Faillure of Windows Backup of C: to other hard drive
in [Windows XP]
|
Prev: Resize Windows
Next: Turn off auto-updates?
From: Stan Hilliard on 29 Nov 2009 20:12 For a long time computer freezups and unresponsive programs have prevented me from making backups. My Physical Hard Drives: 1) 500 GB RAID 0 hard drive contains C: 2) 250 GB hard drive contains N:. 3) 1 TB hard drive Here is what happened when I tried to make a backup of C: partition on drive 1 to N: on drive 2 using Windows Backup. The computer was running in safe mode with msconfig set to disable services and startups. IN THE EVENT VIEWER [APPLICATION] SECTION ============= = 1 Event Type: Information Event Source: NTBackup Event Category: None Event ID: 8018 Date: 11/29/2009 Time: 3:09:19 PM Description: Begin Operation = 2 Event Type: Error Event Source: VSS Event Category: None Event ID: 8193 Date: 11/29/2009 Time: 3:09:19 PM Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007043c. Data: 0000: 42 55 45 43 58 4d 4c 43 BUECXMLC 0008: 33 35 33 32 00 00 00 00 3532.... 0010: 42 55 45 43 58 4d 4c 43 BUECXMLC 0018: 33 34 39 34 00 00 00 00 3494.... = 3 Event Type: Error Event Source: VSS Event Category: None Event ID: 5012 Date: 11/29/2009 Time: 3:09:19 PM Description: Volume Shadow Copy Service error: Shadow Copy shim called routine CoCreateInstance( CLSID_VSSCoordinator, IID_IVssShim) which failed with status 0x8007043c (converted to 0x8000ffff). Data: 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC 0008: 32 32 37 39 00 00 00 00 2279.... 0010: 57 53 48 57 53 48 4d 43 WSHWSHMC 0018: 31 34 39 31 00 00 00 00 1491.... = 4 Event Type: Error Event Source: NTBackup Event Category: None Event ID: 8019 Date: 11/29/2009 Time: 3:09:19 PM Description: End Operation: Warnings or errors were encountered. Consult the backup report for more details. CONTENTS OF THE BACKUP REPORT ========================== Backup Status Operation: Backup Active backup destination: File Media name: "WinXP_Backup_of_HB_C_2009_3.bkf created 11/29/2009 at 3:09 PM" Error returned while creating the volume shadow copy:Catastrophic failure Aborting Backup. ---------------------- The operation did not successfully complete. --------------------- IN THE EVENT VIEWER [SYSTEM] SECTION =========================== EVENTS STARTING WITH SAFE MODE STARTUP THROUGH BACKUP FAILURE = 5 Event Type: Information Event Source: EventLog Event Category: None Event ID: 6005 Date: 11/29/2009 Time: 3:02:34 PM Description: The Event log service was started. = 6 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. = 7 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. = 8 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. = 9 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The FTP Publishing service depends on the IIS Admin service which failed to start because of the following error: The dependency service or group failed to start. = 10 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. = 11 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7001 Date: 11/29/2009 Time: 3:04:14 PM Description: The World Wide Web Publishing service depends on the IIS Admin service which failed to start because of the following error: The dependency service or group failed to start. = 12 Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7026 Date: 11/29/2009 Time: 3:04:14 PM Description: The following boot-start or system-start driver(s) failed to load: AFD AmdK8 Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SandBox Tcpip wgo = 13 Event Type: Error Event Source: DCOM Event Category: None Event ID: 10005 Date: 11/29/2009 Time: 3:06:07 PM User: NT AUTHORITY\SYSTEM Computer: HOMEBUILT Description: DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} = 14 Event Type: Error Event Source: DCOM Event Category: None Event ID: 10005 Date: 11/29/2009 Time: 3:06:16 PM Description: DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} = 15 Event Type: Error Event Source: DCOM Event Category: None Event ID: 10005 Date: 11/29/2009 Time: 3:07:17 PM Description: DCOM got error "This service cannot be started in Safe Mode " attempting to start the service ntmssvc with arguments "-Service" in order to run the server: {D61A27C6-8F53-11D0-BFA0-00A024151983} = 16 Event Type: Error Event Source: DCOM Event Category: None Event ID: 10005 Date: 11/29/2009 Time: 3:08:12 PM User: HOMEBUILT\Stan Hilliard Computer: HOMEBUILT Description: DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} = 17 Event Type: Error Event Source: DCOM Event Category: None Event ID: 10005 Date: 11/29/2009 Time: 3:09:19 PM Description: DCOM got error "This service cannot be started in Safe Mode " attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623} What is the pattern here? What problem do these messages indicate? Stan Hilliard
From: sgopus on 29 Nov 2009 21:46 I think most but not all, of your errors are due to attempt to copy a file while it was still in use, some others may be due to your HD N getting close to failure. I suggest that NTbackup is a poor choice for backup software, instead try Acronis True Image and make clones of your primary drive using a USB HD, they are cheap and get another one for your Data. "Stan Hilliard" wrote: > For a long time computer freezups and unresponsive programs have > prevented me from making backups. > > My Physical Hard Drives: > 1) 500 GB RAID 0 hard drive contains C: > 2) 250 GB hard drive contains N:. > 3) 1 TB hard drive > > Here is what happened when I tried to make a backup of C: partition on > drive 1 to N: on drive 2 using Windows Backup. The computer was > running in safe mode with msconfig set to disable services and > startups. > > IN THE EVENT VIEWER [APPLICATION] SECTION ============= > = 1 > Event Type: Information > Event Source: NTBackup > Event Category: None > Event ID: 8018 > Date: 11/29/2009 > Time: 3:09:19 PM > Description: Begin Operation > > = 2 > Event Type: Error > Event Source: VSS > Event Category: None > Event ID: 8193 > Date: 11/29/2009 > Time: 3:09:19 PM > Description: Volume Shadow Copy Service error: Unexpected error > calling routine CoCreateInstance. hr = 0x8007043c. > Data: > 0000: 42 55 45 43 58 4d 4c 43 BUECXMLC > 0008: 33 35 33 32 00 00 00 00 3532.... > 0010: 42 55 45 43 58 4d 4c 43 BUECXMLC > 0018: 33 34 39 34 00 00 00 00 3494.... > > = 3 > Event Type: Error > Event Source: VSS > Event Category: None > Event ID: 5012 > Date: 11/29/2009 > Time: 3:09:19 PM > Description: Volume Shadow Copy Service error: Shadow Copy shim called > routine CoCreateInstance( CLSID_VSSCoordinator, IID_IVssShim) which > failed with status 0x8007043c (converted to 0x8000ffff). > Data: > 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC > 0008: 32 32 37 39 00 00 00 00 2279.... > 0010: 57 53 48 57 53 48 4d 43 WSHWSHMC > 0018: 31 34 39 31 00 00 00 00 1491.... > > = 4 > Event Type: Error > Event Source: NTBackup > Event Category: None > Event ID: 8019 > Date: 11/29/2009 > Time: 3:09:19 PM > Description: End Operation: Warnings or errors were encountered. > Consult the backup report for more details. > > > > CONTENTS OF THE BACKUP REPORT ========================== > Backup Status > Operation: Backup > Active backup destination: File > Media name: "WinXP_Backup_of_HB_C_2009_3.bkf created 11/29/2009 at > 3:09 PM" > Error returned while creating the volume shadow copy:Catastrophic > failure > Aborting Backup. > ---------------------- > The operation did not successfully complete. > --------------------- > > > > IN THE EVENT VIEWER [SYSTEM] SECTION =========================== > EVENTS STARTING WITH SAFE MODE STARTUP THROUGH BACKUP FAILURE > = 5 > Event Type: Information > Event Source: EventLog > Event Category: None > Event ID: 6005 > Date: 11/29/2009 > Time: 3:02:34 PM > Description: The Event log service was started. > > = 6 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The DHCP Client service depends on the NetBios over Tcpip > service which failed to start because of the following error: > A device attached to the system is not functioning. > > = 7 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The DNS Client service depends on the TCP/IP Protocol > Driver service which failed to start because of the following error: > A device attached to the system is not functioning. > > = 8 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The TCP/IP NetBIOS Helper service depends on the AFD > service which failed to start because of the following error: > A device attached to the system is not functioning. > > = 9 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The FTP Publishing service depends on the IIS Admin > service which failed to start because of the following error: > The dependency service or group failed to start. > > = 10 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The IPSEC Services service depends on the IPSEC driver > service which failed to start because of the following error: > A device attached to the system is not functioning. > > = 11 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7001 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: The World Wide Web Publishing service depends on the IIS > Admin service which failed to start because of the following error: > The dependency service or group failed to start. > > = 12 > Event Type: Error > Event Source: Service Control Manager > Event Category: None > Event ID: 7026 > Date: 11/29/2009 > Time: 3:04:14 PM > Description: > The following boot-start or system-start driver(s) failed to load: > AFD > AmdK8 > Fips > IPSec > MRxSmb > NetBIOS > NetBT > RasAcd > Rdbss > SandBox > Tcpip > wgo > > = 13 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 11/29/2009 > Time: 3:06:07 PM > User: NT AUTHORITY\SYSTEM > Computer: HOMEBUILT > Description: > DCOM got error "This service cannot be started in Safe Mode " > attempting to start the service EventSystem with arguments "" in order > to run the server: > {1BE1F766-5536-11D1-B726-00C04FB926AF} > > = 14 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 11/29/2009 > Time: 3:06:16 PM > Description: DCOM got error "This service cannot be started in Safe > Mode " attempting to start the service StiSvc with arguments "" in > order to run the server: > {A1F4E726-8CF1-11D1-BF92-0060081ED811} > > = 15 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 11/29/2009 > Time: 3:07:17 PM > Description: > DCOM got error "This service cannot be started in Safe Mode " > attempting to start the service ntmssvc with arguments "-Service" in > order to run the server: > {D61A27C6-8F53-11D0-BFA0-00A024151983} > > = 16 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 11/29/2009 > Time: 3:08:12 PM > User: HOMEBUILT\Stan Hilliard > Computer: HOMEBUILT > Description: > DCOM got error "This service cannot be started in Safe Mode " > attempting to start the service StiSvc with arguments "" in order to > run the server: > {A1F4E726-8CF1-11D1-BF92-0060081ED811} > > = 17 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 11/29/2009 > Time: 3:09:19 PM > Description: DCOM got error "This service cannot be started in Safe > Mode " attempting to start the service VSS with arguments "" in order > to run the server: > {E579AB5F-1CC4-44B4-BED9-DE0991FF0623} > > What is the pattern here? What problem do these messages indicate? > Stan Hilliard > > . >
From: Stan Hilliard on 1 Dec 2009 12:37 On Sun, 29 Nov 2009 19:12:08 -0600, Stan Hilliard <usenetreplyMS(a)samplingplansNOTSPAM.com> wrote: >For a long time computer freezups and unresponsive programs have >prevented me from making backups. > >My Physical Hard Drives: >1) 500 GB RAID 0 hard drive contains C: >2) 250 GB hard drive contains N:. >3) 1 TB hard drive > >Here is what happened when I tried to make a backup of C: partition on >drive 1 to N: on drive 2 using Windows Backup. The computer was >running in safe mode with msconfig set to disable services and >startups. > >IN THE EVENT VIEWER [APPLICATION] SECTION ============= >= 1 >Event Type: Information >Event Source: NTBackup >Event Category: None >Event ID: 8018 >Date: 11/29/2009 >Time: 3:09:19 PM >Description: Begin Operation > >= 2 >Event Type: Error >Event Source: VSS >Event Category: None >Event ID: 8193 >Date: 11/29/2009 >Time: 3:09:19 PM >Description: Volume Shadow Copy Service error: Unexpected error >calling routine CoCreateInstance. hr = 0x8007043c. >Data: >0000: 42 55 45 43 58 4d 4c 43 BUECXMLC >0008: 33 35 33 32 00 00 00 00 3532.... >0010: 42 55 45 43 58 4d 4c 43 BUECXMLC >0018: 33 34 39 34 00 00 00 00 3494.... > >= 3 >Event Type: Error >Event Source: VSS >Event Category: None >Event ID: 5012 >Date: 11/29/2009 >Time: 3:09:19 PM >Description: Volume Shadow Copy Service error: Shadow Copy shim called >routine CoCreateInstance( CLSID_VSSCoordinator, IID_IVssShim) which >failed with status 0x8007043c (converted to 0x8000ffff). >Data: >0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC >0008: 32 32 37 39 00 00 00 00 2279.... >0010: 57 53 48 57 53 48 4d 43 WSHWSHMC >0018: 31 34 39 31 00 00 00 00 1491.... > >= 4 >Event Type: Error >Event Source: NTBackup >Event Category: None >Event ID: 8019 >Date: 11/29/2009 >Time: 3:09:19 PM >Description: End Operation: Warnings or errors were encountered. >Consult the backup report for more details. > > > >CONTENTS OF THE BACKUP REPORT ========================== >Backup Status >Operation: Backup >Active backup destination: File >Media name: "WinXP_Backup_of_HB_C_2009_3.bkf created 11/29/2009 at >3:09 PM" >Error returned while creating the volume shadow copy:Catastrophic >failure >Aborting Backup. >---------------------- >The operation did not successfully complete. >--------------------- > > > >IN THE EVENT VIEWER [SYSTEM] SECTION =========================== >EVENTS STARTING WITH SAFE MODE STARTUP THROUGH BACKUP FAILURE >= 5 >Event Type: Information >Event Source: EventLog >Event Category: None >Event ID: 6005 >Date: 11/29/2009 >Time: 3:02:34 PM >Description: The Event log service was started. > >= 6 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The DHCP Client service depends on the NetBios over Tcpip >service which failed to start because of the following error: >A device attached to the system is not functioning. > >= 7 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The DNS Client service depends on the TCP/IP Protocol >Driver service which failed to start because of the following error: >A device attached to the system is not functioning. > >= 8 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The TCP/IP NetBIOS Helper service depends on the AFD >service which failed to start because of the following error: >A device attached to the system is not functioning. > >= 9 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The FTP Publishing service depends on the IIS Admin >service which failed to start because of the following error: >The dependency service or group failed to start. > >= 10 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The IPSEC Services service depends on the IPSEC driver >service which failed to start because of the following error: >A device attached to the system is not functioning. > >= 11 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7001 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: The World Wide Web Publishing service depends on the IIS >Admin service which failed to start because of the following error: >The dependency service or group failed to start. > >= 12 >Event Type: Error >Event Source: Service Control Manager >Event Category: None >Event ID: 7026 >Date: 11/29/2009 >Time: 3:04:14 PM >Description: >The following boot-start or system-start driver(s) failed to load: >AFD >AmdK8 >Fips >IPSec >MRxSmb >NetBIOS >NetBT >RasAcd >Rdbss >SandBox >Tcpip >wgo > >= 13 >Event Type: Error >Event Source: DCOM >Event Category: None >Event ID: 10005 >Date: 11/29/2009 >Time: 3:06:07 PM >User: NT AUTHORITY\SYSTEM >Computer: HOMEBUILT >Description: >DCOM got error "This service cannot be started in Safe Mode " >attempting to start the service EventSystem with arguments "" in order >to run the server: >{1BE1F766-5536-11D1-B726-00C04FB926AF} > >= 14 >Event Type: Error >Event Source: DCOM >Event Category: None >Event ID: 10005 >Date: 11/29/2009 >Time: 3:06:16 PM >Description: DCOM got error "This service cannot be started in Safe >Mode " attempting to start the service StiSvc with arguments "" in >order to run the server: >{A1F4E726-8CF1-11D1-BF92-0060081ED811} > >= 15 >Event Type: Error >Event Source: DCOM >Event Category: None >Event ID: 10005 >Date: 11/29/2009 >Time: 3:07:17 PM >Description: >DCOM got error "This service cannot be started in Safe Mode " >attempting to start the service ntmssvc with arguments "-Service" in >order to run the server: >{D61A27C6-8F53-11D0-BFA0-00A024151983} > >= 16 >Event Type: Error >Event Source: DCOM >Event Category: None >Event ID: 10005 >Date: 11/29/2009 >Time: 3:08:12 PM >User: HOMEBUILT\Stan Hilliard >Computer: HOMEBUILT >Description: >DCOM got error "This service cannot be started in Safe Mode " >attempting to start the service StiSvc with arguments "" in order to >run the server: >{A1F4E726-8CF1-11D1-BF92-0060081ED811} > >= 17 >Event Type: Error >Event Source: DCOM >Event Category: None >Event ID: 10005 >Date: 11/29/2009 >Time: 3:09:19 PM >Description: DCOM got error "This service cannot be started in Safe >Mode " attempting to start the service VSS with arguments "" in order >to run the server: >{E579AB5F-1CC4-44B4-BED9-DE0991FF0623} > >What is the pattern here? What problem do these messages indicate? >Stan Hilliard I finally was able to make a backup with Windows Backup from C: --->N:. But there are still some problems. THE CONFIGUTATION: A) msconfig - normal, nothing disabled B) services.msc - "FPROT Antivirus for Windows system" - stopped. C) Logged in as different user - permissions = administrator (previous also had admin permissions) D) Normal startup - not safe mode THE PROBLEMS: 1) It took 26-1/2 hours to backup 118,263 files, 58 GB. 2) ntbackup reverted to non-shadow copy backup mode because of error 800423f4. (The complete log is below.) 3) Desktop icons and application window went hidden except for screen saver. I could bring them back temporarily with ctrl-alt-del. 4) During the run, Task Manager showed that FPAVserver.exe was using 98% to 99% of the CPU cycles. After the 26-1/2 hour run, I checked services.msc and the "FPROT Antivirus for Windows system" service was still stopped. ==== HERE IS THE COMPLETE LOG FILE ==== Backup Status Operation: Backup Active backup destination: File Media name: "Backup.bkf created 11/29/2009 at 8:38 PM" Error returned while creating the volume shadow copy:800423f4 Reverting to non-shadow copy backup mode. Backup of "C: C1 Windows XP-Pro" Backup set #1 on media #1 Backup description: "Set created 11/29/2009 at 8:38 PM" Media name: "Backup.bkf created 11/29/2009 at 8:38 PM" Backup Type: Normal Backup started on 11/29/2009 at 8:52 PM. Warning: Unable to open "C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-08312008-160741.log" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\LocalService\Cookies\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\NetworkService\Cookies\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\NetworkService\IETldCache\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\Documents and Settings\Stan as Admin\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{0911CC7A-87D2-4101-9F87-F16C7B8DA2D0}" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\Sti_Trace.log" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\wiadebug.log" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\wiaservc.log" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\WindowsUpdate.log" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\h323log.txt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\config\AppEvent.Evt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\config\DriverScanner.evt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\config\Internet.evt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\config\SecEvent.Evt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\system32\config\SysEvent.Evt" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\Temp\Perflib_Perfdata_620.dat" - skipped. Reason: The process cannot access the file because it is being used by another process. Warning: Unable to open "C:\WINDOWS\Temp\TMP000000431830C3EB5903FDAA" - skipped. Reason: The process cannot access the file because it is being used by another process. Backup completed on 11/30/2009 at 11:19 PM. Directories: 11934 Files: 118263 Bytes: 57,820,732,593 Time: 1 day, 2 hours, 26 minutes, and 30 seconds I hope that these clues reveal the cause of the problems with this computer. Stan Hiliard
From: Paul on 1 Dec 2009 20:40 Stan Hilliard wrote: <<some snips>> >> >> = 2 >> Event Type: Error >> Event Source: VSS >> Event Category: None >> Event ID: 8193 >> Date: 11/29/2009 >> Time: 3:09:19 PM >> Description: Volume Shadow Copy Service error: Unexpected error >> calling routine CoCreateInstance. hr = 0x8007043c. >> Data: >> 0000: 42 55 45 43 58 4d 4c 43 BUECXMLC >> 0008: 33 35 33 32 00 00 00 00 3532.... >> 0010: 42 55 45 43 58 4d 4c 43 BUECXMLC >> 0018: 33 34 39 34 00 00 00 00 3494.... >> >> = 3 >> Event Type: Error >> Event Source: VSS >> Event Category: None >> Event ID: 5012 >> Date: 11/29/2009 >> Time: 3:09:19 PM >> Description: Volume Shadow Copy Service error: Shadow Copy shim called >> routine CoCreateInstance( CLSID_VSSCoordinator, IID_IVssShim) which >> failed with status 0x8007043c (converted to 0x8000ffff). >> Data: >> 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC >> 0008: 32 32 37 39 00 00 00 00 2279.... >> 0010: 57 53 48 57 53 48 4d 43 WSHWSHMC >> 0018: 31 34 39 31 00 00 00 00 1491.... > > 4) During the run, Task Manager showed that FPAVserver.exe was using > 98% to 99% of the CPU cycles. After the 26-1/2 hour run, I checked > services.msc and the "FPROT Antivirus for Windows system" service was > still stopped. > > I hope that these clues reveal the cause of the problems with this > computer. > > Stan Hiliard An AV application likes to scan things being opened. So calls to the file system, even things like a backup running (where the backup program isn't likely to be running the files being copied), could result in the AV application scanning each one. My Kaspersky subscription used to do that. Either there is an easy to understand setting in the AV control panel to stop it (temporarily), or you need to contact your AV tech support, to see if they'll suggest a way for the tool to be less abusive. On my computer, if I look in Admin tools, Services, I can see "Volume Shadow Copy" service, Startup type "Manual", and service status "Stopped". Do you find yours to be set up different than that ? Is it possible that service needs to be started ? Maybe a backup doesn't start VSS for you. Paul
From: Stan Hilliard on 2 Dec 2009 01:13
On Tue, 01 Dec 2009 20:40:34 -0500, Paul <nospam(a)needed.com> wrote: >Stan Hilliard wrote: > ><<some snips>> > >>> >>> = 2 >>> Event Type: Error >>> Event Source: VSS >>> Event Category: None >>> Event ID: 8193 >>> Date: 11/29/2009 >>> Time: 3:09:19 PM >>> Description: Volume Shadow Copy Service error: Unexpected error >>> calling routine CoCreateInstance. hr = 0x8007043c. >>> Data: >>> 0000: 42 55 45 43 58 4d 4c 43 BUECXMLC >>> 0008: 33 35 33 32 00 00 00 00 3532.... >>> 0010: 42 55 45 43 58 4d 4c 43 BUECXMLC >>> 0018: 33 34 39 34 00 00 00 00 3494.... >>> >>> = 3 >>> Event Type: Error >>> Event Source: VSS >>> Event Category: None >>> Event ID: 5012 >>> Date: 11/29/2009 >>> Time: 3:09:19 PM >>> Description: Volume Shadow Copy Service error: Shadow Copy shim called >>> routine CoCreateInstance( CLSID_VSSCoordinator, IID_IVssShim) which >>> failed with status 0x8007043c (converted to 0x8000ffff). >>> Data: >>> 0000: 57 53 48 43 4f 4d 4e 43 WSHCOMNC >>> 0008: 32 32 37 39 00 00 00 00 2279.... >>> 0010: 57 53 48 57 53 48 4d 43 WSHWSHMC >>> 0018: 31 34 39 31 00 00 00 00 1491.... > >> >> 4) During the run, Task Manager showed that FPAVserver.exe was using >> 98% to 99% of the CPU cycles. After the 26-1/2 hour run, I checked >> services.msc and the "FPROT Antivirus for Windows system" service was >> still stopped. >> > >> I hope that these clues reveal the cause of the problems with this >> computer. >> >> Stan Hiliard > >An AV application likes to scan things being opened. So calls to the >file system, even things like a backup running (where the backup program >isn't likely to be running the files being copied), could result in >the AV application scanning each one. My Kaspersky subscription used >to do that. Either there is an easy to understand setting in the >AV control panel to stop it (temporarily), or you need to contact >your AV tech support, to see if they'll suggest a way for the tool >to be less abusive. I had thought that my F-PROT AV could be stopped by stopping the service "F-PROT Antivirus for Windows system" -- but apparently I was wrong. I am contacting support. >On my computer, if I look in Admin tools, Services, I can see >"Volume Shadow Copy" service, Startup type "Manual", and >service status "Stopped". Do you find yours to be set >up different than that ? Is it possible that service >needs to be started ? Maybe a backup doesn't start VSS >for you. > Paul I checked and "Volume Shadow Copy" service is running. Startup type is "automatic". I am wonder if "Windows Defender" from Microsoft is involved also. I think it might have an file-watching. It's involvement is implied by the following two entries in the ntbackup log file: = Backup started on 11/29/2009 at 8:52 PM. Warning: Unable to open "C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-08312008-160741.log" - skipped. Reason: The process cannot access the file because it is being used by another process. = and = Warning: Unable to open "C:\Documents and Settings\Stan as Admin\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{0911CC7A-87D2-4101-9F87-F16C7B8DA2D0}" - skipped. Reason: The process cannot access the file because it is being used by another process. = After I learn how to completely stop F-PROT I will also stop the Windows Defender service and try another backup. Stan Hilliard |