Windows Backup error 80070005 or 800700E1

February 7, 2012 at 7:58 pm (computers, security) (, , , )

This was making me scratch my head the other day – I was trying to backup a Vista machine to a removable hard drive, and the backup kept failing with the obscure error message “80070005 – Access Denied” (or might have said “Permission denied” – something like that).

Update: More recently (Windows 10) it was “800700E1”  (“the file contains a virus or other unwanted software”).

The references I found to this on the Internet seemed to suggest that turning off your anti-virus software whilst backing up would cure things, but I didn’t fancy that route at all.  However that did give me a clue.

Looking at the logs for MS Security Essentials, yes, there was a file that was being backed up that MSSE was blocking by indicating that it contained malware.  So I performed the corrective action (removing the file) and started again. However the backup failed yet again with the same error.

That time though, I watched it backing things up and then realised what the issue was.  Windows creates a copy of everything it will backup and then copies that copy to the backup media.  MSSE was kicking in on the second copy – when trying to copying the backup copy to the removable media.  Consequently when I performed the corrective action of removing the offending file, it was removing the copy not the original file.  When the next backup started, Windows created another copy of the dodgy file and the backup failed yet again.

So, once I had located the original file on the disk and removed it, the next backup worked fine.

I’m not sure why creating the first backup copy didn’t trigger MSSE – maybe creating Volume Shadow Copies is special and happens “under the hood” – hence is not seen by MSSE.  I’m also not sure why MSSE didn’t trigger when the offending file was actually placed on the disk in the first place, but maybe it was a file whose signature appeared in MSSE once it was already installed.

Either way, I managed to ‘solve’ error 80070005 without resorting to turning off the PC’s security defenses.  It may have taken an hour to work out, but I’m sure that restoring after a virus problem from a backup that also contains the same virus would take a lot longer than an hour.

Moral of the tale?  Don’t ignore your security warnings and if the Internet wisdom says “turn off your AV to solve your problem” … well, I strongly recommend you don’t!  Solving the symptoms does not cure the issue.

Kevin.

 

Permalink 6 Comments