Skip to main content

ATI 2018 Active Protection thinks MVP Log Viewer is possible ransomware

Thread needs solution

Acronis Active Protection is asking whether the Acronis MVP Loge Viewer is to be blocked or trusted.  Obviously the answer is "Trust".  But why does it think the Log Viewer might be ransomware?  Because it can delete Acronis log files?  So can the Windows File Explorer but it isn't questioned.

0 Users found this helpful

Patrick, AAP tends to err on the side of caution and offer to block anything that it doesn't immediately recognise, including most recent versions of the MVP Log Viewer tool, and also the MVP Custom ATIPE Builder etc.

These tools can be added to the Trusted list (need to do so twice in my experience).

Patrick,

Have you downloaded the latest version of the Log Viewer... version 2.1.  It can be downloaded from the following link.

https://kb.acronis.com/content/59335?build=9207&edition=16&gaID=2726750…

This version was "signed" by Acronis and should be recognized by AAP as a "Trusted" program.  I believe that AAP will challenge any program/app that is "unsigned"...not because it can delete files.

Also, as an FYI, I tried to delete an old .TIB file using Windows Explorer and got an error message asking if I want to approve the process for 1 hour.

Oops.  I have an old log viewer.  I'll download the new one right away.  And I, too, ran into that popup when deleting a (very old, unused) .tib file.  I have mixed feelings about this.  ATI knows which Acronis files need protecting, but I would rather have that protecting done by my security software.

For an explanation about this behavior whuch is by design look Here

You could add Explorer to the whitelist and possibly avert these notices (doubtful it would work), however I would advise against it.  AP looks for Pattern based activity to flag application processes that are deemed suspect or suspicious.  A known ransomware pattern is file deletion.  AP enables an active Self Defense mechanism in which any modification or attempted deletion of backup files or Acroins application files is flagged suspect and triggers the behavior.  It is best to be notified of such behavior and ask for your confirmation of action rather than suffer loss of data.