System state backup fails with error 0xe000fedf - A failure occurred reading an object when Mcafee is installed

Problem

Backup of local or remote server might fail with error - 0xe000fedf when Mcafee virus scan is installed and enabled.
 

Error Message

0xe000fedf - A failure occurred reading an object.

Backup- \\SERVER NAME\System?State
V-79-57344-65247 - A failure occurred reading an object.
 

BEREMOTE debug log from the remote server shows the following errors

[5252] 13:33:11.368 [fsys\shadow] - Informational: calling IVssBackupComponents::SetBackupSucceeded with status 'FS_READING_OBJECT_FAILURE (0xE000FEDF)' for Component 'System Files' in SHADOW::CloseComponent
[5252] 13:33:11.368 [fsys\shadow] - Informational: Closing Component 'System Files'
[5252] 13:33:11.368 [fsys\systemstate] - AD:Status FS_READING_OBJECT_FAILURE (0xE000FEDF) calling FS_ReadObj in SystemState::ReadObj:276
[5252] 13:33:11.368 [fsys\shadow] - Status FS_IN_USE_ERROR (0xE0008485) for Component System Files in SHADOW::ReadComponent
[5252] 13:33:11.368 [fsys\brfs] - brUtil::OpenActiveObject Error: 0xE0008485 Could not open the object csrss.exe C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe  
 

Mcafee Antivirus Protection Log shows the following error

1:33:11 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\Veritas\Backup Exec\RAWS\beremote.exe \Device\HarddiskVolumeShadowCopy26\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe Anti-virus Standard Protection:Prevent Windows Process spoofing Action blocked : Read 

 

Cause

Anti-virus Standard Protection:Prevent Windows Process spoofing rule within Mcafee is blocking read access to system files.
 

Solution

Disable or modify the Anti-virus Standard Protection:Prevent Windows Process spoofing rule by following the below steps

1. Click Start, Programs, McAfee, VirusScan Console.

2. Right-click Access Protection and select Properties.

3. Select Anti-virus Standard Protection.

4. Select Prevent Windows Process spoofing and deselect the Block option. If desired, select the Report option to have entries noted in the Access Protection logs.

5. Click OK

6. Retry the backup job.

Note: If a policy is controlling the settings for Mcafee, the policy needs to be edited to reflect the above change. Changes made locally will not be saved.