File-Backup fails from one day to another

Tamaleus, I would recommend running CHKDSK /F against your D: drive where the file is held in case you have a file system error that is contributing to this problem for the file cannot be saved.

I will check the issue with using Opera to access the forum and report it to the Acronis engineers if I can replicate the problem.

Note: I am able to recreate the issue with using the Opera browser with the forum and will report this to Acronis.

Update on Opera, the problem is being caused by the built-in Ad Blocker in Opera, you will need to turn this off for the Acronis Forum page then you will get the text entry box correctly.  I am writing this update from Opera after doing this.

Hi Steve

Thanks for all of your Feedback! Appreciate it a lot!

Since I had to continue somehow, I answered running process with «Ignore»-Option and clicked on «Ignore» on all of the following Error-Messages concerning this File. Thereafter - entire Backup-Process finally had to be killed (TaskManager) - I checked File with current version of «G DATA TOTAL SECURITY» which surprisingly stated: «Infection - Gen:Variant.Jaik.13836». Although I hardly can believe that, I put the RASConnections.exe file in Quarantine. I sent File and False-Positive-Check-Request to G DATA. No answer yet.

After having read your Recommendation of «CHKDSK /F» I moved back the File to its origin Destination (G DATA offers such Function, although, when checking, to make sure File is there again using TotalCommander, G DATA again was moning about that File and indicating same "Virus". Unfortunately there is no Option to leave the File (with Virus) unchanged where it is (May be you can «Report only»). So, I had to de-activate entire G DATA Suite to get «normal» working Condition.

After these Preparations (RASConnections.exe is back again to where it was, G DATA switched off) I run «CHKDSK D: /F /V /R /X».
Further Info: https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chkdsk.mspx?mfr=true

If you encounter Probs of Security Permission, although you are Administrator and «CMD»-Command requests other and/or even higher Administrator-Rights, try this:

- go via Start-Button to run Command-Option (Start --> type in «CMD» (Don't hit «Enter», continue typing --> «Ctrl + Shift + Enter»)
   (This forces to run CMD-Command-Window with Administrator-Rights, the ones you need!)
- type «CHKDSK X: /F /V /R /X» (where «X» is Drive-Letter, but without Quotes and with Space before each Slash) and confirm with «Enter»
- you might be asked to run CHKDSK after Restart because some Files are currently in use. Confirm with «Y» and «Enter»
- restart your PC/NB

However (CHKDSK may run for quite a While! -> 1 to 2 Hours possible, depending on Size of Drive) in my Szenario, CHKDSK did not solve the Problem. Acronis True Image 2015 still refuses to backup RASConnections.exe and G DATA - activated again - is finding Virus again. So, in my Situation I could not do anything else but move RASConnections.exe to Quarantine and/or delete File (-Copies) from Disk. Don't forget to check wether you have probably some Copies of that File somewhere else. If so, I suggest to may be backup that File to CD and delete it and/or all Copies on Disk-Drive. Thereafter you can restart your Backup-Set/-Definition and run it again. It should succeed.

Remaining Question: Why Acronis cannot save that File (RASConnections.exe) which it did for Ages!?

PS: regarding Opera: I think... (Darwin wrote too ;-) ... Acronis should fix Forum-Software anyway. It should run correctly no matter with or without Ad-Blocker! Agree?

Tamaleus, if you have a file which has been locked by an antivirus program at a low level, then it is unlikely that ATIH could then aquire a lock on it for the purpose of the backup.

Sorry, Steve, don't get what you are saying. First Acronis did not backup anymore. Second - when I asked to check Directory (containing RASConnections.exe) - G DATA found Virus on File not backuped anylonger. What's meaning of «ATIH»? Did not restore nor recover Files and/or Disk or OS. Do you refer to https://kb.acronis.com/tag/atih-recovery ?

Tamaleus, sorry but I think something is getting lost in translation here.

You stated that the file RASConnections.exe was identified by your G Data security program as a potential virus threat and that Acronis reported (in your original post) that this same file could not be saved.  If this file is being locked by G Data then this would prevent Acronis from saving it.

If you have an older backup image where this file was saved previously, then I would suggest removing / renaming or deleting the current copy of RASConnections.exe then restoring a clean copy of the file from your older backup.

If you are seeing a different problem or the above advice is not relevant, then please provide the Acronis log files to show us what the actual issue is here?  Logs can be found in C:\ProgramData\Acronis\TrueImageHome\Logs folder - this folder may be hidden - if so, then change the view options to show hidden files & folders in Windows Explorer.

Sorry, Steve, for me probably causing confusion.

To clearify: Order of what happend as follows:

1. Acronis True Image Home 2015 Backup refuses (suddenly, from one day to the other without any obvious reason) to save «RASConnections.exe»-File (several times / every time when runned)

2. THEREAFTER: Me pro-active checking the directory containing this File with G DATA, leads to information that - according to G DATA - there is a Virus on that File (which I doubt! As I stated: This File is on Disk since November 6, 2007!)

3. According to your suggestion I run CHKDSK, however got Message that Admin-Rights are requested (although I am an Admin!) Therefore my Intention to gi ve «work-around» in case other Users encounter same situation.

4. According to my description, on how CHKDSK shall start, I run CHKDSK on my Drive D:\ (on which RASConnections.exe is to be found)

5. Result of CHKDSK: Nothing. No Solution to Acronis still refusing to backup RASConnections.exe

6. Only working method of running Backup of Drive D:\ (Name of my Acronis-Definition that for is «LWD») WITHOUT hanging and/or error messages after having RASConnections.exe DELETED (or moved to Quarantine).

Clear now?

(Hope, attached File shall help. Otherwise, please let me know!)

BTW: Under Chrome no access to C:\ProgramData (not visible). And yes: I am Admin.

Tamaleus, thank you for the logs zip file, I see the following error message reference the problem file:

 message=Backup von Datei oder Verzeichnis 'RASConnections.exe' fehlgeschlagen. Fehler beim Backup. (0x40019) Tag = 0xCE542E14DA203B15 Zugriff auf die Datei oder den Ordner wurde verweigert. (0x40014) function = CreateFileW, path = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\xxx\Documents\Visual Studio 2010\#_Backups_Projects\vb@rchiv CD Vol.6\data\source\tipp\439\RASConnections.exe, $module = 0) Tag = 0xA8A1022BD18AE02A Zugriff verweigert (0xFFF0) code = 80070005) Tag = 0xBD28FDBD64EDB8C3: Kein(e)

Message = Backup from file or directory 'RASConnections.exe' failed. Backup failed. (0x40019) Tag = 0xCE542E14DA203B15 Access to the file or folder has been denied. (0x40014) function = CreateFileW, path = \\? \ GLOBALROOT \ Device \ HarddiskVolumeShadowCopy1 \ Users \ xxx \ Documents \ Visual Studio 2010 \ #_ Backups_Projects \ vb @ rchiv CD Vol.6 \ data \ source \ tipp \ 439 \ RASConnections. Exe, $ module = 0) Tag = 0xA8A1022BD18AE02A Access denied (0xFFF0) code = 80070005) Tag = 0xBD28FDBD64EDB8C3: None

As I recommended above, you should remove this file and restore a good copy of the same from a previous backup when it was saved without problem.  Even though the file date may still show 2007 this does not mean that the file has not been changed by malware / virus actions.  I personally would not trust a file that my security software has already flagged as potential malware, especially if I have another copy of the same file that I can replace it with.

Steve, thanks for your endless patience. I'm serious!

However - as far as «Confusion» is concerned - please have a look at my very first entry (2016-11-18). I thought, I described exactly what was going on. And your analizes only confirm what I said all the time: Acronis suddenly does not backup RASConnections.exe anymore, without any obvious reason. Except... maybe... G DATA changed Virus Pattern... and... maybe... discovers False Positive? Question only!

What do you think about it?

I checked on VirusTotal. First result: 43 of 43 clear as per 2011-10-13. Second Scan: 11 out of 56 identify Virus. Interesting: None of these competitors offer real online-scan. All of them intend to download there software and I would not be surprized, they find Virus and immediately can remove it (BTW: G DATA already did so).

I have G DATA Total Security since ages. In addition: Malwarebytes Antimalware, licensed Version (States: System protected) and Malwarebytes Anti-Exploit Free for all Browsers I use. 

Restore of RASConnections.exe, eldest version (2011-10-02, even elder version to be brought back from save) available from times where no problems occured, results in immediat Message by G DATA: Virus found.

Restore of RASConnections.exe (Date saved on CD: 2009!) and already on only opening Directory \439 on CD with Explorer results in immediat Message by G DATA: Virus found. 

Please in addition see reporting/describing screenshots/PDF's (Tamaleus_Screenshots_RASConnections-exe.zip).

Interesting, isn't it?

Your suggestion?

BTW: Sent several requests to «Antivirus-Professionals» to check on False-Positive, however no answers yet.

Tamaleus, I am not sure what more I can add to this discussion - your G Data antivirus definitely thinks (rightly or wrongly!) that there is an issue with RASConnections.exe on your system and is blocking this file which will also block ATIH from accessing the file for the backup.

If you are completely sure that there is no malware / virus / trojan type infection for this specific file, then try looking for an option in G Data to exclude the file from further scans and actions etc.  I am not familiar with G Data so cannot advise you on how to do this - it is not a program I have ever used.

I also do not have any file by the same name on my own system.

Steve, I'd like to thank you again. So far I only can wait till I get Feedback from either my Request to Acronis and/or Feedback from G DATA about that matter. At that Time, to me it looks like G DATA is the «Bad Guy» because of putting any new Virus-Patterns in some Updates done automatically (which is okay for me so far) and not telling me about «Locking a certain File» as supposed by you and if that's the situation. I even cannot find any explaining Entry in any Log-File by G DATA. Please (anyone) let me know by return Entry in this Forum in case I have overseen something.

I intend to come back asap and let you know about anything I'll learn as far as this «Topic» is concerned. In my case and since I currently do not need the File in Question (it's still to be found on my original CD from Supplier, «vb@rchiv CD Vol.6»), I deleted the Copy in its origin Destination as well as some backuped Copies and ZIP-Files. So, for the Moment, this is clarified to me.

Greetings