[SOLVED] File Level Restore Causes BSOD

[AlexLeadingEdge]

I'm seeing a BSOD for a client who is using Veeam End Point 1.5. The end user is running Vipre Antivirus, Webroot, Malwarebytes (non-Pro version) and Windows Defender. Windows Defender isn't running in real-time, just a full scan every so often. Malwarebytes is the non-pro version so it doesn't do real-time scanning

I'm not sure which one is doing it, or a combination. Assumed it was Webroot as I've seen this same issue on 09 August 2016 for another client caused by Webroot but disabling just Webroot doesn't fix to stop the BSOD this time. Disabling all antivirus fixes it.

Uninstalled Webroot and changed Vipre over to Bitdefender. End user is also behind on their Windows 10 updates, cumulative update for 1607 completed.

Reboot completed, tested OK for File Level Restore.

[Mike Resseler]

Hi Alex,

It might be a bit late now but where there exclusions created in the AV?

[AlexLeadingEdge]

Hi Alex,

It might be a bit late now but where there exclusions created in the AV?

Yes, I had these folders excluded:

C:\Program Files (x86)\Veeam\
C:\Program Files\Veeam\
C:\Windows\System32\config\systemprofile\
C:\ProgramData\Veeam\

At the time I wondered if the exclusion file masks weren't working so I rebuilt them all as well.

[Mike Resseler]

Those are mostly not enough. For some AV we have seen you need to exclude the process and the folder where we mount the recovery also.
I should talk to support to adapt our KB with more information. Does it work with Bitdefender?

And secondly, did the BSOD appear during file recovery?

Thanks
Mike

[Dima P.]

Alex,

Do not forget to add the backup location to exclusions too, as stated in this KB article. Thanks!

[AlexLeadingEdge]

Does it work with Bitdefender?

Yes, it appears to be working fine with it.

And secondly, did the BSOD appear during file recovery?

Yes, at the beginning.

Do not forget to add the backup location to exclusions too, as stated in this KB article. Thanks!

A good point but hard to do as the backup locations are to USB drives and the drive letters can change. For our business clients we use Drive Letter Fixer, but for the home users we just register the drive and that is pretty much it.