• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Norton keeps blocking a backup program all the time

I have noticed that Norton is endlessly reporting blocking Easeus Back up

What can be done to stop this?

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
16/10/2015 21:59:46,Medium,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,16/10/2015 21:59:46,C:\PROGRAM FILES (X86)\EASEUS\TODO BACKUP\BIN\AGENT.EXE,21832,C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.4.24\nsbu.exe,2664,Access Process Data,Unauthorized access blocked

Top

Replies

Kudos0

Re: Norton keeps blocking a backup program all the time

Please review > About Norton Product Tamper Protection
Norton Product Tamper Protection prevents outside programs from making changes to the Norton product.
Norton Product Tamper Protection protects your Norton product from an attack or modification by any virus or other unknown threat. Norton Product Tamper Protection view in the Security History window displays details about unauthorized attempts to modify Symantec processes.
The tasks that your Symantec product blocks appear in the log as:, "Unauthorized Access Blocked"

What can be done to stop this?

Try Exclude 'C:\PROGRAM FILES (X86)\EASEUS\TODO BACKUP\BIN\AGENT.EXE' from Auto-Protect to stop logging. 
Logging is of no harm.  NPTP events are not threats.   NPTP events are not reports of malware. 
NPTP is simply logging Actor getting too close to Norton.   No worries.  No Action Required.

Kudos0

Re: Norton keeps blocking a backup program all the time

Hello

Please make sure that the Backup Program is  allowed into the Firewall. If not there, then Add .exe for that program to Firewall.

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Norton keeps blocking a backup program all the time

Thanks checked it in list and OK so will leave well alone as the program runs just that something it does it upsets Norton!

Kudos0

Re: Norton keeps blocking a backup program all the time

Hello john7

If the backup program gets close to any Norton product, Norton will complain. You won't be able to back up your Norton product most likely since it is always updating.

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Accepted Solution
Kudos1 Stats

Re: Norton keeps blocking a backup program all the time

I also have ToDo backup workstation with Norton Security, and get the same thing. You can ignore it. It does not effect the backup itself and works fine.

As long as the TbService.exe is allowed, as shown below, you have nothing to worry about, and Norton allows it by default, nothing you need to do.

Only when you open ToDo's main window, does that blocked message appear. Just ignore it.

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Program Name,Program Path,Default Action,Action Taken,Local Computer,Traffic Description
10/18/2015 2:00:02 AM,Info,You allowed EaseUS Todo Backup Application to access your network resources.,Allowed,No Action Required,EaseUS Todo Backup Application,C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbService.exe,No Action Required,Allow,"192.168.1.17, 4512","Outbound UDP, Port 137"
You allowed <b>EaseUS Todo Backup Application</b> to access your network resources.

Kudos0

Re: Norton keeps blocking a backup program all the time

Dell XPS 18 all-in-one, 64bit , upgraded to Windows 10 over the last few days, running current Norton 360.

Source:  EaseUS Todo Backup Free 9.0

Suspect:  Agent.exe

Location:  C:\Program Files (x86)\EaseUS\Todo Backup\bin

I have the same file (Agent.exe) in my system but I have a different take on it:

I installed Todo Backup by EaseUS just last week.  I was analyzing my processes today and came across Agent.exe and saw that it was tied to Todo Backup.  I don't have backups scheduled, I run them manually when I see fit.  There is no need to have a process running for it 24/7/365 so I added Agent.exe to Norton Firewall rules as always blocked.  I was working my way through doing this with a lot of programs that run unnecessary processes.  To my surprise, Norton didn't kill the process.  I manually killed the process expecting that Norton would prevent it from coming back.  Nope.  As fast as I could kill the process it would be back and Norton was helpless despite my manual entry of a "block" rule.  I eventually disabled every startup process, that I couldn't readily identify, and re-booted my system.  Even that didn't stop this persistent punk of a file.

I did a little digging and found this thread in a EaseUS support forum from 2012:

http://forum.easeus.com/viewtopic.php?t=23418

They claim this file is simple to ensure that the program stays current.  I have to call BS on that one.  it is just a flipp'n  backup program.  It can check for updates the next time it runs.  It doesn't need to stay current THAT desperately!  Anyone who goes to that much trouble to keep a process alive on our computers is up to no good.

What that thread was posted in 2012 they say it was running as a service and one user suggested that it was supported by another service called "GuardAgent".  I couldn't find any evidence of a "GuardAgent" and Agent.exe is now running as a process and not a service.  No matter what I tried, that stupid thing was always one step ahead.  After getting an "access denied" error trying to delete the exe file, here is how I finally killed it:

  1. Cop the path of Agent.exe to the clipboard
  2. Open Task manager
  3. Open Admin level command prompt and paste the path to change to the correct directory
    CD C:\Program Files (x86)\EaseUS\Todo Backup\bin
  4. Use the task manager to "end task" on "explorer.exe"  Don't panic, your desktop will be back in a few steps.  This stops most things from re-activating.
  5. Use the task manager to "end task" on "Agent.exe"
  6. Navigate back to the command prompt and rename the exe file
    ren Agent.exe Agent-00dead

    Note that i left off the ".exe" as an added safety measure.

  7. Reactivate explorer by simply typing it at the command prompt
    explorer
  8. See, your desktop came back!  ;)  Close the command prompt, verify the process is gone and enjoy a little piece of mind!  :)

The aftermath:

I'm not sure what OS john7 is running or what version of this virus he has but it seams to me that it has gotten smarter and Norton isn't equipped to deal with it.  I just got done with a depressing chat session.  I tried to share the intel with a Symantec rep but Jitesh didn't understand english well enough to grasp the concept.  A supervisor is supposed to call me back in 24-48 hrs but somehow I doubt it will do any good.  I worked with a Norton rep back in the early '90s and they were eager to work with me to find a way to kill a new version of a virus my work computer had become infected with.  It didn't seam today that they were even interested in getting new intel.

@john7 I'm not sure why you think this thing is harmless, no one goes through that many back doors to keep a backup utility updated.  There is definitely something fishy about this one.

Kudos0

Re: Norton keeps blocking a backup program all the time

Hi Mr. Nun Ya,

Actually a great number of programs are set to run at startup these days, some necessarily, others probably not.  Assuming you know which ones are not needed, you can generally disable them using Window Task Manager's startup tab or sometimes, even the Startup Manager in Norton's Performance tab.  Otherwise, Norton is not concerned with safe programs running on your PC.  It only kills malicious ones.  The Norton Firewall does not disable programs, it only determines whether a program should have network or internet access.  Known good, safe, applications are permitted to connect, bad programs are blocked.  The firewall is a Smart Firewall and will not automatically block a good program - to do that, you would have to go into the Firewall Program Control settings and make the change yourself.  This is NOT recommended.

And yes, a lot of backup programs, in addition to other programs routinely phone home for updates and other things.  It's become the norm, rather than the exception.

Kudos0

Re: Norton keeps blocking a backup program all the time

Hi SendOfJive,

Actually, the only thing you clarified is that my post was too long and you didn't pay any attention to what I wrote.

Me:

...I was working my way through doing this with a lot of programs that run unnecessary processes.

You:

Actually a great number of programs are set to run at startup these days, some necessarily, others probably not.

I think I just said that...

Me:

I eventually disabled every startup process, that I couldn't readily identify, and re-booted my system.

You:

you can generally disable them using Window Task Manager's startup tab

Ya, pretty sure I already said that too...

Me:

I added Agent.exe to Norton Firewall rules as always blocked.

You:

you would have to go into the Firewall Program Control settings and make the change yourself. 

Hmmm...  now that you mention it, I did point that out as well.

It's clear that you have an amazing ability to restate the obvious.  However, since you clearly missed the entire point, I will reiterate that for you as well. 

No matter what I tried, that stupid thing was always one step ahead...

...Norton was helpless despite my manual entry of a "block" rule...

...no one goes through that many back doors to keep a backup utility updated.  There is definitely something fishy about this one.

 You see, it wasn't just that it was there needlessly.  The "big picture" of the behavior of this process suggests that there is likely more going on here than they are letting on.  Maybe it is harmless and the programmers just went ridiculously overboard.  I do feel that there is enough suspicious behavior to warrant a thorough investigation by someone with more expertise at this than myself.

Kudos0

Re: Norton keeps blocking a backup program all the time

Mr. Nun Ya:

There is no need to have a process running for it 24/7/365 so I added Agent.exe to Norton Firewall rules as always blocked.  I was working my way through doing this with a lot of programs that run unnecessary processes.  To my surprise, Norton didn't kill the process. 

Sorry if I was restating the obvious, but from what you wrote here, it certainly sounded as if you expected to kill a process by blocking it with a firewall, which seemed to be the point you were making.  To the point that a backup program is running at startup, that it not that unusual - I use Macrium Reflect and it continually runs a process from startup that enables mounting of images.  I have also used Acronis True Image which actually ran several processes in the background.  Sorry you didn't find my post helpful.

This thread is closed from further comment. Please visit the forum to start a new thread.