notice of possible ransomware!
Acronis True Image 2019 informs me of a possible ransomware. False positive? It's with process powershell.exe and the files in folder C:ProgramData\Lenovo\ImController...
For bitdefender it's all ok.

- Se connecter pour poster des commentaires

I would check with Lenovo tech support concerning the flagged app/files and question there use of PowerShell on your PC. I can think of no legitimate reason for an OEM app to do so and I have not heard or seen any of this before.
I would lean toward this possibly being an accurate detection of ransomware until I could find out differently. Having said that I would encourage you to block the Lenovo app and flagged files until such time as you verify they are OK.
- Se connecter pour poster des commentaires

I blocked them but they are activated when they restart. How can I verify if it is a false positive?
- Se connecter pour poster des commentaires

Maxwell, the first recommendation here would be to run any software update tools provided by Lenovo for your computer and ensure that you have the very latest versions of the Lenovo tools that are found in your Lenovo\ImController folders (battery meter etc).
If you are satisfied that there is no malware involved here, i.e. have run scans of the folders being reported by AAP, then follow the instructions in KB 60193: Acronis True Image 2018 and 2019: Active Protection blocks legitimate applications - to whitelist these Lenovo applications.
- Se connecter pour poster des commentaires

Hi Steve, well, Lenovo software was already updated. I have update bitdefender again, restar pc and I have performed new scan with bitdefender: unit C is clean, no problem.
After rebooting it did not appear acronis notice for pobbible ransomware. This "situation" is strange.
To create an exception with ATI I would like to be very sure.
Thanks.
- Se connecter pour poster des commentaires

As an additional step to verify that the files are not compromised contact Lenovo support and ask. If their software is triggering other security software like AAP then they need to know that so that it can be remedied either by them or Acronis which ever is appropriate.
- Se connecter pour poster des commentaires

I reported the problem on the Lenovo forum. I await your reply. I don't understand how to contact Lenovo support directly. It's very strange.
Fichier attaché | Taille |
---|---|
496999-166839.jpg | 78.06 Ko |
- Se connecter pour poster des commentaires

I am providing a link to the Global Lenovo Support site. It is English however, you can change the language at the top right side of the page.
Click on the PC, laptop, etc. option on this page then, on the next page which is the Contact Us page click on Consumer Products. Now look below and you will see 2 options. They are "We call you" or "You call us" Take your pick.
Hope this helps :)
- Se connecter pour poster des commentaires

Hi Enchantech, I know that Lenovo link but it's not available for my product (PC).
- Se connecter pour poster des commentaires

Look below the Products that you see. There are 2 sections below that and the third section is the Contact Us section that I referenced.
- Se connecter pour poster des commentaires

Ok Enchantech, but it's not possible.
- Se connecter pour poster des commentaires

Ok, so here's the number 877-453-6686. I have no idea why you cannot navigate to it.
- Se connecter pour poster des commentaires

The Imcontroller is definitely not ransomware. Its something that Lenovo includes as part of the software preload on their machines. Its exact purpose is somewhat fuzzy to me. I searched the Lenovo forums and most of the references where about 3 years old. The major complaint about it seemed to be the excessive use of resources. I ran task manager on my Lenovo Ideapad and 5 instances running and none of them was using excessive resources. I did see the ransom ware flag from AAP and told it to ignore the process. THis thread explains how to disable it Modern.Imcontroller
- Se connecter pour poster des commentaires

Hi thomasjk, thanks! I'll create an exception (Lenovo) with ATI.
- Se connecter pour poster des commentaires

Apparently this is fixed now as Acronis no longer flags them, even without the exceptions.
- Se connecter pour poster des commentaires