 1
Comments: 1

Thanks Steve, I guess what's strange is it wasn't doing it before and I couldn't find anything online about it.

I think I've figured out what's triggered it though. I was running the Robocopy multi-threaded option and 64 and 128 threads triggers Acronis Active Protection while 8 threads doesn't. I think too many threads may look like a suspicious pattern to it. Do you think this is something Acronis could fix if it's a false positive?

Incidentally, when I click on ignore in the warning message it says it will add it to it's whitelist, however it's only temporary and the warning will pop up again after a while.

Legend
Posts: 110
Comments: 28569

Good detective work identifying the multi-threaded aspect of using Robocopy!

Acronis will only fix this if it is shown to happen with the current / latest version of ACPHO (build #40107) which is the only version now supported.

As this is a behaviour issue, I doubt that they will change anything other than perhaps to make the whitelisting stick properly!

You could turn off AAP temporarily while using Robocopy in this mode to try stop it from being invoked and challenging the behaviour pattern.