How to stop Acronis Cyber Protection Service

Jim, unfortunately nothing seems to work properly in the Protection module - bit of an exaggeration but it does seem to be badly broken.

You could try uninstalling then reinstalling- before uninstalling save the settings and after reinstalling retrieve the settings. That solved one problem I had.

I suggest you open a support case if you do not get a formula response I the next day or so. In the interim please submit in app feedback- click on help and then Send feedback, include a short description of the problem and make sure that send system report is selected.

Ian

Jim, the only method I have found of stopping Acronis CyberProtection is to set all the protection services to be Disabled at start up in the main Services control panel, and then disable the associated protection processes from starting via the Windows 10 Settings panel (Apps > Startup).

After doing the above, you then need to restart Windows as the Stop option for these services is not available.

The downside of doing this is that ATI 2021 may not launch or work correctly because of the level of integration of protection into other areas of the application!  Also, any new build of ATI would reverse these changes when installed.

Jim, I've been doing a number of experiments including disabling services, changing task settings, etc. Unfortunately I have not come up with a reliable way to do it. Sometimes it seems to work for a while, but then a reboot or reload of the UI will undo my changes.

Steve mentions disabling the tasks, but unfortunately ATI will reenable Active Protection and Cyber Protection when the UI is started. It does not respect the Disabled setting.

I can change the five minute interval for database update checks (I chose 4 hours), but if you do any change to the Protection Settings in the UI, it gets reset to five minutes again. I think this time interval should be user configurable at a minimum, but not even run if all protection is off.

I'm still hoping to find the magic bullet.

BrunoC wrote:

I'm still hoping to find the magic bullet.

The only one I can think of at the moment (sadly) is going back to ATI 2020. 

Bingo :-) The last usable release.

This version of Acronis is really unbelievable.  If you install it and don't disable anything it begins to suck the life out of your PC.   As mentioned previously turning off the services you don't need the proper way within ATI doesn't really do anything.  So you try to be slick and disable them in Services, but they still come back to life.  So what I am  doing now, (because I consider this version a lost cause) is watching Task Manager;   as each process comes back to life, I'll right click on it and click 'Open File Location' and then rename the process after I end in Task Manager.   So far backups, restores and validation all seem to work,  but I don't trust it since I've disabled a bunch of stuff.  When I am done tinkering,  I'll be going back to 2019.

Dc, while this may get you reduced to the functionality you want (backup only), I have found that the logs may get flooded with attempts to access services that are not there.

I question whether the overhead of the services is more or less that the additional overhead of the ATI program from trying and retrying ad infinitum to access services that will always fail.

I fear that at this point, the best answer is 1) turn off all protection, 2) go to Advanced Settings and turn off the option to automatically download database updates, 3) using Scheduler Manager, find the update task (it has a TimeInterval of 300) and change the interval to say 14400. This third item is optional. 4) Never go the protection page again. If you go there and change anything, step 3 may need to be redone.

BrunoC,

Thanks for your input,  after I saw how much of a drag ATI was adding with services I don't use, even by turning them off from inside the ATI app, The App still was using an excessive of amount of overhead for my taste; So  I decided I was done --  but before I removed it, I set sail on a destructive course to strip  all of the junk by disabling services,  renaming files, editing the registry knowing that my end result wasn't going give me anything I am confident in.  I was just curious to see what I can strip off until it completely stops working.  Yeah,  as I expected I saw log entries and even a bunch of service errors for the scheduler looking for files I renamed. I have accomplished my mission of crashing and burning it down.  I have now rolled back to to 2019.   You shouldn't have to go through this extreme amount modification to get satisfaction.

Amen! Acronis has successfully ruined Acronis Backup. I liked the Ransomware protection in 2020. They should have stopped there. 

Technogod wrote:

Amen! Acronis has successfully ruined Acronis Backup. I liked the Ransomware protection in 2020. They should have stopped there. 

+1 

You are sooo right ! Why do they do such silly things ? Are we the Alpha-Testers ?

Here is how to stop it. After turning off all the radio buttons in the dashboard, stopping the Cyber and anti-ransomeware services in services manager, go to c:\program files(x86)\acronis\agent\bin and rename adp-agent.exe to xadp-agent.exe. You can then stop the program in task manager and it will never restart again. Voila!

Three other files need changing - they are sneaky

c:\program files(x86)\acronis\agent\bin\adp-rest-util.exe

c:\program files(x86)\acronis\common files\acronis\ActiveProtection\anti_ransomeware_service.exe

c:\program files\acronis\CyberProtect\cyber-protect-services.exe

I'll monitor it to see if any others morph.

Anthony, could you please check your log files. I suspect that the errors in not being able to complete connections will be causing a constant logging. I think the Schedule2 log is one candidate.

That's disabled too ;)

Anthony Cimorelli wrote:

That's disabled too ;)

 

Are you saying you've eliminated all scheduling as well as protection. Are you just running manual backups?

Bruno, according to the posts here from Anthony, he is primarily just using the boot media for his main ATI backup activities, in which case there is no need to disable / rename anything if the main ATI 2021 application is not being installed!

I use them all. Mainly I just like to play with the toys. See the picture below. Getting great speeds with all the junk disabled. This is using a 4TB Seagate 5400rpm 256mb cache on USB 3.1 from a laptop. Took 22 minutes for a 300GB backup. That's with AES256. With compression it shrank to 151GB tibx on the external.

BrunoC wrote:

Anthony Cimorelli wrote:

That's disabled too ;)

Yes - I run manual full backups. It only takes a few minutes. That way I can always restore from a flash drive. It smokes when using external SSDs or a large HDD with a large cache as pictured below. The things that work for me may not work for your application of it. I used to run a data center with hundreds of Acronis backups clients and servers but now life is good and I can just play.....:)

Are you saying you've eliminated all scheduling as well as protection. Are you just running manual backups?

Anthony, you've reduced ATI to a toy from the sounds of it.

Anyway, I see you have both Nonstop backup and MMS Mini set automatic and running. I have both of those services disabled as I need neither. The two mobile backup services are OK being set to manual as they don't get started. I keep the sync agent set to manual, although it does start running at times... I think just when I start the UI.

You have the scheduler service disabled so that's why no problems with its log. But since you have the agent core service running, you might want to check the Agent logs to see what's going on. I think the easiest way to see if anything is getting overly logged is to run Tree Size Free and see how the Acronis data may be changing.

It now works great for what I want it to (almost).

Nothing noteworthy in the eventvwr or tnd logs. I haven't gone thru all the services but will probably eliminate more.  Almost back to where B&R 11.5 was. If I want any protection I have it with Bitdefender, which has never failed me. I still have the Linux rescue iso on the same bootable USB drive as the Acronis bootable iso and occassionally boot up with that and check my drives independent of Windows. It really gets on my nerves that companies try and make a product that will do everything instead of staying in their expert arena (even Bitdefender is doing that with a substandard VPN, which I disable). Now if Acronis can get 2021 to mount tib's correctly I could access legacy backups and support xfs and btrfs with compression (and not sector backups) on Linux with the bootable iso. ONLY reason I had to go with 2020 was it supported m.2 drives and 11.5 didn't.

How are you able to disable Acronis Cyber Protection Service?  If I try to Stop or Disable, I get Access Denied.  I need to know how to remove and disable the anti-virus components of Acronis as they are causing all kinds of problems, interfering with Sophos, hangs, performance, etc. Every day we find a new issue that it's causing. This is critical. We only use it for backup and now it's our top problem.

When ATI Protection Module goes ferrel the only way I have found of solving the problem is to uninstall ATI. Before doing so save your settings to avoid the need to reconfigure your backup tasks.

After uninstalling ATI, shut down the computer using the restart option, reinstall ATI (run as Administrator), then retrieve your settings go into Protection module and disable everything. I would leave protection against ransomware attacks (which has been in ATI since ATI 2017) in place; I have had no problems with having illicit cryptomining and Microsoft teams protections in place.

Ian

Here is how to stop it.
After turning off all the radio buttons in the dashboard, stop the Cyber and anti-ransomeware services in services manager.
Go to c:\program files(x86)\acronis\agent\bin and rename adp-agent.exe to xadp-agent.exe.

c:\program files(x86)\acronis\agent\bin\adp-rest-util.exe to xadp-rest-util.exe

c:\program files(x86)\acronis\common files\acronis\ActiveProtection\anti_ransomeware_service.exe to xanti_ransomeware_service.exe

c:\program files\acronis\CyberProtect\cyber-protect-services.exe to xcyber-protect-services.exe

Reboot

The system cannot find them to start them. You can monitor in task manager.

Once they are not found you can go back to services and disable them and they won't start.

They are such a serious drag on performance and they won't let you eject the drive using the task bar USB eject tool. A big nuisance for those of us that swap drives around a lot.

I have done this to all my ATI2021 machines and went back to 2020 on another.  Pictures below on what you will see.  ATI2021 will still backup but you lose the bloatware.

Anthony, have you upgraded to ATI 2021 #32010 since your last post above?

It isn't possible to stop the Acronis Active Protection or Cyber Protection services in the Services control panel any more!  This makes renaming the AAP exe impossible without it being stopped first!  (Strangely, the other exe files can be renamed without the services being stopped!)

I will not update until they get rid of that nonsense protection. Other companies do it so much better with less drag on the system. I just download the .exe and .iso and wait. If you need to rename, boot with a Linux USB and go in and rename. Why they don't make it an option is ignorant on their part - couple check boxes.  Sounds like another Microsoft.  Now MS are requiring a Microsoft ID to install W10 on new machines. I uninstalled 2021 on some boxes and reinstalled 2020.  If it weren't for lack of m.2 support I would have stayed with 11.5/11.7 of ABR. Swapping most of my boxes to Fedora Cinnamon. Love it.  Keep it at ext4 and the iso backup works fine and compresses. There is another instance of not knowing the audience. A personal backup for desktop Linux (not server) would be a feather in their cap and generate more revenue but they charge a lot more for Linux Cyber Backup ($300 plus for 3 vice $69 for 5). And you wouldn't need any protection.  Just my $.02.

Anthony, thanks for your update. I was able to rename all the files with the exception of AAP (antiransomware) without having to resort to using any USB boot media, and this stopped the main Cyber Protect service from running after a reboot.

I never install Windows 10 using a Microsoft Account and you can bypass that by simply typing in anything and letting it fail to use it, after which it still lets you create a local account!

I agree that an ATI backup for desktop Linux would be great to have for many users who are making the move from Windows to Linux.  I would expect it wouldn't be that great a challenge for them given they have the Mac app already which is already in a similar arena!

Microsoft just instituted a new hurdle - new machine OEM Windows installs require a valid email address to proceed. It doesn't fallback on a local account anymore. Just got a new one a week ago and found this out.  Installing from a Windows iso still works (latest I tried is vers2004) as you said but anything installed by vendors (i.e. Acer) won't install without verifying an email and setting up a MS account.

Link to article on account https://www.howtogeek.com/442609/confirmed-windows-10-setup-now-prevent…

Anthony, the linked article also confirms that you can still circumvent this change by ensuring the PC is disconnected when doing the install!

How to Create a Local User Account Instead

Thankfully, there is one hidden way around this process on Windows 10 Home: You can disconnect your computer from the network.

If you have a computer with an Ethernet cable, unplug it. If you’re connected to Wi-Fi, disconnect.

After you do, try creating a Microsoft account and you’ll see a “Something went wrong” error message. You can then click “Skip” to skip the Microsoft account creation process.

Once you’ve skipped the Microsoft account creation, the old “Who’s going to use this PC?” screen will appear. You can now create an offline account and sign in to Windows 10 without a Microsoft account—the option was there all along.

FWIW, I reduce the impact of the CPU-hog Cyber-protection-service.exe.  It doesn't eliminate the problem but keeps the <problematic>.exe from hogging CPU cycles.  

On Win 7 (no experience with Win 10) I open the Windows Task Manager, open the Processes tab, select Cyber-protection-service.exe, right-click to get the context menu, hover over Set Priority and select Below Normal from the pull-down, then clock OK.  If you have multiple processors (cores) then open the Context Menu again, click Set Affinity, click  off all processors except 1 (one), click OK

It seems to get reset eventually but, in my case (YMMV), not for quite a bit of time (perhaps an over-night reset or when a backup action is taken (I have scheduled backups in the early morning hours)..

Steve Smith wrote:

Jim, the only method I have found of stopping Acronis CyberProtection is to set all the protection services to be Disabled at start up in the main Services control panel, and then disable the associated protection processes from starting via the Windows 10 Settings panel (Apps > Startup).

After doing the above, you then need to restart Windows as the Stop option for these services is not available.

The downside of doing this is that ATI 2021 may not launch or work correctly because of the level of integration of protection into other areas of the application!  Also, any new build of ATI would reverse these changes when installed.

**********************************

The goal is to get Active Protection Service to the state in the attached image (ActiveProtectionStopped.pjg).

The following process was used to do that for 4 perpetual Acronis True Image 2021 licenses, but, as you say an update can restore the unwanted behavior. We have disabled updates on the affected machines.

Changed file names:

    - C:\Program Files (x86)\Common Files\Acronis\ActiveProtection\anti_ransomware_service.stopped.exe

    - C:\Program Files (x86)\Acronis\Agent\bin\adp-agent.stopped.exe

Changed Registry:

    Registry Key: AcronisActiveProtectionService
        ErrorControl 1 => 0
        Start 2 => 0
    
    Registry Key: AcronisCyberProtectionService
        ErrorControl 1 => 0
        Start 4 => 0
    
    Registry Key: mmsminisrv
        ErrorControl 1 => 0
        Start 2 => 0
    
    Services Altered: Run services.msc
        Under Recovery, set failures to Take No Action and reset fail count to 1000 days. This may not be necessary.
        Acronis Active Protection (TM) Service
            Changed to Disabled, but after reboot, it was changed to Boot
        Acronis Agent Core Service
            Changed to Disabled
        Acronis Cyber Protection Service
            Changed to Disabled, but after reboot, it was changed to Boot
        Acronis Managed Machine Service Mini
            Changed to Disabled, but after reboot, it was changed to Boot
        Acronis Mobile Backup Server
            Changed to Disabled
        Acronis Mobile Backup Status Server
            Changed to Disabled

Your needs may vary and these settings have only been checked for the standard perpetual licenses that we purchased. As you can see from the image, the service was disabled and all the required backup functionality is still working.

Regards...

 

Warren, with the right changes, the Protection page will disappear altogether

I discovered this by chance after renaming the services then running CCleaner which removed some related registry entries for HKLM\CurrentControlSet\Services. 
Note: Always backup any registry entries before changing or removing!

Hi Steve,

You should have documented the process and shared. :-)

I am going to have to look into CCleaner. Sounds useful. I cloned a Dell to Lenovo and it worked well. Is CCleaner safe for removing some of the Registry garbage left behind?

Another issue with Acronis, for those who only want backup/restore/cloning, is that over 16 apps are given full internet upload/download access on each PC installation. I can understand this if someone wants a Web Security/Backup to the cloud service, but this is a red flag for someone like myself who is a software developer/system architect. My backup/restore/cloning is all inside my software and hardware firewalls. I like the control/security of intranet solutions. We do use our own remote servers for ecommerce and as an offsite backup for critical data, but we manage the secure communications ourselves.

I have shut down firewall access for all but the license software, which is reasonable for what I wanted in a backup software. I like the product a lot, but won't deploy it on a larger scale. 

Your experiments and mine show that there are not serious cross couplings of functionality that would preclude Acronis from parsing out a standalone product for intranet deployment. Personally, I think it would also be quite easy to market and deploy. It could be used as a base/spring board to sell some of their other Internet based services.

Thanks for your input and feedback.

Warren

Warren, I have documented the process that I use but for obvious reasons I cannot share that directly here in the public Acronis forums (especially as an Acronis MVP).

If you are interested then I can send you a link to a password protected zip file via a private message.  The zip has 3 small Powershell scripts that do all the 'work' along with a document describing their use.

Please submit Feedback directly to Acronis (use the tool provided in the GUI Help section) and complain about the imposition of these new protection features plus ask for your vote to be added to the Acronis internal change request: TI-213392 Allow installation without Antimalware components

Honestly ATI2021 is utter garbage. I have given up and have gone back to ATI2020 which at least seems to work. Have had a long list of issues over the last few months with 2021 and support have been literally no help whatsoever. It is a complete waste of time contacting them because all they is ask for more and more info and never actually solve a problem or help in any way.

Honestly it is not worth mucking around with just do not use the 2021 version if you can avoid it.

Craig, if you haven't already done so, then please submit Feedback to Acronis as per my previous update to Warren above.

I have done, I have spent hours working with and responding to their support people, but honestly their "support" is hopeless. I have gone back to using ATI2020 and everything works the way I need it to. Don't have time to waste time any further on the VERY buggy 2021 version every time they fix one thing new ones come up making the latest build completely unusable in my case (it would not allow backup locations to be selected). 

My advice is to not trust your data to ATI2021 unless you really don't care about your backups. Over 30 years in IT has taught me the value of backups but they need to be reliable and restorable, ATI2021 is not. So therefore not usable in its current form. YMMV

Craig, while I agree with you on the quality of Acronis Support and the issues with ATI 2021, in particular with the forced introduction of the new Protection features, I cannot agree with your last piece of advice.

I have got ATI 2021 installed on my main laptop and some other PC's and have no worries about the security of my data.  I do not want or use the new Protection features and have these disabled as far as is possible.  I have done regular scheduled and manual backups of these PC's without issue and have done recoveries too, all using ATI 2021, again without issues, so for me, the core Backup & Recovery features are working.

I will add a caveat to my final statement above, there are issues with ATI 2021 that I strongly believe Acronis should have focussed on ahead of introducing the unwanted Protection features.  They should have brought back the full range of features that users have enjoyed for .tib files which were lost when .tibx files were introduced, plus should have dealt with the performance issues that have been introduced too.  They should also have dealt with the thorny issue of forcing migration of MBR to GPT when cloning based on the host PC, allowing users to choose the target partition scheme, and brought back the ability to view log files within the main ATI application that was present in the earlier versions!  All this should have been a priority over adding Cyber Protect to this application.

Final comment, Acronis really need to either offer separate applications with / without Cyber Protect, or else allow users to choose what features are installed or not! 

Steve,

Any chance you can take a look at the latest two entries at this link: How to disable ALL Acronis antivirus services | Acronis Forum. 

The guy seems to have an urgent need.

BTW, I have found an alternative to Acronis True Image 2021. They seem to have a good product for cloning, backups, and restore and their product allows you to completely turn off their equivalent security checking. 

Regards, Warren

Warren, I have added an update but it isn't clear which product Miroslav has for that other topic, i.e. Cyber Protect business product or ATI?  I have not experience with ACP.

Changing the service "Log on as" to an account with an invalid password, and then changing "Recovery" to "Take no action" seems to do the trick.

Brent

Brent Rutherford wrote:

Changing the service "Log on as" to an account with an invalid password, and then changing "Recovery" to "Take no action" seems to do the trick.

Brent

Your workaround is great. Apart from that,I also renamed two files to prevent accidental startup. My PC speed is now back to normal.

C:\Program Files (x86)\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe to *.org

"C:\Program Files\Acronis\CyberProtect\cyber-protect-service.exe" to *.org

After going through this thread just to stop a service I don't want running is truly ridiculous. Seems like I've been an annual customer of Acronis for a decade, but it's time to try something else.

Scott, the latest version of ACPHO allows for selective installation of the Cyber Protection components. If you are running the latest, you could modify the installation to remove it.

Thank you @BrunoC, I had not realized that. I did the modified install; it's nice to at least not have that thrashing taking place. Now though, how do I get a rebate for not using that aspect of the software? Yeah, I'm still going to shop around.

Glad you got the system working better for you now, Scott.

If you feel like a long read, there's this forum topic...
Reflecting on a Post-ATI World