Beware of Acronis "Leftovers" Issues

[Page42]

@Arvy
I want to (and intend to) follow your steps after a normal uninstall, and not use the Acronis Cleanup Utility. For one thing the Acronis tool says to disable Windows 7 integration in the program prior to uninstalling, but this is impossible for me to do as the 30-day trial has expired and the program is now inaccessible... so another strike against the Acronis Cleanup Utility, eh?

Hopefully, the following section of yours addresses Windows integration:

In addition, for Windows 7 only, normal Backup and Recovery control panel functions may be disabled by alterations or deletions of the following registry entries shown as they should be for normal functionality:

[HKEY_CLASSES_ROOT\CLSID\{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\Instance\InitPropertyBag]
ResourceID = 14 (as hexadecimal value or 20 as decimal value)
ResourceDLL = %SystemRoot%\System32\sdcpl.dll (as REG_EXPAND_SZ value)

If Acronis has also hijacked registry key ownership and permissions, see http://www.winhelponline.com/blog/fi...is-true-image/ for more help.

Am I correct in that, Arvy?

In carefully perusing your steps, I do have another question or two prior to going for the uninstall.

1) Are all of the removal steps done in the registry, or are any of the services stopped and then disabled in Admin Tools\Services?
2) In your #2... "Removal of any residual Acronis 'required for boot' (start=0x00000000) services", do I simply delete Start in the registry for all of the listed services (fltsrv,timntr,vsflt, etc)?

I should note that I am no expert with reg edits, but I have been in there a few times, and have edited the registry as needed. So I am not a novice, but at the same time, when I see something I am not sure of, I must ask. I can't delegate this task to someone else (I am the someone else), and I don't want to delegate anyway. I just need a little more guidance.

By the way, the more I ponder this uninstall, the more annoyed and discouraged I get with Acronis for handling their business in such a manner.

[Arvy]

The term "Windows integration" is used by Acronis to refer to several context menu items (for mounting/validating *.TIB images, etc.) as well as ATIH's takeover of the Backup item in the Windows control panel. The part of my original posting that you quoted is intended to assist with that control panel takeover issue if a normal uninstall of this latest ATIH update doesn't do that for you. However, I can't speak from first-hand experience in removing expired trial versions and the quoted section is not a "cure-all" for every aspect of so-called "Windows integration" that Acronis might leave behind in those circumstances.

There is no way to stop "required for boot" (start=0x0) services in the Windows Management Interface (WMI) prior to removal from the registry of the device class filter entries that use them. Don't even try. Just follow the steps PRECISELY in the EXACT ORDER given. The essential first step is removal of the upper and lower filter entries from the disk and volume device classes in the system registry. After that, and ONLY after that, you can then remove the services themselves from the registry. Removal of the driver (*.SYS) files used by those services is absolutely the LAST step to be taken. In fact, that last step is optional once all of the relevant registry call-ups have been eliminated.

I agree that Acronis has created a very unethical trap for the unwary, but I don't know what else I could possibly say or do about it. They don't allow me to post any more help or advice in their own forums.

[majoMo]

Originally Posted by Page42

2). I saw one reference in this thread to Revo, and I'd like to know if you advise against letting Revo Uninstaller Pro handle the ATI uninstall, due to the automatic nature or sequence of the process?

Always an interesting point.

Once Revo Uninstaller Pro [Free also] is unable to handle with app. that need to reboot to uninstall (or when is recomendable to reboot), isn't adviced to use it at all.

Using Arvy'method is far better!

Good luck.

[Page42]

Originally Posted by Page42

2) In your #2... "Removal of any residual Acronis 'required for boot' (start=0x00000000) services", do I simply delete Start in the registry for all of the listed services (fltsrv,timntr,vsflt, etc)?

[Arvy]

After removing the device class filter entries that use the services, you can then remove the services themselves. I mean by that the complete entries ("registry keys") under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services branch for those services, not just their Start=0x00000000 enties. In the case you've illustrated, that would be the complete "fltsrv" item.

[Arvy]

Originally Posted by MarcP

It's gotten to a point where Acronis forum MVP's are questioning whether there will be an ATI 2013 product or not...
http://forum.acronis.com/forum/32700

Looks like Acronis is not easily discouraged by a few teensy problems experienced by mere users -- not even their own MVPs and certainly not those insignificant trial users caught in their spider web trap.

Despite being banned from their forums, I've just received an email message saying that they're "pleased to announce our Beta release of Acronis® True Image Home 2013." They even have the unmitigated gaul to assure me that: "Your opinion counts, join now!" Me? Really?! Join how?!!!

Uh, thanks I guess for the promise that this time "Our target is to make this product ultimately stable and reliable from Day 1 of commercial launch." I can't help wondering if that should not always have been the "target" and somehow I have serious doubts about its sincerity and accomplishment in the current circumstances.

In any case, no thanks just the same! I'll stick with a product that has proven (to me at least) that it can do the job without BSOD "leftover" traps.

[Page42]

Originally Posted by Arvy

In addition, for Windows 7 only, normal Backup and Recovery control panel functions may be disabled by alterations or deletions of the following registry entries shown as they should be for normal functionality:

[HKEY_CLASSES_ROOT\CLSID\{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\Instance\InitPropertyBag]
ResourceID = 14 (as hexadecimal value or 20 as decimal value)
ResourceDLL = %SystemRoot%\System32\sdcpl.dll (as REG_EXPAND_SZ value)

All went well with removal, as near as I can tell, except for I do not have access to normal Backup and Recovery control panel functions. When I click on it in Control Panel, nothing happens. Here is what I have in the registry, instead of what you have outlined above:



How do I go about getting normal Backup and Recovery functions enabled?

[Arvy]

Well, to begin with, that .CLSID key (with a preceeding dot) is not the one we want to look at. I have no idea how that might have got there, but we want to check the HKEY_CLASSES_ROOT\CLSID\{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\Instance\InitPropertyBag entries as stated. No dot in the CLSID key name.

If the entries under that registry key (the correct one) are not as specified in the OP that you quoted, then they need to be changed so that they are what they should be. If you run into permissions difficulties making those necessary changes, then refer to the more detailed instructions that are linked in that same section of the OP.

[Page42]

Wha lah, baby!



ResourceID was 75acc04b and the ResourceDLL was blank.
Inserted your info and now I have Backup and Recovery control panel functions enabled!

[Page42]

Kudos to Arvy for the great thread.
It's one of the most helpful I've seen in five years here at Wilders.
Thank you, Arvy.

[Arvy]

Thanks for your follow-up and the kind words. I'm happy to be able to "pay back" just a small portion of the help I've received from others over the years. Glad that it all worked out for you and that you now have a clean platform for whatever alternative you may choose.

[Page42]

I gotta tell ya, Arvy, the more time I've had to ponder this Acronis fiasco, the angier I could become, and I only say could because my system is not damaged and I have you to thank... and that's not laying it on too thick, that's telling it straight.

When you consider that I was running a free trial, and upon removal, that trial software still left me with normal Windows Backup and Recovery control panel functions disabled by altered and deleted registry entries... well, to me that seems as bad as malware having its way with my machine.

The trial locks a user out upon expiration, with no opportunity to go back into the program to reset anything, and to my thinking (which is actually giving Acronis some benefit of the doubt), that creates a very bad removal scenario. And this is only the disabling of Backup and Recovery... apparently there are other hazards and entanglements awaiting the unsuspecting Acronis users.

Last time a company took such liberties with customers (and potential customers) I made a very definite point to never ever spend another dolllar of my money on any of their products, and I'm here to tell you that has been a very easy promise for me to keep. I have now written Acronis off in the very same manner. There are simply way too many options out there for me to do otherwise.

[Arvy]

Agreed. Setting such a trap for innocent trial users is the dirtiest trick of all. If ATIH 2012 were a drug, it would require labelling to warn against practically irreversible and potentially fatal side-effects.

[MarcP]

Watch for this thread to be deleted as soon as Acronis wakes up in the morning:

http://forum.acronis.com/forum/33483

[Page42]

Originally Posted by MarcP

Watch for this thread to be deleted as soon as Acronis wakes up in the morning

I had to call Acronis support 4 times in order to get the crap software removed from my system. Finally they got it removed and after 2 more hours I was able to get my system stable again.

He may not be aware of what is still lurking, and I can say from experience, he ought to try opening Windows Backup and Restore in Control Panel. Acronis trial version had disabled that feature on my machine, and it was Arvy's spot on assistance that got it back up and running for me. I cringe at the thought of having to deal with their tech support to try to sort that out.

[Arvy]

Originally Posted by The above linked Acronis forum thread

The installer messes around with the Window registry and who knows what else. The bottom line is the Acronis developers do not have any idea what they are doing to people's systems with the installer or care how much they screw someone's system up. Clearly these developers are morons.

The author of that Acronis forum comment is much too kind. The fact is that they know exactly what they're doing. They've certainly been told often enough.

As for not caring, making their software practically unremovable and a trap for trial users might have certain "bottom line" consequences that they do care about.

[Page42]

Originally Posted by MarcP

Watch for this thread to be deleted as soon as Acronis wakes up in the morning:

http://forum.acronis.com/forum/33483

Thread is gone, as predicted.

[molitar]

Are we suppose to delete the files in drivers like fltmgr.sys because when I used the removal tool it bsod my system I had to use Macrium Reflect to restore my windows directory.

[Arvy]

I would strongly recommend that you carefully re-read the original post in this thread and/or the second paragraph of my post #127 reply above. The sequential order is absolutely critical.

Basically, deleting driver files is the LAST step in the removal process. If you do that before completely removing (1) the disk and volume device class filters and (2) the "required for boot" system services used by those filters, you will certainly end up in another BSOD trap.

__
P.S.: If you make a registry editing mistake prior to removing the driver files there is at least a chance of being able to recover by using the F8 key + "Last Known Good Configuration" option.

[molitar]

Well I think I finally got it working without stupid acronis. By restoring my windows folder only completely MINUS the fltmgr.sys if that file is sitting in the driver folder without the service it started the BSOD loop.

The directions do not specify well if the files should be deleted and when. No where did I actually see in that post to actually delete fltmgr.sys or the other individual files like afcdp since only the service themselves was mentioned.

[majoMo]

"fltmgr.sys" file is a Windows file system. To delete it is not to want Windows - not Acronis...

[Arvy]

Individual Acronis driver files are specified as they normally are for any service in the system registry. The "ImagePath" entry for each of the Acronis services that is used as a device class filter specifies the driver file used by that service as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fltsrv
DisplayName = Acronis Storage Filter Management
ImagePath = system32\drivers\fltsrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\timounter
DisplayName = Acronis Backup Archive Explorer
ImagePath = system32\drivers\timntr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vidsflt61
DisplayName = Acronis Disk Storage Filter
ImagePath = system32\drivers\vsflt61.sys (NOTE: Last 2 digits of driver name may vary.)

Sorry if that wasn't completely clear in the OP. I guess I may sometimes assume too much knowledge by the reader about dealing with system registry items. In any case, deleting the driver files themselves is far LESS important than the registry entries that load and use them as upper and lower filter services. It really wouldn't matter much if those Acronis files remained in place once the registry has been sanitized. You certainly do NOT want to delete any of Windows' own driver files.

[DVD+R]

Very Negative thread this one IMO, If someone who's not too experienced in registry maintainence does what Arvy sugests, and makes a complete balls up, like deleting something not related to Acronis, and shags up their Computer, then Arvy will no doubt end up the Topic of conversation and be blamed souly. Be very careful if you not clued up on how to edit the registry

[Arvy]

Very negative thread?! It certainly wasn't intended that way. In fact, it was posted originally in response to another user's specific request for help. The moderator moved it to this more general forum. In the circumstances, I wasn't really expecting all the subsequent follow-ups from others, but felt obliged to respond to them if only as a matter of common courtesy.

There is, of course, some risk with ANY registry alterations, but even Mickeysoft itself posts them in some of its KB articles with caveats similar to mine. Once people get caught up in this kind of trap, the alternatives are few and I've certainly tried my best to urge great care and caution if/when implementing. As I've said repeatedly, the most critical aspect is the sequential order of removal.

I sure hope I won't be "blamed souly" (I do understand that you meant solely ) for any and all mistakes that might possibly be made.

[Page42]

Originally Posted by DVD+R

Very Negative thread this one IMO, If someone who's not too experienced in registry maintainence does what Arvy sugests, and makes a complete balls up, like deleting something not related to Acronis, and shags up their Computer, then Arvy will no doubt end up the Topic of conversation and be blamed souly. Be very careful if you not clued up on how to edit the registry

The only reason this thread is negative is because Acronis has made a mess out of some user's computers. Arvy has done is utmost best to divulge the screw up on Acronis' part and in the process, suggest remedial steps. Arvy has also gone to great lengths to include cautionary statements throughout the thread, beginning with the very first post. I don't think he could have been anymore concise in his warnings.

Originally Posted by Arvy

=============================

All of the above factual information is provided on a USE AT YOUR OWN RISK basis.

PLEASE NOTE VERY CAREFULLY: To avoid "blue screen" death traps, any cleanup MUST be done in the following order:
1) Removal of any residual Acronis device class UpperFilters and LowerFilters entries (remove ONLY inserted values);
2) Removal of any residual Acronis "required for boot" (start=0x00000000) services;
3) Removal of any other residual Acronis services, drivers files and miscellaneous leftovers.

One missed removal item, or one item removed out of sequence (whether done manually or by some automated - e.g., Revo uninstaller - cleanup quirk) will cause a "blue screen" death trap problem every time. THE DRIVER FILES THEMSELVES SHOULD ALWAYS BE THE LAST TO GO! That way, you may be able to use F8 - Last Known Good Configuration to recover from any intermediate registry cleanup errors.

Originally Posted by Arvy

If you are not familiar with using regedit, or if any of the steps are not entirely clear to you, then please don't do it.

Originally Posted by Arvy

Whatever you do, do NOT [repeat] NOT manually remove any driver files unless and until you are ABSOLUTELY CERTAIN that they aren't required for booting in the registry. Doing that leads to an almost certain death trap.

Originally Posted by Arvy

I would strongly recommend that you carefully re-read the original post in this thread and/or the second paragraph of my post #127 reply above. The sequential order is absolutely critical.

Basically, deleting driver files is the LAST step in the removal process. If you do that before completely removing (1) the disk and volume device class filters and (2) the "required for boot" system services used by those filters, you will certainly end up in another BSOD trap