Backup Exec remote agent service (BEREMOTE.EXE) terminates in KERNELBASE.dll when backing up any resource on a Windows 2008 or Windows 2008 R2 server.

Article:TECH145072  |  Created: 2010-11-27  |  Updated: 2013-03-21  |  Article URL http://www.symantec.com/docs/TECH145072
Article Type
Technical Solution

Product(s)

Issue



 

When backing up a Windows 2008 R2 server using Backup Exec 2010 or Backup Exec 2010 R2 the Backup Exec Remote Agent Service (BEREMOTE.EXE) terminates right after the Snapshot Processing portion of the backup job. The backup job (To Tape or Backup to Disk) will start and load the media then switch to Snapshot Processing.  During the VSS Snapshot if a corrupt registry or invalid registry path entry is detected and contains a Unicode character the Backup Exec remote agent service may terminate. The job will fail with a Communication Error and a connection to target system has been lost (FIGURE 1).

 

(FIGURE 1)

 


Error



Final error: 0xe000fe30 - A communications failure has occurred
 

The connection to target system has been lost. Backup set canceled

 The following Application Errors are logged on the server:

 Backup Exec 2010 R2

Log Name:      Application
Source:        Application Error
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
Description:
Faulting application name: beremote.exe, version: 13.0.4164.0, time stamp: 0x4c2a6f09
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0
Exception code: 0xe06d7363
Fault offset: 0x000000000000aa7d
Faulting process id: 0x3d58
Faulting application start time: 0x01cb8e6af01bc02e
Faulting application path: C:\Program Files\Symantec\Backup Exec\beremote.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 8bd8b60f-fa5e-11df-8a87-0019b9ca95d0
 

Backup Exec 2010

Log Name:      Application
Source:        Application Error
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
Description:
Faulting application name: beremote.exe, version: 13.0.2896.120, time stamp: 0x4bfaf002
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0
Exception code: 0xe06d7363
Fault offset: 0x000000000000aa7d
Faulting process id: 0x2810
Faulting application start time: 0x01cb35d18cb4eda3
Faulting application path: C:\Program Files\Symantec\Backup Exec\beremote.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: e8560004-a1cf-11df-9b13-a4badb407a51 


Cause



This issue has been specifically observed with the following registry key pointing to a invalid service entry: 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RHDCStarter\

 The RHDCStarter service is pointing to an executable called Dummy.exe and the registry Image Path points to Ú\Dummy.exe which contains a Unicode character "Ú" (FIGURE 2).

 (FIGURE 2)

 
 NOTE: There may be other registry keys or service entries besides "RHDCStarter" with invalid or corrupt information that could cause the same issue.  Using Process Monitor may help in the aid of tracking down the invalid registry entry.


Solution



Export the following registry keys to a files first then delete the registry keys.

 Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
 

1) Export and Delete registry key  HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Services\RHDCStarter\

2) Export and Delete registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet002\Services\RHDCStarter\

3) Export and Delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RHDCStarter\

 


Supplemental Materials

SourceError Code
Value0xe000fe30
Description

A communications failure has occurred


SourceETrack
Value2209801
Description

Backup Exec Remote Agent BEREMOTE.EXE terminates in KERNELBASE.dll when a server service image path contains a unicode character


SourceUMI
ValueV-79-57344-34108
Description

An unexpected error occured when cleaning up snapshot volumes. Confirm that all snapped volumes are correctly resynchronized with the original volumes.


SourceEvent ID
Value1000
Description

Faulting application name: beremote.exe, version: 13.0.4164.0, time stamp: 0x4c2a6f09
 



Article URL http://www.symantec.com/docs/TECH145072


Terms of use for this information are found in Legal Notices