Aller au contenu principal

[SOLVED] False positive of Acronis NG active protection and PDF24 uninstaller

Thread needs solution

ATIH 2017 NG b6116

Scenario:
Acronis True Image Home 2017 NG is installed and Active Protection is enabled and running
PDF24 is installed
User runs the update, which will cause an uninstallation of the prior version e.g. from 8.0.4 to 8.1.0
 

Problem:

Uninstalling / updating PDF24 application (http://www.pdf24.org/ - that's a very powerful and popular tool in Germany)
causes a false alert of Acronis Active Protection as displayed in the attachment.
The Uninstallation process will be halted (correctly) until the user makes a choice.

 

Fichier attaché Taille
false_positive.png 1.19 Mo
0 Users found this helpful

I suspect it is similar to the problems I have been having with print drivers - PDF24 would include a print driver for the creation of PDF files. Acronis Tech Support suspects that such issues are related to unsigned print drivers. Not sure if you are experiencing the same issue.

Update:  I suggest that you do inApp feedback, attach system report, and include a link to this topic.

Ian

Hello Ian, thanks for your feedback. I have hoped that there are other MVPs or users that would have expierenced this issue, foremost our german MVP Gerhard. I will open a ticket for this behaviour, and hope will be addressed in a future patch. It is nothing critical but it may irritate inexperienced users, let them suspect that there is something wrong with this PDF24 tool.

Hello Karl,

Thank you for reporting the false positive reaction! I have forwarded the information to the Development Team.

Of course, it is OK to click "Allow" button and continue the uninstallation or update of PDF24, or add the respective executable file to the white list in the Settings section of the main program window.

Regards,

Slava

Dear Slava,

I have found another product (update) that will be flagged by Active Protection. If you upgrade from CrystalDiskinfo 8.x to the latest you should be able to reproduce this aswell.

 

Hello Karl,

Thank you! I use and recommend CrystalDiskinfo a lot, but I mostly use its portable version. Probably that is why I have not observed compatibility issues with Active Protection.

Do you mean an upgrade from version 6.8.x? I have tried installing 6.8.2 and upgrading it to 7.0.5, but did not notice any abnormal behavior nor any warnings from Active Protection.

Regards,

Slava

Hello Slava,

yes I updated Crystaldiskinfo to the recent version. I have also updated PDF24 from 8.0.4 to the new 8.1.1 and from 8.0.1 to 8.1.1 on another machine at the moment I cannot reproduce the problem with Active Protection :( maybe there is something else needed to trigger the behaviour.

for the Crystaldiskinfo thing I have no logs but for the PDF24 that I reported above I am in contact with the support dept and they have all logs except their requested Procmon, as I am not able to repro it, as you know if you click on allow once in Active Protection you cannot remove the allowance anymore. it will be not handled in the exceptions. I have raised this behaviour in the NG beta but they said it is as designed.

 

Issue was not reproducible anymore.

I can confirm that the problem is not in the latest ATI 2017 NG build.

Ian

Thanks a lot Ian!

En réponse à par truwrikodrorow…

Hi,

is there any other way to report false-positives?

Thanks in advance.

 

Sven

Sven, welcome to these User Forums.

Please see KB 60193: Acronis True Image 2018: Active Protection blocks legitimate applications

If you find that the above techniques do not resolve the issues you are seeing, then please open a Support Case directly with Acronis to bring this to their attention.