Skip to main content

Issue with Active Protection

Thread needs solution

Hi,

After Installing latest build (12.5 16180) when I apply Active Protection I see in activities that it detects itself as suspicious process:

Self-protection detected suspicious process 'C:\Program Files\Common Files\Acronis\BackupAndRecovery\Common\service_process.exe' 

Is that desired behaviour or a bug?

And as soon as this activity is detected Dashboard stops working ( AMS is installed on vm with Windows and it has agent installed inside).

regards

1 Users found this helpful
frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 0
Comments: 2016

Hello TP,

thank you for posting on Acronis forum and reporting this issue!

I strongly recommend that you open a case with Acronis Support Team and share with engineers Acronis System Information gathered from the Agent where Active Protection Plan returns this error.

In order to avoid getting the error message in the console, I suggest you adding this service (service_process.exe) to the list of trusted services in Active protection plan so that Acronis does not show this service as harmful: https://www.acronis.com/en-us/support/documentation/AcronisBackup_12.5/index.html#38894.html

It detects this process on all agents when Active Protection is enabled it is just the matter of time, some do it right away some do it after couple of hours. It is a fresh installation so it just seems weird to me, on previous builds installed in lab environment I have never experience this issue.

Am I the only one seeing this behaviour in latest build?

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 250
Comments: 7092

Hello TP,

our QA team cannot reproduce this issue in our environment. Would you mind sending us Acronis system report from one of the affected machines? I'll provide the upload link in a personal message. 

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 250
Comments: 7092

Dear TP,

our development team tried to reproduce the issue and unfortunately didn't get enough data to localize the issue. We'd be very grateful if you could collect Acronis system report from the affected Agent and upload it to our FTP server (sent the link in a private message - to access PM, go to My account at the top of a forum page and then to Dialogs) 

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 0
Comments: 2016

Dear TP.

Please check the latest available build # 16318 with a fix to a bug [AAP-3880] Active Protection erroneously detects ams.exe, service_process.exe and mms.exe as suspicious processes in some case.

New build seems to fix this this issue.

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 250
Comments: 7092

TP wrote:

New build seems to fix this this issue.

Thanks for the update\feedback! Good to know of positive results