Windows Backup error 80070005 or 800700E1

February 7, 2012 at 7:58 pm (computers, security) (, , , )

This was making me scratch my head the other day – I was trying to backup a Vista machine to a removable hard drive, and the backup kept failing with the obscure error message “80070005 – Access Denied” (or might have said “Permission denied” – something like that).

Update: More recently (Windows 10) it was “800700E1”  (“the file contains a virus or other unwanted software”).

The references I found to this on the Internet seemed to suggest that turning off your anti-virus software whilst backing up would cure things, but I didn’t fancy that route at all.  However that did give me a clue.

Looking at the logs for MS Security Essentials, yes, there was a file that was being backed up that MSSE was blocking by indicating that it contained malware.  So I performed the corrective action (removing the file) and started again. However the backup failed yet again with the same error.

That time though, I watched it backing things up and then realised what the issue was.  Windows creates a copy of everything it will backup and then copies that copy to the backup media.  MSSE was kicking in on the second copy – when trying to copying the backup copy to the removable media.  Consequently when I performed the corrective action of removing the offending file, it was removing the copy not the original file.  When the next backup started, Windows created another copy of the dodgy file and the backup failed yet again.

So, once I had located the original file on the disk and removed it, the next backup worked fine.

I’m not sure why creating the first backup copy didn’t trigger MSSE – maybe creating Volume Shadow Copies is special and happens “under the hood” – hence is not seen by MSSE.  I’m also not sure why MSSE didn’t trigger when the offending file was actually placed on the disk in the first place, but maybe it was a file whose signature appeared in MSSE once it was already installed.

Either way, I managed to ‘solve’ error 80070005 without resorting to turning off the PC’s security defenses.  It may have taken an hour to work out, but I’m sure that restoring after a virus problem from a backup that also contains the same virus would take a lot longer than an hour.

Moral of the tale?  Don’t ignore your security warnings and if the Internet wisdom says “turn off your AV to solve your problem” … well, I strongly recommend you don’t!  Solving the symptoms does not cure the issue.

Kevin.

 

Advertisements

5 Comments

  1. Mike Pepper said,

    Kevin, Great post about the “access denied” error, but what is the location and name of the file that you had to remove, please?

    Thanks very much

  2. Kevin said,

    I can’t remember now I’m afraid. It was something dodgy that the kids had downloaded and that MSSE then decided was a problem when the backup process was running.

    Kevin

  3. Mike Pepper said,

    OK: thanks. I thought that you were talking about a temporary database that Backup makes. Some followups, please:

    1. Did you find the problem file’s name in an event log? Which one?

    2. Is there a particular place that Windows keeps these temporary copies? Is it hidden?

    Thanks again.

    • Kevin said,

      I’m a bit hazy on details now, but I believe the copy was a system restore point, which windows creates in a special place on the disk, usually the hidden ‘System Volume Information’.

      I think I spotted it as MSSE popped up a warning when the backup was running and pointed to the problem file in the system restore area, but that’s about all I remember now, sorry.

      Kevin

  4. Mike Pepper said,

    OK. Thanks again. We’re not getting any warning from MSSE and the machine in question scans clean. I liked the idea of Backup getting stuck on a temporary file of its own making.

    Thanks again.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: