ATI 2018 Active Protection thinks MVP Log Viewer is possible ransomware
Acronis Active Protection is asking whether the Acronis MVP Loge Viewer is to be blocked or trusted. Obviously the answer is "Trust". But why does it think the Log Viewer might be ransomware? Because it can delete Acronis log files? So can the Windows File Explorer but it isn't questioned.


- Log in to post comments

Patrick,
Have you downloaded the latest version of the Log Viewer... version 2.1. It can be downloaded from the following link.
https://kb.acronis.com/content/59335?build=9207&edition=16&gaID=2726750…
This version was "signed" by Acronis and should be recognized by AAP as a "Trusted" program. I believe that AAP will challenge any program/app that is "unsigned"...not because it can delete files.
Also, as an FYI, I tried to delete an old .TIB file using Windows Explorer and got an error message asking if I want to approve the process for 1 hour.
- Log in to post comments

Oops. I have an old log viewer. I'll download the new one right away. And I, too, ran into that popup when deleting a (very old, unused) .tib file. I have mixed feelings about this. ATI knows which Acronis files need protecting, but I would rather have that protecting done by my security software.
- Log in to post comments

For an explanation about this behavior whuch is by design look Here
You could add Explorer to the whitelist and possibly avert these notices (doubtful it would work), however I would advise against it. AP looks for Pattern based activity to flag application processes that are deemed suspect or suspicious. A known ransomware pattern is file deletion. AP enables an active Self Defense mechanism in which any modification or attempted deletion of backup files or Acroins application files is flagged suspect and triggers the behavior. It is best to be notified of such behavior and ask for your confirmation of action rather than suffer loss of data.
- Log in to post comments