AV blocks MS backup in Vista

[Guest]

[languy99]

Every now and then the AV will block the built in back up software in Vista ultimate. The error that backup reports is:

Code:

Log Name:      Application
Source:        Windows Backup
Date:          6/7/2009 8:42:59 PM
Event ID:      4104
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PC
Description:
File backup failed. The error is: Access is denied. (0x80070005).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Backup" />
    <EventID Qualifiers="0">4104</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-06-08T00:42:59.000Z" />
    <EventRecordID>21702</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Access is denied. (0x80070005)</Data>
    <Binary>05000780E0040000F10600000D070000420ED1665C2BEE174B64529CB14610EA71000000</Binary>
  </EventData>
</Event>

 Once I disable the AV, I can click retry and the back up finishes just fine.

[John Buchanan]

What AV?  I don't see this and I use the backup program regularly (Vista Ultimate x64).

[languy99]

AV built into CIS

[voices]

Hello,

I have a similar problem. I user Vista 64 and during the standard vista backup of C: y get an access error 0x80070005 . I assume it´s der folder quarantine in connection with the volume shadow thing (I have an error in der windows log file) but I don't know what I have to do. Thanks in advance for helping ideas.

Voices

[EricJH]

Can you show a screenshot of the error message?

[Conny]

Can you show a screenshot of the error message?

   I've got the same bug and it happened on version 3.10 too but I added it to all the exclusions I could and that fixed the problem until this update; 3.11 here are some shots of the results.

[EricJH]

Make sure to set the AV Real Time scanner to not automatically quarantine files found during scanning. Next time you get a pop up you add that file to the exclusions.

Please consider submitting the file as a false positive using these guidelines: How to report False Positives - Please read this before submitting !.

[Conny]

Make sure to set the AV Real Time scanner to not automatically quarantine files found during scanning. Next time you get a pop up you add that file to the exclusions.

Please consider submitting the file as a false positive using these guidelines: How to report False Positives - Please read this before submitting !.

 As you can see in the latest snip I added CIS AV doesn't quarantine it, it just detects it and somehow blocks the process of the backup.(the snip was added to my last post; backup denied 4)
   My scanner is set to _not_ automatically quarantine files. I don't get a pop up.

[Conny]

Seems to have something to do with INUNINST.exe and inuninst.exe. Both were qurantined on another program (snip backup denied 4) I restored them by adding them to my own safe files then ran my backup and it worked fine I then moved them to pending files and looked them up and submitted them. One had already been submitted the other hadn't.
  Both files are signed by sonic solutions and sonic solutions is on my trusted vendors list and "Trust the applications digitally signed by Trusted Software Vendors" box is checked in Defense+ settings. So I don't understand why they were quarantined in the first place.

[voices]

Can you show a screenshot of the error message?

It's in German but I think you can read it.

[EricJH]

It's in German but I think you can read it.

I can read German indeed. I am trying to keep an eye on the German board these days. I am from the Netherlands and learned German in school but it needs some dusting of.....

Can you take a look at the D+ and AV logs of around the time the error happens? And then post screenshots of them? The D+ logs can be found under Defense + --> Common Tasks --> View Defense + Alerts. The AV logs can be found under Anitvirus --> View anti virus events.

[Tags:]