- Untitled.jpg (29.07 KiB) Viewed 473 times
Can FreeFileSync Execute "vssadmin delete shadows /all /quiet"?
- Posts: 1
- Joined: 5 Sep 2025
Something on a computer caused the command "vssadmin delete shadows /all /quiet" to be flagged as possible ransomware. Freefilesync 14.4 donation edition was run as a normal user in the portable version on a USB drive around this time. Could it have attempted to run that command in terminal?
- Posts: 1222
- Joined: 8 May 2006
The only time (that I am aware) that FFS would deal with VSS is with,
https://freefilesync.org/manual.php?topic=volume-shadow-copy
And if you are not running FFS "as Administrator", that should not even apply.
(Likewise, vssadmin itself requires administrator privileges.)
(Now, I suppose if FFS was running as Admin, & some malware were able to inject into that process, maybe it could then do a delete... but then the same could hold true for any process running as Admin...)
Can't say I recall, particularly, that VSS did have some pre-allocated space?
Not sure what List Writers means (or shows), but if FFS were the 'writer', might that be noted in List Writers (as a 'Writer name:')?
https://freefilesync.org/manual.php?topic=volume-shadow-copy
And if you are not running FFS "as Administrator", that should not even apply.
(Likewise, vssadmin itself requires administrator privileges.)
(Now, I suppose if FFS was running as Admin, & some malware were able to inject into that process, maybe it could then do a delete... but then the same could hold true for any process running as Admin...)
Can't say I recall, particularly, that VSS did have some pre-allocated space?
Shadow Copy Storage association
For volume: (E:)\\?\Volume{
Shadow Copy Storage volume: (E:)\\?\Volume{
Used Shadow Copy Storage space: 3.679 GB (4%)
Allocated Shadow Copy Storage space: 3.99 GB (4%)
Maximum Shadow Copy Storage space: 4.5 GB (5%)
Not sure what List Writers means (or shows), but if FFS were the 'writer', might that be noted in List Writers (as a 'Writer name:')?
- Posts: 4910
- Joined: 11 Jun 2019
Along with therube's info, even if FFS is using VSS, it is only for accessing files and wouldn't run a delete command ever. The only way FFS could run this command is if it was set to in the "post-sync" command option. This would have to be a deliberate action, so unlikely you'd forget, and why would you have it delete without at least making a new one.
That screenshot shows Trellix as the source, is that not the root issue or is that the AV you are using? Maybe the AV itself got flagged, AVs kind of suck lol
If not, the parentid is 13716. You could check Task Manager for that ID, and if it is still running, it could be the source. It is possible for the ID to get reused though, so grain of salt
That screenshot shows Trellix as the source, is that not the root issue or is that the AV you are using? Maybe the AV itself got flagged, AVs kind of suck lol
If not, the parentid is 13716. You could check Task Manager for that ID, and if it is still running, it could be the source. It is possible for the ID to get reused though, so grain of salt
-
- Site Admin
- Posts: 7523
- Joined: 9 Dec 2007
That's not coming from FFS.
