Acronis TI2018 Active Protection - IPROSETMonitor.exe shows up in DOS, and in Windows Explorer, but not ADD for whitelisting

Scott, the answer to your issue here is described in the KB you don't wish to be reminded of.... where it says:

Please note that the white list is respected only by the ransomware detection component. The self-defence module ignores this trusted list, and if you need to allow an application modifying Acronis True image settings, you need to disable the self-protection as explained here.

The other option is to open a Support Case to request the Acronis developers to recognise the IPROSETMonitor.exe and associated application files as being trusted by AAP.

Thank you, Steve Smith.

But IPROSETMonitor.exe is an intel network card process, not an Acronis process.  Your suggestion to set or unset Acronis Active Protection and it's own files to protect Acronis itself from ransomware doesn't apply to IPROSETMonitor.exe.  So I'm not sure how that would help me.

But thanks.

Scott,

First I encourage you to be suspect of the IPROSETMonitor.exe file.  Malware can masquerade as an executable file.  A genuine Intel file will be found in C:\Windows/System32 folder.   If this file is in any other folder it is highly suspect as malware.  I recommend a complete scan of your computer to verify this is not a malicious file.

Additionally, this file should not be flagged by Active Protection.  The only way this should happen is in the event the version on your computer is very outdated.  The most recent version of the file I can find is 23.1.101.0 Copywright 2015. you can check yours by locating the file in Explorer, right click and select Properties the check the Details tab.  If you find yours is older I suggest that you visit the Intel support site and download the latest version of the ProSet tools application for your NIC.  Then uninstall the current software and install the new downloaded version.  In my experience if you attempt to run the installer for ProSet and an older version is detected on your computer you will be prompted to allow the older version to be uninstalled first.

The above should address your issue with the IPROSETMonitor.exe file.

Hope this helps

Hello,

 Thank you for your reply.  Your suggestions are good ones.  I, of course, scanned all drives of my computer with multiple anti-virus and anti-malware tools before posting.  All scans of all drives came up clean for all used tools.  In addition, my computer is auto-full scanned each week on a schedule, and I review the results after each weekly scan.  I have never encountered an infection due to careful use and monitoring of this system.

What I have have to disagree with you about is when you say “IPROSETMonitor.exe should not be flagged”.  I have noticed with Acronis Active Protection (APP) in using since it’s inception and addition/inclusion with Acronis TI is that it flags most every non-Windows 7 x64 OS process or application that is launched, and marks each as “suspicious” automatically, especially if it is like this example and launches from the C:\Windows\System32 folder.  “Suspicious” just says that Acronis Active Protection does not and cannot be programmed to know about every third-party application or process outside of a basic Windows OS and AAP itself.  Intel Proset is an added support process additional to just the Intel Network card driver files that provides additional network card operation services and support.  So, unless I am missing something, why do you say the Intel IPROSETMonitor.exe should not be flagged by AAP?  I believe it is just a standard warning from APP about a process launched from C:\Windows\System32.  But APP flags “Suspicious” for many things, even Java.

Thanks, though, for your basic suggestions.  They should help others less experienced than myself.

I have opened a case with Acronis Support.  A Google Search of this site shows that another person has reported my very issue with IPROSETMonitor.exe and not being able to choose it from APP to set as “Trusted”.  But that other person too did not receive a solution to this same issue. This is the first time I have not been able to choose and flag a file manually as “Trusted” in APP, and I wanted to find out why.  Maybe it is a bug?  Again, a DOS or Windows Explorer search displays the file easily, but it is hidden from APP’s browser/chooser.

Scott

https://forum.acronis.com/forum/acronis-true-image-2018-forum/active-protections-suspicious-processes

Scott, please let us know the outcome of your Support Case when this is known.

Scott,

Thanks for posting back.  I stand corrected, you are right about AP flagging the IPROSETMonitor.exe file.  I believe this to be something new as I do not recall seeing it in the Suspicious list prior to the last 2 releases.  Unfortunately I do not have any installs of the early releases of 2018 presently to check against.

I find it strange that the file can be located via Explorer and a Command Prompt in the C:\Windows\System32 directory but it cannot be located in an open file instance even with the service disabled.  Not sure that Acronis can do anything about that!