Acronis True Image 2017: troubleshooting Acronis Active Protection

Acronis Active Protection protects your computer from ransomware -  malicious software that encrypts your files or blocks access to an entire system, and then demands ransom for restoring access to your data. Acronis Active Protection monitors processes running on your computer by using the real-time mode. When it detects a third-party process that tries to encrypt your files, it informs you about it, and asks if you want to allow the process to modify your files or block the process. In case your files still were encrypted, Acronis True Image 2017 New Generation will suggest recovering them from previously created backups.

Acronis Active Protection has two major goals:

• protect your data from ransomware attacks
• protect own files (backup files and application files) from attempts to change, delete, or corrupt them (self-protection)

Troubleshooting

Limitations of Acronis Active Protection:

• Does not monitor external drives that were plugged in after the AR service start
• Driver's storage size is limited to 20% of the free space on C:
• Does not monitor processes having the valid digital signature: embedded or in a cab file

Active protection does not start

Issue 1: The Active Protection icon does not appear in tray.

Solution:

1. Open Task Manager (see this article, if you need assistance).
2. In Processes (or in Details), look for TrueImageMonitor.exe

• If it is not listed among processes, start it manually: navigate to C:\Program Files\Acronis\TrueImageHome\ and double-click TrueImageMonitor.exe:
  
  
• If the process is listed, collect system report and contact Acronis Customer Central.

Issue 2: The Active Protection icon is grayed out

Solution:

1. Right-click the Active Protection icon and check whether Active Protection is turned on or off. If it is turned off, turn it on:
   
2. Check whether Acronis Active Protection Service is running:
   
   1. Open Windows services: Start -> search -> type services.msc and press Enter.
   2. Locate Acronis Active Protection Service and check it status. If it is stopped, start it:
       

Issue 3: Active Protection does not start

Solution:

1. Check service configuration in Windows registry:
   
   1. Open Windows registry: Start -> search -> type regedit.exe and press Enter.
   2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
   3. Locate AcronisActiveProtectionService
   4. Compare the configuration of the service with the default:
      
2. Check driver configuration in Windows registry:
   
   1. Open Windows registry: start -> search -> type regedit.exe and press Enter.
   2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
   3. Locate file_protector
   4. Compare the configuration of the driver with the default:
      
3. If these registry keys are absent or the configuration vary, run repair installation of Acronis True Image: double-click the installation file and click Repair:
   

False positive alarm

Protection detects regular software as ransomware.

Solution:

1. In detection alert window, click Trust.
2. Add the process to trusted processes list:
   1. On the left sidebar, click Settings.
   2. Navigate to the Acronis Active Protection section.
   3. Click Manage permissionlist:
      
   4. Click Add.
   5. Select the application you want to add to the trusted applications.
   6. Make sure its status is Trusted.

Issues with Windows operating system

Symptoms:

• Windows hangs
• An application cannot be started
• Windows Explorer does not response for a long time
• Operations with files (for example, copying files) are slow

Troubleshooting:
The issue requires detailed investigation. Collect the information listed below and contact Acronis Customer Central.

Collect the following information:

1. Windows memory dump:
   
   1. Follow this article to enable kernel-mode dump creation.
   2. Follow this article to enable dump creation upon a specific key combination.
   3. Restart Windows.
   4. Reproduce the problem. Once the problem appears, hold down the rightmost CTRL key, and press the SCROLL LOCK key twice.
   5. The dump file is created. Meanwhile you will see a blue screen. This is expected, wait until the dump is written.
   6. After dump is created, restart Windows.
   7. Disable Acronis Active Protection.
2. Acronis system report. Collect Acronis system report as described in this article.

And contact Acronis Customer Central.