User's Manual

125 Copyright © Acronis International GmbH, 2003-2020
 Cloud backups
If Acronis True Image 2021 finds a good temporary copy, the file is restored from that copy. If
temporary file copies are not suitable for restore, Acronis True Image 2021 searches for backup
copies locally and in the cloud, compares the creation dates of the copies found in both locations,
and restores your file from the latest available non-corrupt copy.
Note Acronis True Image 2021 does not support file recovery from password-protected backups.
To configure Acronis True Image 2021 to automatically recover files after blocking a process, select
the Automatically recover files after blocking a process check box in the Active Protection settings.
See Configuring Active Protection (p. 126).
Real-time Protection
When Real-time Protection is enabled, it constantly checks the files you interact with to protect your
machine from suspicious activity, viruses, and other malicious threats in real time.
Real-time Protection comes with the following additional protection options:
 Behavior analysis – to identify malicious processes, Active Protection uses behavioral heuristics.
It compares the chain of actions performed by a process with the chains of events recorded in
the database of malicious behavior patterns. This approach enables Active Protection to detect
new malware by its typical behavior.
 Exploit prevention – Active Protection analyzes the behavior of processes running on the
machine and detects abnormal activity. It prevents infected processes from spreading and
exploiting the vulnerabilities of other software installed on the system. Active Protection
employs several exploit prevention methods:
 Memory protection detects and prevents suspicious modifications of the execution rights on
memory pages. Malicious processes apply such modifications to page properties, to enable
the execution of shellcodes from non-executable memory areas like stack and heaps.
 Privilege escalation protection detects and prevents attempts for elevation of privileges
made by an unauthorized code or application. Privilege escalation is used by malicious code
to gain full access of the attacked machine, and then perform critical and sensitive tasks.
Unauthorized code is not allowed to access critical system resources or modify system
settings.
 Code injection protection detects and prevents malicious code injection into remote
processes. Code injection is used to hide malicious intent of an application behind clean or
benign processes, to evade detection by antimalware products.
You can choose one of the following types of scanning:
 Smart on-access detection means that the program runs in the background and actively and
constantly scans your machine system for viruses and other malicious threats for the entire
duration that your system is powered on. Malware will be detected in both cases when a file is
being executed and during various operations with the file such as opening it for reading/editing.
 On execution detection means that only executable files will be scanned at the moment they are
run to ensure they are clean and will not cause any damage to your machine or data. Copying of
an infected file will remain unnoticed.
You can view the results of real-time protection checks in the Activity tab of the Protection
dashboard.