Introduction

This article explains where to find logs of Active Protection service and driver in Windows.

Description

Acronis Active Protection service's logs

Acronis Active Protection service executable anti_ransomware_service.exe has the following location:

Windows 64-bit: "C:\Program Files (x86)\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe"

Windows 32-bit: "C:\Program Files\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe"

Introduction

This article explains how to enable Active Protection if the tray icon is grayed out and the message says "Acronis Active Protection is turned off" when moving the mouse cursor over it:

Solution

Active Protection can be enabled either from the tray icon menu or from Acronis True Image main program's interface.

Symptoms

Folder C:\Acronis Active Protection Storage contains files with .ENCRYPTED extension. Files may be related to custom or hand-written programs on the computer.

Cause

When programs modify files on the computer, Acronis Active Protection may have a false positive and detect that program as ransomware, especially if some files or databases are modified quickly. 

Acronis True Image 2021 combines reliable backups with advanced security features - integrated anti-ransomware, cryptomining protection and antivirus - to protect you against today's threats.

This article contains frequently asked questions about new Advanced Antimalware Protection features of Acronis True Image 2021.

This article instructs how to approach common issues with Active Protection in Acronis True Image 2018:

• "Acronis Active Protection service is turned off" notification
• "Service is unavailable" and "Acronis Active Protection service is inactive" messages
• Toggle switch does not work when trying to enable Active Protection. "Active Protection is off" status
• Legitimate applications are blocked
• Computer becomes completely unresponsive
• Operating system crashes (also known as BSOD, fatal system error, bug check)
• Operating system becomes unbootable

Symptoms

Acronis Active Protection stops on its own.

"Application error" event about anti_ransomware_service.exe is recorded in Windows Application event log (open Windows Start menu, type eventvwr.msc, press Enter, navigate to Windows Logs - Application).

Cause

Known issue with the software. The application crash occurs when the software is unable to parse configuration files.

Answers to frequent questions

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Question: why a ransomware attack was not stopped by Acronis Active Protection? What happened?

Answer: there are many possible reasons, an investigation is required to determine the cause.

Symptoms

1. Machine is running Dentrix software,
2. You receive false-positive alerts from Acronis Active Protection:

   Suspicious activity is detected
   On machine 'machine name', injection process within program '...\DENTRIX\...' modified file. The process has been stopped, and the file changes have been reverted.

Cause

The behavior is by design. 

Dentrix software is being monitored by Active Protection because it does not have a valid signature.

Introduction

Symptoms

• User receives a false positive alert about a suspicious process from Active Protection,
• You want to exclude the process from Active Protection (add it to Trusted processes), but there is no exact path for exclusion: e.g. the process has a new name or a new location by each run. Exclusion of the whole folder where the process is located does not help.

Cause