cancel
Showing results for 
Search instead for 
Did you mean: 

"System Files" is a corrupt file

Jack_tpe
Level 3
Partner

I received the following errors when backing up a Windows 2003 server with McAfee VirusScan running:

Backup- \\server1\System?StateV-79-57344-65247 - A failure occurred reading an object.

Backup- \\server1\System?StateWARNING: "\\server1\System?State\System Files\System Files" is a corrupt file. This file cannot verify.

I found discussions on this forum about setting the agent to debug mode, etc.

What helped me was the McAfee Access Protection Log.  Open the VirusScan Console:

Capture1.JPG

Right-click and View Log.  The log had this:

Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\PROGRAM FILES\SYMANTEC\BACKUP EXEC\RAWS\BEREMOTE.EXE \Device\HarddiskVolumeShadowCopy8\WINDOWS\system32\winlogon.exe Anti-virus Standard Protection:Prevent Windows Process spoofing Action blocked : Read

So, open the properties of the Access Protection in the VirusScan Console.  In the Anti-virus Standard Protection section, edit the Prevent Windows Process spoofing rule.  In the Processes to exclude, add C:\PROGRAM FILES\SYMANTEC\BACKUP EXEC\RAWS\BEREMOTE.EXE.

Now I don't get the error.

1 REPLY 1

CraigV
Moderator
Moderator
Partner    VIP    Accredited

This should be made a blog so consider adding it there.

And I had this problem before with McAfee...this sorted it out a number of years ago. My problem from then on was that the ePO server would randomly decide a media server was no longer part of a policy and kick it from there, causing this issue to start up again. So watch out for that. Not sure if it was a release version that used to cause that!

Cheers!