After updating Docker Desktop from 4.78 to 4.79 on Windows, Acronis Active Protection reported ransomware activity and listed several files under AppDataRoamingDocker Desktop, including JSON configuration files. Docker stopped opening after I chose "Stop the process," and I'm unsure whether to restore the files, leave them quarantined, uninstall Docker, or uninstall Acronis. I installed Docker from the official source and use it to run n8n locally. Is this likely a false positive, and what is the safest way to recover?
4 Answers
A JSON file is just text and normally isn’t executable malware. If Docker was downloaded from its official website, the installer is digitally signed, and you’re using the official n8n image, the alert is much more likely to be a security-product mistake than a compromised Docker release. Still, verify the installer’s signature and checksum, and run another reputable malware scan before reinstalling.
Since you clicked “Stop the process,” Acronis may have blocked or quarantined Docker files rather than deleting them. The “Recover files” option likely restores those files from quarantine, while “Do not recover” leaves Docker incomplete. After updating Acronis, restoring the flagged files or reinstalling Docker from the official installer should be reasonable. Make sure important data and Docker volumes are backed up first.
Don’t jump straight to uninstalling Windows or switching operating systems. If the alert continues after Acronis is updated, contact Acronis support with the detection details and scan the machine independently. Also review any third-party n8n images, scripts, or AI-related tools you installed, since unrelated software could create a genuine risk.
This appears to be a confirmed false positive from older Acronis Active Protection builds. Docker Desktop writes several JSON configuration and state files during startup and updates, and older versions of Acronis could mistake that burst of file activity for ransomware. The files were not actually encrypted, and current Acronis agents reportedly include a fix. Update Acronis first, then restore the Docker files if they were quarantined. You can temporarily add Docker Desktop to the trusted-applications list if necessary.
I restored the files and Docker opened again. Version 4.79.0 is installed, and my n8n container and workflows are working normally. I’ll update Acronis and keep a separate backup of anything important.