Windows 10: Macrium Reflect Backup Failures (problema resolutum est)

@DavidY - thanks so much for your efforts....looks like something may have been accomplished? *Smile

Not to confuse things, but I just came across this, and can't remember if we tried it or not?




(Rather than re-read 6 pages, I thought I'd ask...)

 

simrick Yes, Fix VSS was tried, had no apparent effect, alas, alack.

 

Code: Rkill 2.8.4 by Lawrence Abrams (Grinler) BleepingComputer Copyright 2008-2016 BleepingComputer.com More Information about Rkill can be found at this link: RKill - What it does and What it Doesn't - A brief introduction to the program - Anti-Virus, Anti-Malware, and Privacy Software Program started at: 08/27/2016 08:11:09 AM in x64 mode. Windows Version: Windows 10 Home Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * No malware processes found to kill. Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * Windows Defender Disabled [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender] "DisableAntiSpyware" = dword:00000001 * Reparse Point/Junctions Found (Most likely legitimate)! * C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 => C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\IE [Dir] Checking Windows Service Integrity: * gagp30kx [Missing Service] * IEEtwCollectorService [Missing Service] * IoQos [Missing Service] * nv_agp [Missing Service] * TimeBroker [Missing Service] * uagp35 [Missing Service] * uliagpkx [Missing Service] * WcsPlugInService [Missing Service] * wpcfltr [Missing Service] * WSService [Missing Service] * agp440 [Missing ImagePath] * WMPNetworkSvc [Missing ImagePath] * AJRouter => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted [Incorrect ImagePath] * WpnService => %systemroot%\system32\svchost.exe -k netsvcs [Incorrect ImagePath] * vmicrdv => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL] * vmicvss => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL] Searching for Missing Digital Signatures: * No issues found. Checking HOSTS File: * HOSTS file entries found: 127.0.0.1 localhost 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 20 out of 36 HOSTS entries shown. Please review HOSTS file for further entries. Program finished at: 08/27/2016 08:11:44 AM Execution time: 0 hours(s), 0 minute(s), and 34 seconds(s)[/quote]

is linked to
Code: C:\WINDOWS\WinSxS\x86_microsoft-windows-s..icingstack-cmitrust_31bf3856ad364e35_10.0.14393.82_none_397264147e08b82f\cmitrust.dll[/quote] (if I typed that right.)

What happens if you try the same command on the next one on the original RKILL list:
Code: findlinks.exe -accepteula "C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\bcdeditai.dll"[/quote] [/quote]

╪ (I will leave it to you to decipher...).

 

[/quote] So all those Reparse points with <Unknown Target> have now gone.
This would be a good thing if Macrium actually worked now... What happens if you try it?
(I'm not 100% hopeful to be honest!)

 

I was going to tell you to see my reply #57, on the previous page, but first I reran the Macrium VSS repair function, and then tried a backup; that failed as expected. (Restore Point continues to fail with the same error as seen the first time I tried it and found it to be corrupted.)

However, and I have no idea what, if anything it means, the Macrium log error report is rather different from that shown in #57:





After posting that, I returned to Macrium to close it, where I found that it provides a link to the Windows Event Viewer; here is a compound image of that report, as the scroll feature of Snagit, although indicating that it was working, did not:

 

Somehow I thought you might say that. *Sad

It still might be useful to see the results of these - most of the answers were cut off in the earlier screenshot so I've added a bit which should hopefully put them into a text file called vsschecks.txt

[/quote] Edit: just saw the screenshot you added - 'catastrophic failure' doesn't sound good (if perhaps over-dramatic).

 

I tried all four entries, and none of them reported anything; perhaps this was a catastrophic failure.

 

Ah I wasn't quite clear - those commands should have created a text file called vsschecks.txt in your Documents folder. Assuming that worked, could you paste the contents of the file here, in a Code box, please?

Edit: Also I found something else online which suggests checking the status of the system volume. From an elevated command prompt try these commands and post a screenshot of what came back.
Code: diskpart list volume[/quote] Then look for the volume with "System" in the Info column, "FAT32" in the Fs column, and a size of 100MB.
Suppose it is volume 2 - replace as necessary in the commands below.
Code: select volume 2 detail volume exit[/quote]

 

A search on that error code and text brings up a conflict between Macrium and other imaging software (either existing or previously installed, ShadowProtect from StorageCraft in particular):

VSS fails due to disks with a non-standard sector size - KnowledgeBase - Macrium Reflect Knowledgebase

VSS fails due to modification by 3rd party software - KnowledgeBase - Macrium Reflect Knowledgebase

VSS Error: 0x8004230F - KnowledgeBase - Macrium Reflect Knowledgebase

 

I think we checked that one in the Registry a couple of pages back. Also post #59 shows the vssadmin list providers screenshot and it looks the same as the required registry settings.

I did see the vss fix download but I assumed it was the same a the 'Fix VSS Errors' function in Macrium itself. On the other hand it might be worth trying everything at this point. *Wink

 

At some unknown and unknowable time, I would have found that file and wondered where it came from, why it came from there.

Code: vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. No items found that satisfy the query. vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. No items found that satisfy the query. vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. Writer name: 'Task Scheduler Writer' Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124} Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b} State: [1] Stable Last error: No error Writer name: 'VSS Metadata Store Writer' Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06} Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93} State: [1] Stable Last error: No error Writer name: 'Performance Counters Writer' Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2} Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381} State: [1] Stable Last error: No error Writer name: 'System Writer' Writer Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Instance Id: {137d8ee1-97f8-4e4e-bd3a-9dfae99a2b22} State: [1] Stable Last error: No error Writer name: 'ASR Writer' Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Instance Id: {5870e83c-a030-47f1-8342-80af83a2ee99} State: [1] Stable Last error: No error Writer name: 'Shadow Copy Optimization Writer' Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f} Writer Instance Id: {9a000db4-d2e6-4019-9fb8-94c6d1584b3a} State: [1] Stable Last error: No error Writer name: 'Registry Writer' Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485} Writer Instance Id: {45455b89-a27c-4f34-8da4-0354a01e6fc9} State: [1] Stable Last error: No error Writer name: 'COM+ REGDB Writer' Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f} Writer Instance Id: {0f57803a-5d97-4631-9ad2-22f9b6730207} State: [1] Stable Last error: No error Writer name: 'BITS Writer' Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0} Writer Instance Id: {bd7fd198-ef56-4b84-850c-899ef894e3ef} State: [1] Stable Last error: No error Writer name: 'WMI Writer' Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0} Writer Instance Id: {17fbab10-38a9-4d93-a164-8d25cef82df3} State: [1] Stable Last error: No error Writer name: 'MSSearch Service Writer' Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2} Writer Instance Id: {0219352c-e1c2-42f0-a646-794629fb78fc} State: [1] Stable Last error: No error vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. Provider name: 'Microsoft Software Shadow Copy provider 1.0' Provider type: System Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5} Version: 1.0.0.7[/quote]

Then look for the volume with "System" in the Info column, "FAT32" in the Fs column, and a size of 100MB.
Suppose it is volume 2 - replace as necessary in the commands below.
Code: select volume 2 detail volume exit[/quote] [/quote] Result:

 

I could not find any of the things mentioned in the Macrium articles as being causes of problems, nor did the downloaded VSS repair program fix Macrium,. ShadowProtect and other imaging software never installed as far as I am aware.

 

I see that all the VSS Writers claim 'No Error' (perhaps optimistically).

So am I right in thinking your disk setup looks like this? :

• Main disk with
  • C: drive
  • System drive (incidentally I wanted to check that Offline was set to No; it was)
  • Recovery Tools
  • Recovery Partition ('Image')
• A WD Passport drive with encryption (I have something similar) which
  • Emulates a CD drive on drive F: so you can type in a password, and
  • Has drive K: for data once you've unlocked it
• Drive H: which is a Freeagent (Seagate?) drive, which if I remember rightly is the one you were trying to backup to in the first place?
• DVD/CD drive as drive E:

Is there any space on the K: drive? I wonder what would happen if you set up a new backup job in Macrium, which perhaps just selected the two smallest partitions on the main system drive (ESP and WinRETools), and then tried to backup to a folder on K: (if there's space). It might eliminate one or two things, although wouldn't be much use as a backup. Another thing to try would be safely removing then unplugging the K: drive altogether, and trying something like the original backup.

But I admit I really don't know the answer. @simrick do you have any more ideas?

The only other thing I found was some software called VSSTrace which is part of the Windows Software Development Kit, which might perhaps give more helpful error messages on whatever is going wrong with VSS. (I'm assuming VSS is the problem because I believe both System Restore and Macrium use it, and the error code started with VSS_.) But it's too late for me in this timezone to look at that today.

 

*Sad

Have we tried creating a Restore Point in Safe Mode? If it indeed works, then we need to perform a clean boot to troubleshoot.

 

@DavidY Sorry - just re-reading this entire thread to get back up to speed.

I have a bit of reading/research I'm doing at the moment, to see if I can come up with some other ideas, although I am interested to see if the OP can create a restore point in Safe Mode.

Thanks for all your help. We're not giving up yet! *Wink