Attempt to modify MBR
I use Acronis True Image 2018 and this morning I started getting this popup message:
Acronis Active Protection
An attempt by process 'C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe' to modify MBR of your disk was successfully blocked.
So far I get the message about once per boot (occurs about 1-2 minutes after the Windows desktop starts).
IAStorDataMgrSvc.exe and my whole drive scans clean by Trend Micro. Is this a real problem or a false positive? It seems like the Intel process might have entirely legitimate reasons to write the MBR.

- Anmelden, um Kommentare verfassen zu können

Looking at the Acronis log, it also blocked registry access from program C:\Program Files (x86)\AMD\Performance Profile Client\AMDPPCM.exe
And registry access from C:Program Files\DiskLED\DiskLED.exe
All legitimate sounding apps that scan clean by Trend Micro. Looks like I'm going to have to disable Acronis Active Protection.
- Anmelden, um Kommentare verfassen zu können

Bruce, you will need to whitelist these Intel RST applications.
See KB 60193: Acronis True Image 2018: Active Protection blocks legitimate applications for more information.
- Anmelden, um Kommentare verfassen zu können

Thanks, but it's flagging too many apps for me to trust the feature. It obviously wasn't well thought out.
- Anmelden, um Kommentare verfassen zu können

Bruce, please open a Support Case direct with Acronis for this issue as this is still only version 2.0 of AAP and I would guess that Acronis are still learning in terms of the very broad list of possible known/trusted applications that they shouldn't need to be flagging up.
- Anmelden, um Kommentare verfassen zu können

Fyi too... you don't have to install the entire IRST package. Just download the drivers which are in the flpyx64.zip in the same download area on the intel page. Extract the zip and use device manager to update your storage controller driver by pointing the path to the extracted folder.
I never run the full IRST package, but that's just me.
- Anmelden, um Kommentare verfassen zu können