Symptoms

file_protector.sys, file_tracker.sys or another driver consumes nonpaged memory pool until the computer eventually becomes unresponsive.

Cause

The issue typically occurs if there are many files from non-trusted software that are being monitored by Acronis Active Protection and Antimalware Protection. In this case, resources are used by the heuristic analysis.

Troubleshooting

• If you have trusted applications or custom scripts without valid signature, add them to Exclusions,
• Update Acronis Agent to the latest build available,
• If the issue reproduces with the latest build, collect the following information:

1. Output of the Memory Pool Monitor (PoolMon), command poolmon -b -p -r -n <filename>.log
2. How to use PoolMon: click to expand

    

   1. Download or locate the PoolMon tool on the machine. It is included in the \Tools\Other subdirectory of the Windows Driver Kit (WDK)

   2.Open Command line (cmd.exe) with Administrator privileges

   3. To start PoolMon, type a command in the Command line (cmd.exe) using the startup command syntax, e.g. cd <path to the tool>

   4. Type the command poolmon -b -p -r -n <filename>.log where <filename> is the name of log that will be saved in the current directory

   Example of tool output:

   

   Find the output in the folder where the tool is located and send it to Acronis Support.

   For more information, refer to the Microsoft article.

   Acronis system report

   and contact Acronis support.

   Instead of PoolMon, you can also collect an output of Windows Performance Monitor or another similar tool.