[SOLVED] False positive of Acronis NG active protection and PDF24 uninstaller

ATIH 2017 NG b6116
Scenario:
Acronis True Image Home 2017 NG is installed and Active Protection is enabled and running
PDF24 is installed
User runs the update, which will cause an uninstallation of the prior version e.g. from 8.0.4 to 8.1.0
Problem:
Uninstalling / updating PDF24 application (http://www.pdf24.org/ - that's a very powerful and popular tool in Germany)
causes a false alert of Acronis Active Protection as displayed in the attachment.
The Uninstallation process will be halted (correctly) until the user makes a choice.
Fichier attaché | Taille |
---|---|
false_positive.png | 1.19 Mo |


- Se connecter pour poster des commentaires

Hello Ian, thanks for your feedback. I have hoped that there are other MVPs or users that would have expierenced this issue, foremost our german MVP Gerhard. I will open a ticket for this behaviour, and hope will be addressed in a future patch. It is nothing critical but it may irritate inexperienced users, let them suspect that there is something wrong with this PDF24 tool.
- Se connecter pour poster des commentaires

Hello Karl,
Thank you for reporting the false positive reaction! I have forwarded the information to the Development Team.
Of course, it is OK to click "Allow" button and continue the uninstallation or update of PDF24, or add the respective executable file to the white list in the Settings section of the main program window.
Regards,
Slava
- Se connecter pour poster des commentaires

Dear Slava,
I have found another product (update) that will be flagged by Active Protection. If you upgrade from CrystalDiskinfo 8.x to the latest you should be able to reproduce this aswell.
- Se connecter pour poster des commentaires

Hello Karl,
Thank you! I use and recommend CrystalDiskinfo a lot, but I mostly use its portable version. Probably that is why I have not observed compatibility issues with Active Protection.
Do you mean an upgrade from version 6.8.x? I have tried installing 6.8.2 and upgrading it to 7.0.5, but did not notice any abnormal behavior nor any warnings from Active Protection.
Regards,
Slava
- Se connecter pour poster des commentaires

Hello Slava,
yes I updated Crystaldiskinfo to the recent version. I have also updated PDF24 from 8.0.4 to the new 8.1.1 and from 8.0.1 to 8.1.1 on another machine at the moment I cannot reproduce the problem with Active Protection :( maybe there is something else needed to trigger the behaviour.
for the Crystaldiskinfo thing I have no logs but for the PDF24 that I reported above I am in contact with the support dept and they have all logs except their requested Procmon, as I am not able to repro it, as you know if you click on allow once in Active Protection you cannot remove the allowance anymore. it will be not handled in the exceptions. I have raised this behaviour in the NG beta but they said it is as designed.
- Se connecter pour poster des commentaires

Issue was not reproducible anymore.
- Se connecter pour poster des commentaires

I can confirm that the problem is not in the latest ATI 2017 NG build.
Ian
- Se connecter pour poster des commentaires

Thanks a lot Ian!
- Se connecter pour poster des commentaires
En réponse à Hello par truwrikodrorow…

Hi,
is there any other way to report false-positives?
Thanks in advance.
Sven
- Se connecter pour poster des commentaires

Sven, welcome to these User Forums.
Please see KB 60193: Acronis True Image 2018: Active Protection blocks legitimate applications
If you find that the above techniques do not resolve the issues you are seeing, then please open a Support Case directly with Acronis to bring this to their attention.
- Se connecter pour poster des commentaires