Attempt to modify MBR
I use Acronis True Image 2018 and this morning I started getting this popup message:
Acronis Active Protection
An attempt by process 'C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe' to modify MBR of your disk was successfully blocked.
So far I get the message about once per boot (occurs about 1-2 minutes after the Windows desktop starts).
IAStorDataMgrSvc.exe and my whole drive scans clean by Trend Micro. Is this a real problem or a false positive? It seems like the Intel process might have entirely legitimate reasons to write the MBR.

- Log in to post comments

Looking at the Acronis log, it also blocked registry access from program C:\Program Files (x86)\AMD\Performance Profile Client\AMDPPCM.exe
And registry access from C:Program Files\DiskLED\DiskLED.exe
All legitimate sounding apps that scan clean by Trend Micro. Looks like I'm going to have to disable Acronis Active Protection.
- Log in to post comments

Bruce, you will need to whitelist these Intel RST applications.
See KB 60193: Acronis True Image 2018: Active Protection blocks legitimate applications for more information.
- Log in to post comments

Thanks, but it's flagging too many apps for me to trust the feature. It obviously wasn't well thought out.
- Log in to post comments

Bruce, please open a Support Case direct with Acronis for this issue as this is still only version 2.0 of AAP and I would guess that Acronis are still learning in terms of the very broad list of possible known/trusted applications that they shouldn't need to be flagging up.
- Log in to post comments

Fyi too... you don't have to install the entire IRST package. Just download the drivers which are in the flpyx64.zip in the same download area on the intel page. Extract the zip and use device manager to update your storage controller driver by pointing the path to the extracted folder.
I never run the full IRST package, but that's just me.
- Log in to post comments