Macrium Reflect Backup Failures

Qwinn said:

Are you running a volatile Ramdisk? I am running one with Softperfect, 2gb, for my browser caches. I was getting some VSS errors. To fix it with Softperfect, you just need to modify the Ramdisk settings to "Mount as removable". The errors also don't occur if you're imaging the Ramdisk to a drive - it only affects volatile ramdisks that aren't set to mount as removable. It actually DID affect any ramdisk created by older versions of Softperfect, they eventually fixed it, so if you're using some other brand of ramdisk, they may not have fixed it yet.

At any rate, the exact error code DOES appear to be related to insufficient disk space per that knowledge base link, so I'd look at everything else that's getting a drive letter on your system. Maybe you have a USB stick plugged in, or an external hard drive? Take any CD out of your optical drive too. Just because you're not telling it to back those other drive letters up doesn't mean it won't generate errors due to them.

No Ramdisk. There is more than enough disk space,as delineated in one of my previous replies. No USB stick. The external hard disk has been installed and in use since day one of this computer, last February; with it unplugged, Restore Point continues to not work. No CD nor DVD in optical drive. Assigned drive letters are just as they have been, without causing any problem until a few days ago.

It is, to me, rather evident that it is the Restore Point problem that is the root cause keeping Macrium Reflect to fail.

simrick said:

Yeah, nothing to see here - everything looks fine.

AU = Anniversary Update (v1607)

See post #2 here; Kyhi's Image Health tool.
Windows 10 Recovery Tools - Bootable Rescue Disk - Windows 10 Forums

What version Windows are you running? 1511 or 1607?
Perhaps, if the above doesn't do anything, we could try a repair install with an in-place upgrade.
Repair Install Windows 10 with an In-place Upgrade - Windows 10 Forums

But you need to use the same version ISO as what you're running on the system, and the latest ISOs from MS will be v1607.

EDIT: You're quite sure the system is virus-free? Because they will prevent System Restore from working.

Good point. I found after Anniversary Update that trying to return to an earlier a Restore Point produced "Failed due to a missing file. No change made" (or something like that). With help from elsewhere it was found that my Kaspersky internet Security 2016 was the culprit. I have uninstalled it (using Windows Uninstall) and the problem has gone. Perhaps it interferes in your problem.

simrick said:

Yeah sorry - we tend to use acronyms and we really shouldn't. People we're helping, as well as people who read the threads later, are not served well by our use of acronyms. Sorry about that.



Okay good. That will be the version downloading from MS now.



Doesn't surprise me. MS don't turn on System Restore by default like they did in previous operating systems - in W10 they turn it off by default. Those were KB3176936 and KB3176934, right?

I don't know.

I still don't understand why turning off the VSS requirements in Macrium didn't allow it to work - it should have.

I think that I know, and it relates to your comment that you don't think that my assertion about Restore Point being the problem underlying the Macrium failures. I don't recall the precise steps that led me to that conclusion, but it started with my looking at the Macrium help file and following the entry about a specific error code that appears in my Macrium logs. In pursuing that trail, I found a specific entry somewhere that, as I recall, VSS errors can arise if, for example, you have too many Restore Points. I don't, of course, know why that should be, only that the information was presented.

My next step was to go to Restore Point, to see how many I might have, and to delete at least some of them, which is when I quickly discovered that RP (that is an abbreviation for something or another...) is corrupt. As to when this arose, I can judge from the information in Total Uninstall: When you install or update a program from within TU (yes, another...), the first thing that it does is to create a Restore Point; I have entries for 20/21/23 August, 2016.

Did this all start after you took the v1607 Anniversary update? and was Avast installed and running on the system during the update?

No, as stated just above, RP was working until a few days ago, which was well after I installed AU. Yes, RP was running during the update; I leave it on so that I can use Total Install without having to re-enable RP each time.

It really shouldn't be.

Do me a favor and run these, in this order:

RKILL

ADWCleaner

JRT

Post the logs here in a code box (use # in the toolbar) for me to eval. Thanks.

Code:

Rkill 2.8.4 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/25/2016 08:27:01 AM in x64 mode.
Windows Version: Windows 10 Home 

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

 * Reparse Point/Junctions Found (Most likely legitimate)!

     * C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 => C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\IE [Dir]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..icingstack-cmitrust_31bf3856ad364e35_10.0.14393.0_none_145e7a4159d239dd\cmitrust.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\bcdeditai.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\ConfigureIEOptionalComponentsAI.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\FeatureSettingsOverride.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\IEFileInstallAI.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\msdtcadvancedinstaller.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\netfxconfig.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\peerdistai.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\PrintAdvancedInstaller.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\servicemodelregai.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..ingstack-base-extra_31bf3856ad364e35_10.0.14393.0_none_f05abb1521a8c58e\SetIEInstalledDateAI.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-s..k-transformers-core_31bf3856ad364e35_10.0.14393.0_none_3d896aa333c64126\PrimitiveTransformers.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\CbsCore.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\CbsMsg.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\cmiadapter.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\dpx.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\drupdate.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\drvstore.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\msdelta.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\mspatcha.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\poqexec.exe => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\smiengine.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\smipi.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\TiFileFetcher.exe => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\wdscore.dll => <Unknown Target> [File]
     * C:\WINDOWS\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_dab53140259fad95\wrpint.dll => <Unknown Target> [File]

Checking Windows Service Integrity: 

 * gagp30kx [Missing Service]
 * IEEtwCollectorService [Missing Service]
 * IoQos [Missing Service]
 * nv_agp [Missing Service]
 * TimeBroker [Missing Service]
 * uagp35 [Missing Service]
 * uliagpkx [Missing Service]
 * WcsPlugInService [Missing Service]
 * wpcfltr [Missing Service]
 * WSService [Missing Service]

 * agp440 [Missing ImagePath]
 * WMPNetworkSvc [Missing ImagePath]

 * AJRouter => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted [Incorrect ImagePath]
 * WpnService => %systemroot%\system32\svchost.exe -k netsvcs [Incorrect ImagePath]

 * vmicrdv => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL]
 * vmicvss => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL]

Searching for Missing Digital Signatures: 

 * No issues found.

Checking HOSTS File: 

 * HOSTS file entries found: 

  127.0.0.1       localhost
  0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
  0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
  0.0.0.0 media.opencandy.com
  0.0.0.0 cdn.opencandy.com
  0.0.0.0 tracking.opencandy.com
  0.0.0.0 api.opencandy.com
  0.0.0.0 api.recommendedsw.com
  0.0.0.0 installer.betterinstaller.com
  0.0.0.0 installer.filebulldog.com
  0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
  0.0.0.0 inno.bisrv.com
  0.0.0.0 nsis.bisrv.com
  0.0.0.0 cdn.file2desktop.com
  0.0.0.0 cdn.goateastcach.us
  0.0.0.0 cdn.guttastatdk.us
  0.0.0.0 cdn.inskinmedia.com
  0.0.0.0 cdn.insta.oibundles2.com
  0.0.0.0 cdn.insta.playbryte.com
  0.0.0.0 cdn.llogetfastcach.us

  20 out of 36 HOSTS entries shown.
  Please review HOSTS file for further entries.

Program finished at: 08/25/2016 08:27:42 AM
Execution time: 0 hours(s), 0 minute(s), and 40 seconds(s)

==
ADWCleaner found only one entry, FreeDownloadManagerNetworkMonitor, which I found out is actually the MS Network Monitor. That has only appeared in ADWCleaner recently, and may be part of the latest version of Free Download Manager. I had run ADWCleaner yesterday, which found two Registry keys it did not like; I left the monitor alone, which is why it was found today.

==
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 10 Home x64 
Ran by John (Administrator) on 25-Aug-16 at  8:51:54.47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 5 

Successfully deleted: C:\ProgramData\mntemp (File) 
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDEventLauncherTask (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\PCDoctorBackgroundMonitorTask (Task)
Successfully deleted: C:\WINDOWS\prefetch\TREESIZEFREE.EXE-163E8C6B.pf (File) 
Successfully deleted: C:\WINDOWS\prefetch\TREESIZEFREESETUP.TMP-FD74A480.pf (File) 



Registry: 4 

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Free Download Manager (Registry Value) 
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6F19585E-CB90-490F-BF12-B6699FC7062D} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13D67BB7-DB5F-48AA-884D-7A5D94168509} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13D67BB7-DB5F-48AA-884D-7A5D94168509} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25-Aug-16 at  9:04:21.76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It tried to create a RP, could not, allowed one to go ahead.

I do hope that you don't charge by the hour for technical support!

I don't know much about VSS I'm afraid - but I did come across this page on Macrium's website.
Is it any use?
http://knowledgebase.macrium.com/dis...ors?src=search
Edit:
and this one which is perhaps more helpful:
http://knowledgebase.macrium.com/dis...ors?src=search

And the first line mentions MS Servicing Stack, which was just released on the 23rd.
Servicing stack update KB3176936 Windows 10 version 1607 - Windows 10 Forums

Maybe something went awry with that KB3176936 install.

Please check to see if it was installed, and when and if it was successful.

Settings>Update & security>Windows Update>Update History

Then maybe try uninstalling it and rebooting a few times (making sure Fast Startup is OFF first).

Yes, I do have KB3176936, but it was only installed yesterday, which was a few days after I first encountered the Macrium problem (and if my theory is correct, that was when the Restore Point problem began.)

Ought I remove KB3176936 anyway, or might that be futile?