Why do I still have relog_ap.dll after doing manual uninstall of ATI 11?

Hi,

I'm hoping Marat Setdikov and/or another board member can help me out...

I got ATI 11 with the sole intent of using it to back-up my hard drive in its entirety (I've installed XP but would need to put Vista back on if I had to send it in for repairs, and this would allow me to then put an exact copy of my XP system back on the laptop once returned).

Not realizing that you can do this procedure from the bootable cd that the program is on, I installed the program. Then I realized that it started all these services, etc. that I didn't want on my computer.

So I followed the manual removal instructions posted here:
https://www.wilderssecurity.com/showpost.php?p=1120006&postcount=4

...as I had read that used add/remove programs or other methods did not do a complete uninstall.

I followed the instructions exactly (though please note that not all the files listed for the registry were there). Uninstall seemed to be successful.

However, this morning I was looking through the Security logs and saw this entry:

Event Type: Success Audit
Event Source: Security
Event Category: System Event
Event ID: 514
Date: 12/28/2007
Time: 10:52:31 AM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTRESS
Description:
An authentication package has been loaded by the Local Security Authority. This authentication package will be used to authenticate logon attempts.
Authentication Package Name: C:\WINDOWS\system32\relog_ap.dll : ACRONIS_RELOGON_AUTHENTICATION_PACKAGE

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I found the relog_ap.dll file in system32 and right-clicked on it and it is indeed an Acronis file.

Why is this on my computer? Should it have been removed in the manual uninstall? (This file was not listed in the instructions.)

Should I just leave it alone? (It doesn't seem to be causing any problems that I know of...)

Any help is appreciated -- thanks!

 

I thought this file was only part of the corporate software, but as I have it as well, obviously not.

It might not hvae uninstalled due to being a DLL - in other words another program might have hooked itself into it. I haven't tried deleting it as yet.

However here is where it lives in registry.

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Lsa
Acronis Relogon Authentication Package

Colin

 

Thanks for the post. It's good to know I'm not the only one (so I didn't do anything wrong with the uninstall).

So are you going to just leave the file as is and let it run/load (or whatever) on startup like it does?

Does anybody know if this file is supposed to be left on your system?

Any rep from Acronis that can chime in with info on this?

Thanks!

 

Hello bloomcounty, bodgy and anyone interested,

Thank you for choosing Acronis Software.

We are sorry for delayed response.

Please be aware that uninstallation instructions leave out this file and a number of others because, in case they were deleted and one decided to use Microsoft Windows' "last known good configuration" option, it would restore the registry entries for those files, but not files themselves, making the system unstable or even unbootable. Otherwise, this file is safe to be deleted after full uninstallation of Acronis True Image as it's not used by any other applications.

Thank you.
--
Marat Setdikov

 

Thanks for the reply and help.

Follow-up questions:

1. So by manually right-clicking and deleting relog_ap.dll file from the system32 folder, it will make it so this isn't run as a System Event when you boot up, and with no ill effects on the computer?

2. What are the other files you mention as being left out of the removal instructions? And can those be deleted safely as well?

Looking forward to hearing back...

 

Hello bloomcounty,

Correct, provided that Windows' "last known good configuration" option is never (or at least untill the instance that includes links to that file is replaced) used after that.

Other files are:

System32\DRIVERS\tdrpman.sys;
System32\DRIVERS\tifsfilt.sys;
System32\DRIVERS\timntr.sys;
Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe;
system32\drivers\snapman.sys.

Those files can be deleted on same conditions as the relog_ap.dll file. After the deletion you might see Event Log messages related to system failing to load those files, but as nothing in the system actually uses them, it's safe to ignore those messages.

Thank you.
--
Marat Setdikov

 

Thanks for the reply.

1. But why would you get "Event Log messages related to system failing to load those files" if Acronis is no longer on the system? Why would that even come up if the program is *truly* removed from the computer?

2. And so installing Acronis True Image 11 basically and wanting to uninstall it basically makes future use of "Windows' "last known good configuration"" option useless/bad?

3. And does just keeping these files on your system cause *any* hard or lesser function or anything negative in any way?

I have to be honest, I really wish I had never installed True Image 11 on my system in the first place. If the instructions (if there actually were any in the box, which there weren't) had said that it embeds itself so severely in your system and that it would ruin the use of Windows last known good configuation if you want to uninstall, I never would have installed it (and thus uninstalled it, as well).

4. Does it actually say anywhere that the software causes these problems/conditions? Shouldn't that be make perfectly clear up front?

Looking forward to hearing back. Thank you.

 

Still no response to the above? Any follow-up from an Acronis person would be greatly appreciated -- thanks!

 

I do wish ATI made available a small script file to handle manual uninstal, and a readme file for anything left behind and why.

Otoh, ATI doesn't embed it self so severely that it would ruin Windows to use Last Known Good Config. Because of one of the quirky ways that windows handles certain error and restoration functions, ATI has to leave these certain files behind just so that it Last Known Config doesn't trip over it's own shorts. So ATI, be design, is actually taking Windows quirks into account. There might be more elegant solutions but they probably don't involve windows ;-)

I wish I knew of any major program that didn't leave lots of stuff behind after an uninstall. I'm still finding Adobe files from years ago. ;-)

 

Thanks for the info/explanation!

I guess I'll just leave those remaining files alone...