Cobian Backup can't delete Volume Shadow Copy image

[Ignacio]

Hi, i have installed Cobian Backup 11 (http://cobiansoft.com/cobianbackup.htm), and i have defined some backup tasks using Volume Shadow Copy.

When this backup task run, the log of Cobian Backup display information about normal deletion of the shadow image. But in the folder "c:\system volume information" remains one shadow image, wich only is deleted after a computer reboot.

Of course, if MBARW is off (interface and service) deletion is automatic after the end of the backup task.

Steps for reproduce the issue:

1. Install Cobian Backup and MBARW
2. Create of task in Cobian Backup using Volume Shadow Copy
3. Run this task



SCRENSHOTS - MBARW NOT RUNNING

Screenshot1: Before run Cobian Backup task. The folder System Volume Information is almost empty. MBARW is not running

Screenshot2: Cobian Backup task using Volume System Information

Screenshot3: After execute the backup task, the log of Cobian Backup display information about successful deletion of Volume Shadow copy image

Screenshot4: After run Cobian Backup task. The folder " System Volume Information" is still almost empty



SCREENSHOTS - MBARW RUNNING

Screenshot5: Before run Cobian Backup task. The folder System Volume Information is almost empty. MBARW is running

Screenshot6: After execute the backup task, the log of Cobian Backup display information about successful deletion of Volume Shadow copy image. Just like before. But .........

Screenshot7: Now, the folder "System Volume Information" contains a Volume Shadow Copy file with a size of 320 MB, wich only is deleted after a computer reboot. The file name is not the same as indicated by Cobian Backup log, but It only appears in this situation.

[1PW]

Hello Ignacio and

This might be only the third report concerning Cobiansoft's Cobian Backup 11 and as such may hold high interest for the MBARW development team.  The data being requested below seemingly is for a false positive, but the same data will be extremely valuable for analysis of your issue:

From your system, please archive (.zip) Cobian Backup 11's main installed executable just as if it had triggered a MBARW false positive.

Please carefully read the locked and pinned topic in this sub-forum, How to report a False Positive and for developer analysis, kindly attach the 3 requested .zip archives to your next reply in this thread.

Thank you for beta testing MBARW and your feedback.

[Ignacio]

I am not sure which is the main executable of Cobian Backup. The installation program creates a shortcut in start menu to cobian.exe with the name "Cobian Backup 11 - Application" and to cbinterface.exe with the name "Cobian Backup 11 - User Interface". But the user can configure the automatic execution like a service; in this case, the windows task manager display only two processes: cbservice.exe and cvVSCService11.exe; So, i attach this 4 executables.

 

cbInterface.zip

cbService.zip

cbVSCService11.zip

Cobian.zip

logs.zip

Malwarebytes Anti-Ransomware.zip

[Ignacio]

Windows services screen display 2 services: "Cobian Backup 11 Gravity" (executable cbservice.exe) and "Cobian Backup 11 Volume Shadow Copy Requester" (executable CbVSCService11.exe)

[1PW]

Hello Ignacio:

The MBARW development team has been contacted.  Thank you for the great data archives and participating in the MBARW Beta testing program.