Skip to main content

Possible Ransomeware detected

Thread needs solution

Just started getting this message this morning. It points to outlook as the issue and lists 11 affected files. 10 are in \users\"my profile name"\appdata and one is \program data\microsoft\office\heartbeat\heartbeat.xml. I selected block and then recover but it keeps coming back. Both Malwarebytes and AVG report no threats.I am using ATI 2017 build 6209 on Windows 10

0 Users found this helpful

Harry, I can only recommend that you open a direct Support Case with Acronis to investigate this issue to determine whether this is a real ransomware issue or a false positive being detected by Acronis Active Protection.

You will be asked to submit an Acronis System Report to help with that investigation, which you could submit to Acronis by using the GUI Feedback tool - make sure that you reference this forum topic in the feedback text.

In reply to by truwrikodrorow…

Thanks Steve!!   I assumed that would be the answer but figured I'd give the forum a try first in case there was an answer here that my search didn't find. Do I send the report initially or wait 'till I am asked for one?

Harry, I would send the System Report via the Feedback tool then refer the support folks to this when they get in contact with you, or when you speak to them via the Live Chat feature.

The heartbeat files of Microsoft Office are used to authenticate your Office install by sending verification over the internet to Microsoft servers.

There are a number of recommended steps to fix these issues on Microsoft support sites.  Try Googling all of the filenames exactly as they appear and look at any hits that come from Microsoft.

I cannot say for sure but I would say that because the attept to contact a server is failing Active Protection sees this as suspicious activity and has flagged the failed attempts.

In reply to by truwrikodrorow…

Thanks. I tried doing the block and recover once more and this time for whatever reason the issue did not re-occur.

Harry