Synology ABB Hyper-V backup fails with "WinRM operation timed out after 300 seconds" – Microsoft Defender false positive (Trojan:Win32/Commando.A!ml)
After spending a day troubleshooting this issue, I wanted to share the root cause in case someone else runs into the same problem.
# Environment
* Synology Active Backup for Business (ABB) 3.2.0 * Hyper-V on Windows Server 2025 * WinRM enabled (5985) * VSS writers healthy * Hyper-V services healthy * No packet loss between the Hyper-V host and the NAS
# Symptoms
ABB failed with:
WinRM operation timed out after 300 seconds
The following errors appeared in the Synology logs:
curl perform failed url[127.0.0.1:8000/api/v1/infra/backup_server/me] curl_code[7] Failed to connect to 127.0.0.1 port 8000
and:
Can not connect to server at '/run/synoabk/abk-agent-control-socket'
At first, I suspected:
Windows updates, WinRM configuration, Hyper-V, VSS or ActiveBackup for Business itself
However, none of those turned out to be the root cause.
The actual cause:
While an ABB backup was running, Microsoft Defender generated the following alert:
Trojan:Win32/Commando.A!ml
Defender removed the process immediately.
The affected command line was:
C:\Windows\System32\cmd.exe /C powershell -encodedcommand ...
After decoding the PowerShell command, we found that it was simply trying to establish a TCP connection to the Synology NAS:
$ip = 'your NAS IP' $port = 5510
$client = New-Object System.Net.Sockets.TcpClient $client.Connect($ip, $port)
The script also verified a shared secret returned by the NAS.
No external connections were made.
No payload was downloaded.
No persistence mechanisms were created.
No registry modifications were performed.
# Solution
* Open **Windows Security**. * Open **Protection history**. * Locate the **Trojan:Win32/Commando.A!ml** event. * Verify the blocked process. * Create an appropriate exclusion. * Re-enable Microsoft Defender. * Report the false positive to Microsoft and Synology.
Hopefully this saves somebody else a few days of troubleshooting.