none
Backup makes the server go crazy!

    Question

  • I don't have any idea what is going on with this server.

    Server 2008 x86 fully patched

    Backup software is Appassure Relay 4.7 (latest version).

    So the server runs fine with no problems as long as I don't do a backup. I have verified that it is the backup causing the issue because if I don't perform any then the problem never happens. When I perform a backup the problem occurs after about 10 minutes and results in having to reboot the computer to do anything.

    Basically the backup fails saying the Network path is no longer available.

    Here is the thing.. when this happens and you try to log into the server you get a message saying: "Logon process has failed to create the security dialog." "Failure - Security Options". After click OK you just get a black screen. Sending a CTRL+ALT+DELETE causes that dialog box to popup again.

    I have ran SFC /SCANNOW with no luck. I have scanned the system with Malwarebytes, TDSSKILLER, and scanned with the installed AV called Bitdefender. It is a virtual machine and I can't seem to send a reboot or a force reboot to it when this happens. I am using Xenserver and have to go in and kill the domain to get it to power off.

    Any ideas? I am at a loss where to go. I see nothing really in the event logs for this.

    Friday, June 28, 2013 5:31 AM

All replies

  • have you checked with  Appasure support?

    Do you use Appasure with other VM and does it work fine? or you're only using on that problematic VM?

    check out this link:

    http://forum.appassure.com/

    http://community.spiceworks.com/topic/188911-wanted-to-look-at-appassure-replay-but-i-m-afraid-of-the-negative-comments


    Every second counts..make use of it.


    • Edited by cguan Friday, June 28, 2013 6:14 AM grammar
    Friday, June 28, 2013 6:13 AM
  • I have not checked with Appassure yet because honestly I didn't think it was Appassure. We run that backup software on tons of servers and I'm having this issue on two servers. The thing is we have always been running Appassure on these servers.

    Things in common:

    Both servers are 2008 x86.

    Both servers started doing the same thing around the same time

    Only big thing I can think has changed is Windows Updates

    Looking at the CBS.log I see this:

    2013-06-28 00:49:53, Info                  CSI    000001a1 Hashes for file member \??\C:\Windows\system32\wbem\Wdf01000Uninstall.mof do not match actual file [l:42{21}]"Wdf01000Uninstall.mof" :
      Found: {l:32 b:Khw6Snu1wJ++GNIoY6yxl9I9YcMFd1DIgoHfKZafkno=} Expected: {l:32 b:Yt1Cj1cn2TiRYuRVf4giD3Kg40g43GBdTTr4ip5TNCI=}
    2013-06-28 00:49:53, Info                  CSI    000001a2 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
    2013-06-28 00:49:53, Info                  CSI    000001a3 Hashes for file member \??\C:\Windows\system32\wbem\Wdf01000.mof do not match actual file [l:24{12}]"Wdf01000.mof" :
      Found: {l:32 b:ew+xsUJbni5eIvJoq16I+phaGGLWets5I4YF9P6gDL0=} Expected: {l:32 b:rjBJp3JUDkwqQn/7E5mVEcjWSk0b/GPJ4b/7QWTo3N8=}
    2013-06-28 00:49:53, Info                  CSI    000001a4 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
    2013-06-28 00:49:53, Info                  CSI    000001a5 WARNING: File [l:42{21}]"Wdf01000Uninstall.mof" in [l:56{28}]"\??\C:\Windows\system32\wbem" switching ownership
        Old: Microsoft-Windows-WDF-Kernel Library, Version = 6.0.6002.18574, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
        New: Microsoft-Windows-WDF-Kernel Library-MOF, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    2013-06-28 00:49:53, Info                  CSI    000001a6 WARNING: File [l:24{12}]"Wdf01000.mof" in [l:56{28}]"\??\C:\Windows\system32\wbem" switching ownership
        Old: Microsoft-Windows-WDF-Kernel Library, Version = 6.0.6002.18574, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
        New: Microsoft-Windows-WDF-Kernel Library-MOF, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    2013-06-28 00:49:53, Info                  CSI    000001a7 Hashes for file member \??\C:\Windows\system32\wbem\Wdf01000Uninstall.mof do not match actual file [l:42{21}]"Wdf01000Uninstall.mof" :
      Found: {l:32 b:Yt1Cj1cn2TiRYuRVf4giD3Kg40g43GBdTTr4ip5TNCI=} Expected: {l:32 b:Khw6Snu1wJ++GNIoY6yxl9I9YcMFd1DIgoHfKZafkno=}
    2013-06-28 00:49:53, Info                  CSI    000001a8 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
    2013-06-28 00:49:53, Info                  CSI    000001a9 Hashes for file member \??\C:\Windows\system32\wbem\Wdf01000.mof do not match actual file [l:24{12}]"Wdf01000.mof" :
      Found: {l:32 b:rjBJp3JUDkwqQn/7E5mVEcjWSk0b/GPJ4b/7QWTo3N8=} Expected: {l:32 b:ew+xsUJbni5eIvJoq16I+phaGGLWets5I4YF9P6gDL0=}
    2013-06-28 00:49:53, Info                  CSI    000001aa [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
    2013-06-28 00:49:53, Info                  CSI    000001ab WARNING: File [l:42{21}]"Wdf01000Uninstall.mof" in [l:56{28}]"\??\C:\Windows\system32\wbem" switching ownership
        Old: Microsoft-Windows-WDF-Kernel Library-MOF, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
        New: Microsoft-Windows-WDF-Kernel Library, Version = 6.0.6002.18574, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    2013-06-28 00:49:53, Info                  CSI    000001ac WARNING: File [l:24{12}]"Wdf01000.mof" in [l:56{28}]"\??\C:\Windows\system32\wbem" switching ownership
        Old: Microsoft-Windows-WDF-Kernel Library-MOF, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
        New: Microsoft-Windows-WDF-Kernel Library, Version = 6.0.6002.18574, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    2013-06-28 00:49:53, Info                  CSI    000001ad Repair results created:
    POQ 76 starts:
         0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\777c934fc373ce01a11f000064046c04._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
        1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\d7dd954fc373ce01a21f000064046c04.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
        2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\b7c4a14fc373ce01a31f000064046c04.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
        3: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\7787a64fc373ce01a41f000064046c04.$$_system32_wbem_06656d9fdf2f8577.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms"
        4: Hard Link File: Source = [l:258{129}]"\SystemRoot\WinSxS\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000.mof", Destination = [l:82{41}]"\??\C:\Windows\system32\wbem\Wdf01000.mof"
        5: Hard Link File: Source = [l:276{138}]"\SystemRoot\WinSxS\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000Uninstall.mof", Destination = [l:100{50}]"\??\C:\Windows\system32\wbem\Wdf01000Uninstall.mof"
        6: Hard Link File: Source = [l:250{125}]"\SystemRoot\WinSxS\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000.mof", Destination = [l:82{41}]"\??\C:\Windows\system32\wbem\Wdf01000.mof"
        7: Hard Link File: Source = [l:268{134}]"\SystemRoot\WinSxS\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000Uninstall.mof", Destination = [l:100{50}]"\??\C:\Windows\system32\wbem\Wdf01000Uninstall.mof"
        8: Checkpoint

    Googling I found a page talking about KB2761494 being the cause of these errors in CBS.log

    I just removed that update and rebooted. Currently i'm running another SFC scan to see if it gives any errors this time. If it doesn't then I'm going to try another backup and see if I get the same results or not.

    Friday, June 28, 2013 6:29 AM
  • AFter removing kb2761494 and rebooting the SFC scan now shows there are no integrity problems.... executing a backup now..

    Let you know in 10 minutes!!

    Friday, June 28, 2013 6:30 AM
  • Uhm sort of the same problem. Backup failed... caused the system to act weird but this time I could at least attempt to login and be able to run taskmgr and such.. before I would just get the error listed on my first post.

    I'm going to install a different backup software I have and see what happens.

    Friday, June 28, 2013 7:01 AM
  • The other servers that works fine, do they have same windows update with those problematic servers?

    Remove any drivers update from Windows if there is.


    Every second counts..make use of it.

    Friday, June 28, 2013 8:00 AM