Norton and ATI Active Protection.
OK, don't want Norton when scanning drives to access the ATI backups.
So, when Norton runs its scans, ATI Active Protection pops up and ask if I want to allow access. I say NO. However, that it seems is NOT saved anywhere? There is a WHITE LIST to allow programs though.
Norton of course always gets updated to a newer version periodically as well.
Here is what Active Protection looks like:
As you can see, Norton has had a few version that were blocked. I'll assume when my wife got the notice she said to block it. Looks like Access Protection knew enough to remove the old version, but she's still getting the notice every time ATI runs. How can Norton be permanently be stopped and not be asked for permission?
Also, why it Active Protection stopping RUNDLL32.EXE from accessing the Registry?
Her PC is W10 Pro x64. I'm on W11 Home x64, and I don't see that on my ATI Active Protection (I am running McAfee) other than the RUNDLL32.EXE as well?
On BOTH PC's, as far as I can tell, nothing seems to have happened adversely due to the prevention.
So, I have 2 questions:
- How to we stop the prompt for Norton 'access' and always NOT allow access for any version of the program?
- Why is RUNDLL32.EXE blocked and how to allow it?
Well, I guess each of those are 2 questions, a 'Why?' and a 'How?'
Alternatively, how can I determine WHAT is trying to be accessed/written to the Registry?
By the way, I can see this on my PC for instance:
First the RED CIRCLES, those columns can not be changed at all to allow seeing the full name of the process. However, I can RMB on it and see it.
Note the Permissions for RUNDLL32.EXE... No mention of not allowing Registry Access?
Attachment | Size |
---|---|
Capture.JPG | 137.75 KB |
Capture1.JPG | 156.46 KB |
Capture2.JPG | 126.46 KB |


- Log in to post comments

Thanks Steve,
Still sort of confused on Norton?
Why just Norton? I'm using McAfee (along with Windows Defender) and it doesn't happen to me (also on W11)?
Wondering if I had blocked McAfee a long time ago so I don't see it, however it seems that Norton EXE moves to a different folder when it is updated, and the path therefore doesn't match what AAP had, hence the notice.
I am assuming that would be it and McAfee uses the same path all the time?
My old PC which was running Norton too I don't recall seeing the problem though? That was 'decommissioned' over 7 months ago so I could be wrong? I might have seen it too and 'lived with it'?
Yeah, RUNDLL32 like SVCHOST does the work for many other processes. Expanding it in Task Manager or other programs that look at running tasks can help determine who/what it is acting on behalf of. Not too worried about 'who', but the message has nothing to do with ATI, but AAP reporting the Process was prevented from accessing the Registry, not ATI programs or backups? I can't correlate the time stamp to any specific application, and I don't think it was ATI either but it could be? Not due to a power on/off either or else I'd have it every day?
Why would AAP stop anything from accessing the Registry?
- Log in to post comments

Irv,
In my opinion your issue can only be fully addressed by deciding which protection product is best for you to use and uninstall or disable the rest.
You might find it beneficial to read some of the many kb articles related to this topic Here
- Log in to post comments

Irv, sorry but all I can say is that AAP is working as Acronis has designed it to do and this would apply to any application which tries to access / scan / check the files that AAP is protecting, or which exhibits any behaviour that would suggest that of malware / ransomware or virus behaviour.
- Log in to post comments

Steve. after you posted the FAQ's I then went and read many of them.
I guess I'm used to Norton, it protects itself (Norton files) and I assumed AAP did the same for backup files and its program files and data only,
I can 'fix' Norton by having it exclude the whole backup disk I guess?
Registry, well that presents a problem... not sure what I should do? RUNDLL32 on the Whitelist? Before I do that, I want to KNOW what is 'it' trying to do on both our PC's? Can't tell if it was trying to do a READ or WRITE? Suspect either could be the case. Some program either trying to read some data to display, it can't, so it shows a blank or a default I guess? No harm done in that case, especially if I use the default value. Maybe the same for a WRITE? Can't write what it wanted to save, but I'd expect a Program error then?
Any suggestions on how to discover what the app is and what it was trying to do via RUNDLL32?
RUNDLL32 is used to execute a section of code in a DLL that is loaded (or may load the DLL and then execute). Why it is trying to access the Registry I don't know?
Any suggestions on this as RUNDLL32 can be used to access the Registry it seems.
- Log in to post comments

I find the ongoing requests from Norton annoying - the problem is with Norton, not Acronis. If the backup is encrypted, then granting permission will not serve any useful purpose; if it is not encrypted, not sure if Norton would be able to make any sense of it. However, it would be useful if there was some way to black-list Norton requests to scan *.tib and *.tibx files.
Ian
- Log in to post comments