Today a client reported an error message "Adagio Backup DLL not found" when they tried to make a backup in Adagio.

I noticed that the SSIQBACK.DLL file was missing from their \Softrak\System folder. I replaced it with mine.

The next time they tried to make a backup, McAfee popped up to complain about the file, and removed it (again).

I'm guessing there was some sort of Anti-Virus update last night that now identifies this file as a virus.

How do I rectify this?

Steve

I've had multiple clients call about this as well. Windows defender also mis-identifies the file as a trojan.

Mark the file as "Safe" or exclude the \Softrak\System Folder from your virus checker.

Our SSIQBACK.DLL file is missing too. How do I get it back?

Reinstalled GL and AP still same error "backup DLL missing" Any solution?

Check your antivirus quarantine and move it back from there.

Hi,

It's possible that this is a much bigger problem than being presented.

I have now seen this problem with Sophos and MS AV programs and Steve Schwartz has observed the problem with Mcafee as well.

(FYI - Tuesday is commonly known as Microsoft Security update day)

In my attempt to copy the SSIQBACK.DLL file on my own Server to replace it for one of our clients who needed the file replaced after trying to run their Backup this morning. MS System Center Endpoint Protection intervened and removed the file as well as modified the Windows Registry entries. Please see below for details:

Category: Trojan Downloader
Description: This program is dangerous and downloads other programs.
Recommended action: Remove this software immediately.

System Center Endpoint Protection detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the Allow action and click Apply actions. If this option is not available, log on as administrator or ask the security administrator for help.

Items:
file:F:\Softrak\system\SSIQBACK.DLL
regkey:HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS\\F:\Softrak\system\SSIQBACK.DLL
shareddll:HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS\\F:\Softrak\system\SSIQBACK.DLL

To correct the above I have done the following:
Before recovering the SSIQBACK.DLL file from last night's Image Backup of the Guest Machine, the SSIQBACK.DLL file was excluded from the AV program on the Host Machine & Guest Servers. This allowed the replacement of the deleted file on the Guest Machine successfully.

The question I have is how best to deal with the Adagio Windows Registry entries that the AV reported as changed? Softrak, please advise action required.

Unfortunately, after replacing the file on our Server, when I try to open any Adagio module, it now requests a WKSETUP. Softrak, please advise action required

One last thing,
in response to Andrew's suggestion to exclude the \Softrak\System folder,
I have been advised by our System Support technical people that the exclusion of any Folder from AV checking potentially creates an unacceptable opportunity for Hackers to save an Virus program to that Folder and as it is an AV excluded Folder their Virus programs can run without AV intervention. Softrak, please advise action required.

I suggest everyone immediately add an exclusion to their AV programs on all Workstation & Servers that run Adagio for SSIQBACK.DLL file. Ideally prior to an Adagio Backup being run.

Warmest regards,
Kerry Gullins
IOS Consulting Group.inc.

ps.s It might be advisable to move this to the private Forum until a complete resolution is available and then later add an edited version to the Technical Forum.

Hi, Kerry,

We use Sophus also and it certainly hasn't interfered with my use of Adagio's backup function (have used it several times today already).

I've been telling people basically what Andrew did earlier. I've asked them to ensure that the full path and filename to the dll (ie. ...Softrak\System\SSIQBACK.DLL) is included in the AV s/w's list of exclusions and then to put the file back in the Softrak\System folder. In one instance only, I had to upload the dll for the person.

What you might also want to do, for any of you that are affected and if you're using a purchased antivirus software, is to contact the antivirus software developer and let them know that they are delivering a false positive. The file's an older one but it is signed and there is no virus.

Thanks for you detailed post.

Hello Support,

I have two clients now where I have put the file back and put full exclusions in place including unc pathing and mapped drive pathing to the UNC.

The file is in the proper directory in both cases, but the backup will not run and says the dll is not found.

On one client I receive an additional message first: The first and second messages are in the link below

[img]https://www.dropbox.com/s/ojk8ftjf5dx72pn/Backup.png?dl=0[/img]

Hi, Ken,

Do they have things set up on the server and on w/s's? Are they using primarily one s/w but, as sometimes it turns out, Defender has been enabled the w/s?

Makes it more of a pain to track down I know.

Thanks for providing the screenshot. I'll pass them on to R&D.

Please let me know on the other things.

Both clients are Peer to Peer network setups with no server.

Per Kerry Gullins post above I reinstalled Ap and the issue went away.

Thanks Kerry!

Hi, Ken,

Good information to know.

Glad you've got it under control and it's working out for them now.

I was able to restore SSIQBACK.DLL followed this procedure:
1) Add Softrak/system folder to Windows antivirus - (excuse this folder).
2) Disconnect all internet and windows antivirus(in registry or settings.
3) Load up clean SSIQBACK.DLL again in Softrak system folder. Test your data if
Backup is working.
4) Re-activate your antivirus and internet.
Still working for me.

Hi, Chandler,

Thanks for the feedback. Seems that in different environments, different things do work.

Much appreciated.

HI Support,

What is it about this file that is causing the AV to suddenly see it as a threat?

What is going to be done to eliminate this problem for this file and future DLL issues with Adagio?

I have more clients complaining they cannot backup today and don't have time to figure out a unique solution for every client.

Hi All

I just went through this with the one client who has had this issue so far and I don't think it's the AV. MS updated their Security/Defender programs and this is where the issue is likely coming from.

The solution seems to be re-installing an Adagio application (likely the most recent release date) or restoring the DLL from a backup.

So far is hasn't been deleted again. Hopefully it will stay that way.

Doug,

I have had 5 calls/emails and 4 so far were Windows Defender identifying the file in question as a trojan virus. The 5th has not answered my reply yet.

Initially replacing the file was not sufficient because as soon the .dll was used to run a backup, Defender removed it again. As previously stated, an exclusion of the folder was needed in Defender's Virus and protection settings. Then replacing the file and excluding the file name. In two cases, replacing the file (even with the folder exclusion) flagged it again for removal and I had to mark it as "Allow" in the threat history.

So while I have not see it with other AV software as of yet, (as others have) Defender is the only AV software some clients use now.

My own machine seems unaffected since I use Norton AV and Windows is set to allow Norton as the AV solution. Hopefully Norton does not pick this definition up from Defender.

HI Doug,

I agree with you that Defender is the issue. The latest windows update seems to be the trigger from what I have seen.

I did the reinstall last yesterday, and the backup worked, but later the dll was again quarantined. I am not sure if the file was "killed" from this same workstation or another one as I am not 100% confident the IT group had setup up the exclusions correctly on the second workstation. I again reinstalled and cleaned up the exclusions and so far so good.

Is this file going to be white listed going forward?

All of these questions should be asked your anti-virus provider why they see it as a threat. The DLL is signed. There is nothing we can do further from our end.

I have already suggested excluding the \Softrak Folder from the anti-virus scan.

To add to Doug and Ken's responses, I noticed that one of my sites that had the issue, only had it on the machine with the 1809 update. The PCs still on 1803 were unaffected.

Hi, All,

One of your counterparts has reported the issue to Microsoft, as they are the developer of Defender, this morning.

May take a while but once they make the change, usually the other AV s/w developers follow suit shortly thereafter.

Unfortunately, different environments often require variations in the procedure to resolve an issue. Having reported the problem to the developer will ultimately be what resolves it.

Thanks for the added information, Dan.

I am also having this issue. Bitdefender is our antivirus software. Yesterday I had two trojan virus notices. They were in quarantine and I deleted the file without noting the name of the deleted file. After that I could no longer do Adagio backups, getting the error message “Adagio Backup DLL not found. Unable to do backup.”

I cannot get the DLL file back as I cannot reinstall the last service packs because when I go online to try to get the file the link where I am to input my email address doesn’t work. Since I can’t put my email address in I can’t get the file to download it. (I have an email and a call in to Customer Service about the email link.)

Can someone assist me in getting the last service packs for Ledger, AP & BR, and then I can re-install them and then get our IT guy to figure out what to do with all the info above about exclusions etc?

Hi Support,

I have just encountered the issue and thought it could be due to upgrades not being executed. As a client had the issue and I was already schedule to do their upgrades and thus after they were executed the issue stopped.

But just got a call from another client who had their upgrades done weeks ago and this issue has suddenly presented itself. I will try the AV solution at that site and see what happens.

Hi Support:

Among users that reported this problem to me last week, most lacked the internal resources or the willingness to involve their external IT support firm to fix the problem. They decided to wait out the problem and then to replace the missing SSIQBACK.dll.

Question: How will we know when the false positive reading has stopped occurring and it's safe to go back into the water?

Hi Bruce,

Without trying to sound flippant, you'll know when one of your clients with the necessary IT resources lets you know that the issue has been resolved, or someone posts in whatever thread has been created on this forum.

Bruce I don't trust the AV resolutions personally, they'll fix this specific error but a week from now another update will flag another file and start the headache again. I've taken this as a good opportunity to exclude the Softrak folder from AV scans (as Andrew suggested in this thread). I've moved many sites to this setup and am only seeing those that have yet to see the setting migration call with issues relating this this misidentification. It comes with the added bonus of allowing for better network performance for clients with older/slower networks.