Acronis Ransomware blocks copying/deleting of tib-files

Hello Juan,

Thank you for your posting and welcome to Acronis forums! The behavior is expected, Acronis Self-protection module, which is a part of Acronis Active Protection, protects Acronis own processes, backups, and archives from ransomware, unauthorized changes, or deletion. Please refer to https://kb.acronis.com/content/59857

disable the service temporarily when you move or delete backup.

Hi Ekaterina,

except Acronis Ransomware Protection, I don´t have installed other Acronis program on my PC.

Is it right that Ransomware Protection itself even does not allow to copy a tib-file by myself as administrator to paste  into another partition on the same computer ?

If yes, why is it possible then to copy tib-files without any problems to a NAS within the same network or even by FTP to somebody outside the LAN ?

I thought that Ransomware Protection does check all processes constantly if there is any strange behavior, but allows normal tasks done by the admin as copying, deleting, moving.

In my case, the tib-files don´t contain important files except the OS, but there are much more important files on the HDD which I still am able to delete, to copy, or to move while Ransomware Protection is enabled ....

Thanks for your comments to understand if everything is correct that way.

Of course I could disable Ransomware Protection while handling tib-files on the PC, but during that time no protection is available, so it would make much more sense if the program would allow to copy, paste, delete or move all kind of files if it´s made by an admin.

Best Regards

Juan

Juan, you can minimise the risk of temporary turning off AAP while you copy or delete tib files by using a simple batch file as the example below:

@echo off
sc stop "AcronisActiveProtectionService" > NUL 2>&1
del L:\Test\Downloads*.tib > NUL 2>&1
sc start "AcronisActiveProtectionService" > NUL 2>&1

You can put copy commands instead of delete as needed.

Juan Jabonero wrote:

...
Is it right that Ransomware Protection itself even does not allow to copy a tib-file by myself as administrator to paste  into another partition on the same computer ?

If yes, why is it possible then to copy tib-files without any problems to a NAS within the same network or even by FTP to somebody outside the LAN ?...

The logic behind this behavior is that if you can copy / rename / delete .tib files, so can malware - a reasonable assumption.  The reason you can do the copy / rename / delete on a NAS is because Acronis has not yet implemented this in their NAS support.  (They claim to have enabled protection against encryption on a NAS.)  This leaves .tib files on a NAS quite vulnerable.

Note that the AAP does not prevent copying .tib files from the local computer; it prevents copying to the local computer (which obviously prevents copying between directories on the local computer).  I have no idea how Acronis has implemented this support, but it has not been extended to FTP or SMB.  (I understand that the SMB support is tricky, but I assumed that an FTP client used regular Windows I/O routines protected by AAP.  It does not.  You can FTP a .tib file onto a computer protected by AAP.)

The SMB protocol provides both user and share level security.  User security is username/password credential dependent.  Share level security is password assigned to that share only and set by an administrator.  As long as you are authenticated by these methods then you can copy, move, delete files without AAP complaint to/from SMB shares.

Patrick O'Keefe wrote:

I have no idea how Acronis has implemented this support, but it has not been extended to FTP or SMB.  (I understand that the SMB support is tricky, but I assumed that an FTP client used regular Windows I/O routines protected by AAP.  It does not.  You can FTP a .tib file onto a computer protected by AAP.)

I was wrong about FTP.  AAP does see FTP access to files but (at least in my case with the WinSCP client) allows writing of .tib files.  I don't know how to change that behavior.

Enchantech wrote:

The SMB protocol provides both user and share level security.  User security is username/password credential dependent.  Share level security is password assigned to that share only and set by an administrator.  As long as you are authenticated by these methods then you can copy, move, delete files without AAP complaint to/from SMB shares.

I notice in the Anti Ransomware log that there is no logging of access to files on a NAS.  Does that mean that AAP does not have visibility to SMB file requests?  (I assume that's the case, but I don't know what - if any - security hooks exist in SMB code to allow such visibility.)

I believe that once you the user authenticates to an SMB share, then writes, moves, copies, and deletes are deemed expected behavior and so those actions are not acted upon by AAP.  This may be true for FTP as well on an LAN.  That would not hold true for connection over WAN.