Active Protection, Monitored Process window problems.
Irv, ATI 2020 #20770 is the current version in use.
If AAP is not reporting any issues / activity for rundll32.exe then I do not understand why you are trawling through the logs looking for entries related to it?
The logs contain a whole lot of informational entries that only show that AAP is working normally so you are just chasing shadows for a non-existent issue.
I know it is the most recent, I checked the account d/l.
I am not really trolling, I'm trying to understand why I have it reported, my wife didn't, and now it seems it is gone as a report, yet the log entry is still there? I've not seen it in the last two days of boots, but the same statement is in the log file?
When I first started looking in the log file I saw other oddities (as I posted) in the log. Some which were fails (errors) and not listed in the Activities?
If the Activity entries are incorrect or missing, how can one assume it is working as designed?
Right now my thoughts are one of two things are going on, a timing issue, that is it couldn't post it to Activities for some reason or the trigger to post it wasn't happening (it isn't the log entry I found possibly that is the trigger) or that was a false positive as some operation later on worked OK and did what was needed?
Would you think the same way if you looked in the log and found an error or some statement that you think indicated there was a problem and it wasn't listed in Activities?
Do you have 100% confidence that the Activity list is complete and correct? That AP is completely protecting you?
From my point of view I have confidence in AAP. It has twice saved the system I use everyday from ransomware infection and allowed me to recover the few files which were modified by the attack which not other product to my knowledge can do.
I also find AAP to be matured now and does not report false positives as often as when first introduced. I have another security suite installed and it also has ransomware protection and both these products get along nicely without my having to tell each one about the other.
I bet in your case that AAP has learned that this rundll32 process on your machine is normal and has adjusted to that being the case. It is still monitoring the process thus why you see it in the logs. If at anytime a running process begins encryption that process will be halted and you will receive notification and asked to confirm that you have authorized the process. If you have not then the offender will be quarantined and any effected files will be recovered for you.
Protection of network NAS connections is also provided with the feature which is a great addition as well!
I'm waiting now for a call from Support (15 minutes late).
Log still shows the warning from rundll32 but Activity does NOT any longer show this. PeaZip continues to produce an entry in Activity that it was prevented from accessing Acronis files when I tried to open the .GZ log file, but it did work and I could use NOTEPAD to see the log. I've set PeaZip to allow it to modify backups (this may not allow it to process other Acronis files possibly) so maybe this was more a warning than anything else as it was operating on a file in a programfiles/acronis sub-folder.
We'll see what I learn from Support if they do call in?
45 minute phone and teamviewer session.
End result, it (AP) is working fine. Don't know why the rundll32 entry shows in the log, but I can exclude it from AP is I don't want to see those Actvity entries.
So, unless I can find out what 'did not happen' since it was blocked, I'll consider this closed.
Guy how called seemed to know his was around, intelligent, and asked the right question, like did I do a REPAIR install.
As for Peazip, didn't really have an answer for that? Said I could exclude it from AP if I don't want to see the message every time I use it to look at the logs. To me, that sort of bypasses the problem, but it does work.
Oh well, time will tell if I have a real problem, but I sort of doubt it as it doesn't have the same 'quirk' on 2 PC's here. As I go further into the log files there are just too many entries that seem to indicate the same thing being performed over and over, and sometimes I do see errors. I'm not starting to think this was one of those cases where an error appears (actually it is labeled a warning) and at some point either before or after that the needed operation was performed. That would make me think this is a result of a timing issue and it is tried a few times until it works? Could be wrong though?