- xp sp2 with all the latest patches from windows update
- thorough AV scan is clean
- complete anti malware / spyware is clean
- chkdsk c: /f /r is clean
- rebooting makes no difference
- no event log errors

The problem is that when I do a system state backup, it gets to the
c:\windows\system32\drivers\rootmdm.sys file and then crashes. (The
error is the one where it says that the app has had a problem and it
sends a report to Microsoft.) Because of this, I am unable to do a
system state backup at present. Apart from this, all is well with the
PC.

Any ideas?
TIA
Mark

Are there any errors in the event logs or the ntbackup logs?

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca/phpBB2/



news@mail.adsl4less.com wrote:
> - xp sp2 with all the latest patches from windows update
> - thorough AV scan is clean
> - complete anti malware / spyware is clean
> - chkdsk c: /f /r is clean
> - rebooting makes no difference
> - no event log errors
>
> The problem is that when I do a system state backup, it gets to the
> c:\windows\system32\drivers\rootmdm.sys file and then crashes. (The
> error is the one where it says that the app has had a problem and it
> sends a report to Microsoft.) Because of this, I am unable to do a
> system state backup at present. Apart from this, all is well with the
> PC.
>
> Any ideas?
> TIA
> Mark

Are there any errors in the event logs or the ntbackup logs?

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca/phpBB2/



news@mail.adsl4less.com wrote:
> - xp sp2 with all the latest patches from windows update
> - thorough AV scan is clean
> - complete anti malware / spyware is clean
> - chkdsk c: /f /r is clean
> - rebooting makes no difference
> - no event log errors
>
> The problem is that when I do a system state backup, it gets to the
> c:\windows\system32\drivers\rootmdm.sys file and then crashes. (The
> error is the one where it says that the app has had a problem and it
> sends a report to Microsoft.) Because of this, I am unable to do a
> system state backup at present. Apart from this, all is well with the
> PC.
>
> Any ideas?
> TIA
> Mark

Kerry Brown wrote:
> Are there any errors in the event logs or the ntbackup logs?
>
> news@mail.adsl4less.com wrote:
> > - no event log errors
- no ntbackup log errors either.

Kerry Brown wrote:
> Are there any errors in the event logs or the ntbackup logs?
>
> news@mail.adsl4less.com wrote:
> > - no event log errors
- no ntbackup log errors either.

If it gets a system error and you get the dialog about sending a report to
Microsft there should be an event in one of the logs. It may be seemingly
unrelated other than the time when it occurs. It should identify an event id
and possibly an application.

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca/phpBB2/



news@mail.adsl4less.com wrote:
> Kerry Brown wrote:
>> Are there any errors in the event logs or the ntbackup logs?
>>
>> news@mail.adsl4less.com wrote:
>>> - no event log errors
> - no ntbackup log errors either.

If it gets a system error and you get the dialog about sending a report to
Microsft there should be an event in one of the logs. It may be seemingly
unrelated other than the time when it occurs. It should identify an event id
and possibly an application.

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca/phpBB2/



news@mail.adsl4less.com wrote:
> Kerry Brown wrote:
>> Are there any errors in the event logs or the ntbackup logs?
>>
>> news@mail.adsl4less.com wrote:
>>> - no event log errors
> - no ntbackup log errors either.

Kerry Brown wrote:
> If it gets a system error and you get the dialog about sending a report to
> Microsft there should be an event in one of the logs. It may be seemingly
> unrelated other than the time when it occurs. It should identify an event id
> and possibly an application.
>

I agree - there should be an error in one of these logs. But there
isn't. (The only references are, as expected, the normal vss services
starting and stopping.) There is, of course, the debug report which I
punt to Microsoft each time it happens:

appname: ntbackup
appver: 5.1.2600.2180
modname: ntbackup.exe
modver: 5.1.2600.2180
offset: 000a63f8

(For some strange reason, MS don't allow the debug detail to be copied
and pasted, and there's no way I'm typing in all that module info!)

Is it just "one of those things that windows does every now and then"
that requires an os reinstall?

Kerry Brown wrote:
> If it gets a system error and you get the dialog about sending a report to
> Microsft there should be an event in one of the logs. It may be seemingly
> unrelated other than the time when it occurs. It should identify an event id
> and possibly an application.
>

I agree - there should be an error in one of these logs. But there
isn't. (The only references are, as expected, the normal vss services
starting and stopping.) There is, of course, the debug report which I
punt to Microsoft each time it happens:

appname: ntbackup
appver: 5.1.2600.2180
modname: ntbackup.exe
modver: 5.1.2600.2180
offset: 000a63f8

(For some strange reason, MS don't allow the debug detail to be copied
and pasted, and there's no way I'm typing in all that module info!)

Is it just "one of those things that windows does every now and then"
that requires an os reinstall?

news@mail.adsl4less.com wrote:
> Kerry Brown wrote:
> > If it gets a system error and you get the dialog about sending a report to
> > Microsft there should be an event in one of the logs. It may be seemingly
> > unrelated other than the time when it occurs. It should identify an event id
> > and possibly an application.
> >
>
> I agree - there should be an error in one of these logs. But there
> isn't. (The only references are, as expected, the normal vss services
> starting and stopping.) There is, of course, the debug report which I
> punt to Microsoft each time it happens:
>
> appname: ntbackup
> appver: 5.1.2600.2180
> modname: ntbackup.exe
> modver: 5.1.2600.2180
> offset: 000a63f8
>

Just to be clear, there is no system event log error. The above is an
app log error. Also...

- tried a sfc /scannow : no errors on the scan and still getting the
ntbackup crash
- disabled the AV software : still getting the ntbackup crash

Any more ideas? The problem happens with rootmdm.sys every time.

news@mail.adsl4less.com wrote:
> Kerry Brown wrote:
> > If it gets a system error and you get the dialog about sending a report to
> > Microsft there should be an event in one of the logs. It may be seemingly
> > unrelated other than the time when it occurs. It should identify an event id
> > and possibly an application.
> >
>
> I agree - there should be an error in one of these logs. But there
> isn't. (The only references are, as expected, the normal vss services
> starting and stopping.) There is, of course, the debug report which I
> punt to Microsoft each time it happens:
>
> appname: ntbackup
> appver: 5.1.2600.2180
> modname: ntbackup.exe
> modver: 5.1.2600.2180
> offset: 000a63f8
>

Just to be clear, there is no system event log error. The above is an
app log error. Also...

- tried a sfc /scannow : no errors on the scan and still getting the
ntbackup crash
- disabled the AV software : still getting the ntbackup crash

Any more ideas? The problem happens with rootmdm.sys every time.

> Any more ideas? The problem happens with rootmdm.sys every time.
More info:
- Renamed rootmdm.sys to rootmdm-old.sys (had to disable windows file
protection first to do this which in xp sp2 is a bit of a pain, but I
got there in the end) in drivers and dllcache.
- With windows file protection disabled, the system state backup works.
However, it only backs up a 1/4 of the files, presumably because with
the wfp disabled, it is the equivalent of asking ntbackup not to backup
files protected by the system? Anyway, i digress...
- I reenabled file protection and rebooted and tried again. It still
crashed, but this time, the file it bombed out on rndismpx.sys instead.


Now interestingly, rndismpx.sys is the file that comes exactly before
rootmdm-old.sys in the file system when ordered alphabetically! So,
does ntbackup have a limit on the number of files it can back up when
backing up the system state?

> Any more ideas? The problem happens with rootmdm.sys every time.
More info:
- Renamed rootmdm.sys to rootmdm-old.sys (had to disable windows file
protection first to do this which in xp sp2 is a bit of a pain, but I
got there in the end) in drivers and dllcache.
- With windows file protection disabled, the system state backup works.
However, it only backs up a 1/4 of the files, presumably because with
the wfp disabled, it is the equivalent of asking ntbackup not to backup
files protected by the system? Anyway, i digress...
- I reenabled file protection and rebooted and tried again. It still
crashed, but this time, the file it bombed out on rndismpx.sys instead.


Now interestingly, rndismpx.sys is the file that comes exactly before
rootmdm-old.sys in the file system when ordered alphabetically! So,
does ntbackup have a limit on the number of files it can back up when
backing up the system state?

Beginning to look like a bug: someone else is having the exact same
problem as me.

http://groups.google.co.uk/group/mic...82e6a4d?&hl=en

Beginning to look like a bug: someone else is having the exact same
problem as me.

http://groups.google.co.uk/group/mic...82e6a4d?&hl=en