What’s going on? All the EXEs, MSIs, DLLs, and LNKs have been removed from the folder structure that I attempted to backup to Personal OneDrive using Duplicacy.
(including CMD, BAT, INI, CONFIG, CAT, INF, SYS, ICO, REG)
Every EXE, MSI, DLL, and LNK within the Source directory I backed up to OneDrive Personal using Duplicacy has disappeared with other non-executable files remaining intact.
Microsoft Defender anti-virus did not detect, quarantine, or do any deletions itself.
Thankfully I have an alternative backup (via robocopy) of the source directory, so I can restore the files that have gone missing.
This bug makes Duplicacy dangerous
I think the behaviour must be a terrible bug, because if it were otherwise malicious the code would have gone after other files on my system.
I’m going to reproduce the behaviour and perform a system trace as I’m a curious cat.
I’ll provide my findings below:
- Microsoft SFCScan and DISM tools did not find any system file or integrity issues, so I’m certain the files going missing issue is isolated to executable binaries in the directory structure targeted by Duplicacy for backup.
- Malware scans came back negative - except for the occasional false positive from over ambitious AV vendors. I verify suspicious files against VirusTotal.com’s battery of AV engines.
- Given the binaries targeted hints at some sort of malicious code somewhere on my system triggered by the backup - but scans from multiple malware vendors came back negative, including Process Explorer use of Virus Total.
- I’ve put the following back into place using a PowerShell script:
$fileTypes = @(".exe", ".msi", “.dll", ".lnk”, “.cmd", ".bat”, “.ini", ".config”, “.cat", ".inf”, “.sys",".ico”,"*.reg")
