Active Protection Won't Turn On in Build 9660

Good, at least Bitdefender is cleared. As I said, of my 2 PCs, both with Bitdefender and Win 10 Pro, one works and one doesn't.

I'm thinking the True Image I wanted was 2017...

DarrylB,

Hmmm...

Like you, my Win 10 Home works, while my Win 10 Pro does not.  My Win 10 home is 32 bit, my Win 10 Pro is 64.

In TrueImage 2017, I was having issues on  the same Win 10 Pro PC with the tray icon indicating a backup in progress not appearing. Sometimes, manually starting TrueImageMonitor.exe during a backup would restore the icon, sometimes not. They never fixed that in 2017. In 2018 so far that tray icon seems to be working, but it is tied to the Active Protection icon, which I really don't want to see, especially if it isn't working. I'm really tempted to reinstall 2017 and ask for a refund, but I guess as long as the actual backups are working, I can hold off and help Acronis and the community find the solution.
Funny, for my most critical installation, an alternate Windows 7 boot from which I restore Acronis Win 10 backups when I need to, I use TIH 2014 - never had a glitch restoring.

I was using the build prior to 9660 and it all worked fine. I upgraded from 2016 and I really like 2018. I'm sure they'll get it sorted in short order. I've been using True Image since version 10 (before they started using years for the version), so probably 10 years or more. It has saved me countless hours recovering from system failures, hardware upgrades, user mistakes, etc. Over the years, my experience has been positive so I'll give them the benefit of the doubt that this is just a hiccup in this new ransomware protection feature.

With the news full of security breaches at companies large and small, I assume I'm just as vulnerable to being hit as next guy, despite running up to date software, best practices, not opening suspicious emails, etc. I like the idea of having another layer of protection against ransomware that protects my backups as well as my current system. 

I was using Crashplan for offsite backups but they are going away from the consumer market. I'd already been using True Image for system images and data backups to external hard drives. When I saw the new version contained the new AP feature that protected backups locally combined with cloud backup, I decided to try it out. They've had a couple of missteps out of the gate with 2018 (AP and USB 3 drivers which they fixed in short order) but I like the premise of the protection and I'll hang around to see how things go.

I dont know if this helps anyone. I recognized that some of you also have a samsung hdd.

I had the same problem. With build 9660 the active protection service in true image was always shown as disabled even though it is running.
I created the system report and recognized that i had several disk errors with my samsung 850 pro.

Therefore i deactivated the rapid mode of my samsung ssd with the magician tool and repaired acronis 9660.

Now it works!

maidou7, welcome to these User Forums.

Thank you for sharing your insights into this problem, it is always good to get positive updates and is something that the other users can check for on their computers if they are running Samsung Magician.

I have a Samsung EVO 850 on one of my troublesome computers. I see no disk errors in the system report and I see that rapid mode is already off in Samsung Magician. I have an Intel SSD in my other computer where AP is not working properly. And I have a Crucial SSD in my laptop where AP does work.

I just loaded the new version on a Windows 7 Pro machine and I am experiencing the failure. My Windows 10 Pro machine works fine.

Here is something I noticed in the anti-ransomeware.0.log file on the failing system:

2017-10-02 12:30:00:236 3792 I00000000: Starting driver session (91EF005F-CD9A-4141-96A-684D471299EE) ...
2017-10-02 12:30:00:611 3792 I00000000: Failed to start driver session (91EF005F-CD9A-4141-96A-684D471299EE): Error code 801f000b
2017-10-02 12:30:00:611 3796 I00000000: Starting to retrieve index: success
2017-10-02 12:30:03:653 3796 I00000000: Handle 0803ABE8 (http://dl2.acronis.com/u/anti-ransomware/ati/2018/index) has finished retrieving content: success
2017-10-02 12:30:03:653 3796 I00000000: Handle 08043340 (http://dl2.acronis.com/u/anti-ransomware/ati/2018/index.signed) has finished retrieving content: success
2017-10-02 12:30:03:653 3796 I00000000: Verification of signed retrieval ID = 0: success
2017-10-02 12:30:03:653 3796 W00000000: Current version of 'FileProtection' = 2 (most recent version = 2)
2017-10-02 12:30:03:653 3796 W00000000: Current version of 'SelfDefense' = 2 (most recent version = 2)
2017-10-02 12:30:03:653 3796 W00000000: Current version of 'ImageWhiteHashList' = 7 (most recent version = 7)
2017-10-02 12:30:03:653 3796 W00000000: No update found for 'ImageBlackHashList'
2017-10-02 12:30:03:653 3796 W00000000: Current version of 'SelfDefenseImageWhiteHashList' = 2 (most recent version = 2)
2017-10-02 12:30:03:653 3796 I00000000: No component updates to retrieve; update finished
2017-10-02 12:31:31:883 1108 I00000000: Device interface \\?\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f} has been attached
2017-10-02 12:31:38:981 1108 I00000000: Device interface \\?\UMB#UMB#1&841921d&0&IPBusEnumRoot#{65a9a6cf-64cd-480b-843e-32c86e1ba19f} has been attached
2017-10-02 12:31:42:335 1108 I00000000: Device interface \\?\IPBusEnumRoot#UMB#2&ba1ffa4&0&uuid:102CF8B5-C609-6E6E-0176-201CA24B5B54#{65a9a6cf-64cd-480b-843e-32c86e1ba19f} has been attached
2017-10-02 12:31:46:048 1108 I00000000: Device interface \\?\SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{cac88484-7515-4c03-82e6-71a87abac361} has been attached
2017-10-02 12:31:46:048 1108 I00000000: Device interface \\?\SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{78032B7E-4968-42D3-9F37-287EA86C0AAA} has been attached
2017-10-02 12:32:06:952 2236 I00000000: Active-Protection service shutting down
2017-10-02 12:32:06:952 2236 I00000000: Executor 'service' is stopping
2017-10-02 12:32:06:968 2236 I00000000: HTTP server is stopping
2017-10-02 12:32:06:968 3792 W00000000: Failed to stop driver session: Session already stopped

I was playing around with the on/off status and while I cannot match up the times, I find this sequence about 5 times in the log.

On the working system, I see the following:

2017-10-02 08:08:09:702 7092 I00000000: Starting driver session (9B5F89E3-F8EF-4365-B5F4-E73C2634F879) ...
2017-10-02 08:08:09:716 6576 I00000000: [driver] Process  [1 (internal), 476 (system-wide), "C:\Windows\System32\smss.exe"] has started (parent PID = 0 (internal))
2017-10-02 08:08:09:740 6576 I00000000: Verification of "C:\Windows\System32\smss.exe" by embedded certificate: success (0)
2017-10-02 08:08:09:740 6576 I00000000: "C:\Windows\System32\smss.exe" can be trusted
2017-10-02 08:08:09:740 6576 I00000000: Setting the trust status of [1 (internal), 476 (system-wide), "C:\Windows\System32\smss.exe"] to 'white listed': success
2017-10-02 08:08:09:740 6576 I00000000: [driver] Process  [2 (internal), 632 (system-wide), "C:\Windows\System32\csrss.exe"] has started (parent PID = 0 (internal))
2017-10-02 08:08:09:746 6576 I00000000: Verification of "C:\Windows\System32\csrss.exe" by embedded certificate: success (0)
2017-10-02 08:08:09:746 6576 I00000000: "C:\Windows\System32\csrss.exe" can be trusted
2017-10-02 08:08:09:746 6576 I00000000: Setting the trust status of [2 (internal), 632 (system-wide), "C:\Windows\System32\csrss.exe"] to 'white listed': success
2017-10-02 08:08:09:747 6576 I00000000: [driver] Process  [3 (internal), 720 (system-wide), "C:\Windows\System32\wininit.exe"] has started (parent PID = 0 (internal))
2017-10-02 08:08:09:753 6576 I00000000: Verification of "C:\Windows\System32\wininit.exe" by embedded certificate: success (0)
2017-10-02 08:08:09:753 6576 I00000000: "C:\Windows\System32\wininit.exe" can be trusted
2017-10-02 08:08:09:754 6576 I00000000: Setting the trust status of [3 (internal), 720 (system-wide), "C:\Windows\System32\wininit.exe"] to 'white listed': success
.
.
.
2017-10-02 08:08:10:520 6576 I00000000: [driver] Process  [115 (internal), 6628 (system-wide), "C:\Windows\System32\svchost.exe"] has started (parent PID = 0 (internal))
2017-10-02 08:08:10:520 6576 I00000000: "C:\Windows\System32\svchost.exe" can be trusted (cache)
2017-10-02 08:08:10:520 6576 I00000000: Setting the trust status of [115 (internal), 6628 (system-wide), "C:\Windows\System32\svchost.exe"] to 'white listed': success
2017-10-02 08:08:10:520 7092 I00000000: Driver session (9B5F89E3-F8EF-4365-B5F4-E73C2634F879) started successfully

My suspicion is that this failure to start the driver session is the key to the problem. I have no idea why it would be happening. In both systems, there is no error in creating the driver session. If someone has an open support case, please direct Acronis to this.

My wife's PC, on which Build 9660 is working correctly, has a Samsung 850 (not pro) with Rapid Mode enabled.

Just checked 4th machine (installed the update yesterday) and Active Protection is working - the system has Norton.

One possible anomaly is that Active Protection may not have started working until after I ran the App and accepted the licence agreement (the latter happens when installing a new build). If I get a chance I will investigate further - I am sure the system tray icon did not display the status before I accepted the licence agreement but that could just be a seniors moment on my part.

Ian

Ian, AP does not work even after accepting the license agreement (for those who have the problem).

I opened a case with Acronis so they have more info, it won't work after repairing and stopping protection and firewall of ESET Endpoint Security 6.5

Just to add some fun variety to this issue, I now have the problem on two computers. On one, the tray icon says it's active but the UI says it isn't. On the other, the tray icon says inactive but the UI says it is active. Right hand .. left hand .. 

Same exact problem.  Updated from 2017 to 2018 perpetual.  I opened a trouble ticket on the first, but have not heard a word yet

Hello guys, I've faced the same problem until I've removed my empty SD card reader. Now everything is working smoothly. I think there is some kind of an issue related to card readers so let's just wait for a fix.

And the award goes to IAM314! Bingo!

I just plugged in my USB card reader and rebooted on my machine with a working AP. After reboot, the failure was there.

I unplugged the reader and rebooted and all is OK again.

My other Windows 7 system has a built in card reader, hence its failure.

Thanks for this info.

IAM314, welcome to these User Forums, thank you for sharing your solution to this issue which sounds to be working for some of the users hit by it!  Hopefully with this additional information the developers will be able to produce a fix to roll out to all users.

The card reader may be an issue for some. My laptop on which AP is working has a built in card reader. I have an external card reader on the desktop machine. I'll try unplugging it to see if it begins working.

Edit:

Unplugging the empty card reader on my desktop machine allows AP to work as expected. Reconnecting the card reader causes AP to stop working. My laptop with the built-in card reader continues to work as expected. I'm running Win 10 Creators Update on both machines.

On my laptop I receive the "Interrupted action" message but I never see the second popup message. On the desktop with the reader disconnected I get the "interrupted action" message which is more detailed then the laptop. I also see the second popup window. So the laptop appears to be working but I never see the second popup. Possibly still a bug there.

I do indeed have a built-in SD card reader on my machine that does not work.  I do not have one on my machine that is working.

I think if you simply disable it in device manager it would also help. I guess if it is empty you are still not using it at this very moment anyways. It's quite inconvenient though so I hope this problem will be taken care of.

Thanks IAM314, I have a built-in SD Card, I disabled it, rebooted and it still didn't finish loading, it said it wasn't active on the small icon  next to the cock but inside ATI it said it was loaded and the service was started. I had to set up again to protect ATI files from ransomware and now it works as before. THANKS!!! :-)

Unplugging my external USB card reader and rebooting has allowed my problem system to work properly too. Thanks to all who posted the workaround. Now lets wait for a permanent fix !

I have a built-in multipurpose card reader installed in a drive bay in my case -also has USB, e-SATA and firewire interfaces. I tried disabling the card reader components in Device Manager - did NOT fix. I don't use any of the components regularly, but I don't see why I should start taking my PC apart so TrueImage will work. Looking for that update!!

I just manually disabled the 5 card reader devices on my Windows 7 machine, which are in a drive bay and connected to an internal USB 3 port on the M/B. I restarted the service and the UI. The result was a bit inconsistent between the notification icon and the UI. A reboot solved that and all is well with AP. Good thing I never use that card reader any more.

Next step is to see if re-enabling the card readers will cause it to continue to work (at least until the next reboot). Have to wait for my wife to stop using that machine.

Ha! Disabling the permanently-installed card reader in Device Manager didn't work, but I went back and also disabled the internal USB Universal Host Controller that USBTree showed the card reader was attached to, rebooted, and Protection is on!
So that definitely seems to be the source of the issue for many of us! Thank you all for leading to the (temporary) solution. In my case, I essentially never use the card reader, so I could leave it disconnected.
I could also go back to TrueImage 2017...

I can now also confirm as that disabling the SD Card Reader in Device Manager solves the problem.  I can also confirm that problem reappears when card reader is re-enabled.  I DO use my SD card reader so I am awaiting a proper fix.

I am impressed by this discovery - none of my Desktops has a card reader. My Dell notebook has one but I have never used it; just checked and it seems to be working OK.

Ian

Mine started working when I uninstalled PerfectDisk Pro. A utility that keeps disks unfragmented on the fly. Removeing the card reader had no affect.  Only problem now is NextPVR cannot delete shows.

Acronis Active protection is not ready for prime time imho.

I wonder if this is related to the USB 3 driver issue that required an update right out of the gate for TI 2018. Is there a correlation between USB 3 card readers causing troubles and USB 2 (maybe built in to laptops) working fine? 

Also, I just received the following reply to my support ticket:

... we have analyzed your logs and see that the issue needs deeper investigation from our development. I have escalated your case to our development. Normal processing time of cases in development department is three - four weeks. I have notified the developers that the issue is urgent and hope that I will get any information during next week but unfortunately I cannot promise you for sure that it will take place. I will surely come back to you with update to this case on or before Oct 31, 2017.

My internal card reader was on the Intel ICH10 motherboard controller - not USB3.

"Only problem now is NextPVR cannot delete shows." This should be easy to solve by adding the relevant exe files to the white list.

I have just tried removing my card reader and rebooting . Voila! All is working as it should. I have an open case with Acronis, so I will update them with this finding.

Excellent discovery - we are on the way to getting this resolved fully.

Hello Everyone,

We've published a KB article on the issue 60469: Acronis True Image 2018: Active Protection toggle turns off automatically if an empty card reader is connected. 

Our development team is actively working on the permanent fix. 

Thank you!

Wow, yes now it works, but i even had to switch off my USB connected HP Officejet8620 because the sytem seet it as a drive.

Anyway thanx for the workaround.

My backups are going fine with 9660 build of TI2018.

But I have this same "Active Protection Off" showing in the dashboard issue after doing the Acronis notified in-place upgrade from the previous TI2018 build to this 9660.  The dashboard says that active protection is off, but the icon in the tray indicates it is on.

This is on a Windows 7 x64 System with 16 GB RAM

I have not opened a case with Support, as I do not believe it to be a problem with my system or any failure during the actual in-place upgrade to 9660, but some bug in the 9660.

Please post here if Support finds the actual solution to the problem.  I really don't want to play un-install and re-install game and giving logs to Support.  I think from this thread there have been plenty who have already gone through all that.

Scott

Scott. A work around has been posted by support https://kb.acronis.com/content/60469. No uninstall is required.

Same problem with broken 'Active Protection' within build 9660, as everyone else. I have just reverted back to an earlier version of ATI 2018: build 9207. With this build, 'Active Protection' is now working normally. I won't reinstall build 9660, but will wait for a patch to be issued.  

@Michael Shields, A work around has been posted by support https://kb.acronis.com/content/60469. No uninstall is required and you can use build 9660

Hi about same here, my win 10 pro 64 bit does not have system tray icon and will not let me turn it on in program. Now if I look at my services it says it is running. I did do online live support chat and the tech support used Team Viewer to take control and try to troubleshoot the problem with no luck. What he did do was create about 4 troubleshooting log files and uploaded to a ftp site to pass on upper level support.  My laptop running win 10 64 bit went right on minus system tray icon but everything else appears to work

Ross, welcome to these User Forums.

Please see the following statement by Ekaterina of Acronis Support in an earlier post above yours in this topic:

Quote: Ekaterina

Hello Everyone,

We've published a KB article on the issue 60469: Acronis True Image 2018: Active Protection toggle turns off automatically if an empty card reader is connected. 

Our development team is actively working on the permanent fix. 

Thank you!

I have the same problem. As I do not like to disable my card reader in Windows Device Manager as I use it very often, I came up with the following workaround that works. When I have a SD card in my card reader all the time, Active Protection is on all the time. I hope this is a temporary situation as this should not be necessary. I recently choose Acronis as my backup software as I thought it was the best solution on the market.

Martin, welcome to these User Forums.  Keeping a spare SD card in the reader should be fine as it will present a valid card file system which seems to be part of the issue with AAP here.  The Acronis developers are aware of the problem and working on a resolution.

I just wanted to add my two cents worth.....

I installed a licensed copy of ATI 2018 today and did a complete backup to an external drive. Same problem, AAP could not be turned on via the menu, but it was showing as running in Windows Services.

Later, I realised I hadn't setup the Acronis Secure Zone. As soon as I did this, the AAP became active!

I'm not 100% sure if AAP only works when ASZ is enabled, but it worked for me.

This image shows how I initially backed up. I deleted the backup, installed the ASZ and then ran a backup again (to ASZ).

At least I found that if I disable my card reader, turn Active Protection ON and then OFF, it turns off properly - both the application and tray icon show OFF. Then I can turn my card reader back on. I would rather have the card reader than Active Protection for now, and at least this way I don't have to look at an obvious contradiction... Backups still work fine; that's what counts.

9660 update is Garbage. Opened a ticket and have received NO communication.

I have same problem as listed but I don't have a Cardreader installed..

Hopefully a fix will be available soon, as on mine although it shows Enabled in systray , it in fact isn't, (the Service is running in services.msc), as I can delete backup files without any error or warning message from Acronis 2018.

Just wondering if the worst happened and someone was hit by Ransomware because this feature wasn't running as it should, how they would stand.

No doubt there in the small print there is a get out clause.

Alan, have you opened a Support Case with Acronis for this issue - this is important given that you don't have a card reader so don't fit into the same pattern that Acronis are looking at.

As to 'small print' then you would need to get an official statement from Acronis on any liability they might admit to in respect of using AAP - I very much doubt that they would offer anything as this is a software product not an insurance protection policy, otherwise the price of the product would be a lot higher for certain!  Your main protection is to have full backup images which are stored away from your computer and therefore not at any risk from malware, ransomware etc.

Alan and Steve maybe it is not only the cardreader I notified dat my HP connected printer (Officejet Pro 8620 via USB) have an usb connectiont for printing docs and foto's before AAP started it was neccesary to put a usb stick in de printer

Hello Alan,

Could you check that the option "Protect Acronis True Image files" is enabled?