[SOLVED] System Restore not working: error 0x81000203 - Kaspersky Removal Tool

Will Watts said:
Okay great - at some point it looks like the Kaspersky Removal Tool has deleted the registry key - this registry key is part of the Volume Shadow Copy service, which handles system restore points.

Optional extra: If you want to check if this has run correctly, you can enter the Registry Editor (Search > regedit), and navigate to Computer/HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} in the address bar. The correct settings should look something like below:

View attachment 49762
Click to expand...

First: *THANKS*

Second: FYI: SysNative Forum has enough rank to appear in my SERPs for "System Protection" 0x81000203

Third:
I have 2 very similar W10 PCs, both running Kaspersky IS2020. On PC#1, I created a Kaspersky Rescue Disk (USB) which is sufficient for both; i.e., I did not do it on PC#2 - this was the only difference. PC#1 (not #2) developed the problem in this topic; so ...

On PC#2, I started Regedit, drilled down to the above key, and found
"UpperFilters REG_MULTI_SZ klbackupdisk volsnap fltsrv"

On PC#1, "volsnap" was missing, so I double-clicked the UpperFilter and added "volsnap" to make it match.

After restart, System Protection is fixed. I don't know if other Kaspersky features might cause the subject problem, but I'm certain my version was caused by creating the KRD. Now I just need to go pester Kaspersky.
 
Will Watts said:
Okay great - at some point it looks like the Kaspersky Removal Tool has deleted the registry key - this registry key is part of the Volume Shadow Copy service, which handles system restore points.

To fix it - please carry out the following steps:

  1. Open a new Notepad window
  2. Copy / Paste the below script into Notepad, and save as "kaspersky_fix.reg":
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]
"UpperFilters"=hex(7):76,00,6f,00,6c,00,73,00,6e,00,61,00,70,00,00,00,00,00


This will update the "UpperFilters" value at this location to be "volsnap" (the hex code decodes to "volsnap"). Once you've copy/pasted the registry key, save this in a location you can easily access (e.g. desktop), and double click on the script to run the fix.


You will need to restart your machine once the fix has run, then check if you get the same issue accessing System Restore.


Optional extra: If you want to check if this has run correctly, you can enter the Registry Editor (Search > regedit), and navigate to Computer/HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} in the address bar. The correct settings should look something like below:


View attachment 49762
Click to expand...
Thank you so much. You saved my life. I searched for long time for this issue where i used kaspersky removal tool lately and had this problem .
 
Hello everyone,
I have the same issue on Windows 10 - "System Restore Error 0x81000203" and chkdsk not running due to all volumes are locked (The shadow copy provider had an unexpected error).
I don't have Kaspersky, but don't think it is something with Bitdefender. I suspect AOMEI Backupper. I was doing system backup but this time the program did not show any progress for 20 min and I restarted the computer. Probably it was waiting for Windows to update. After it I did the image without a problem. Soon after, I found system restore is not working and then tried to run check disk it failed too.
I tried many ways described online but non of them worked. I read this FIX here but not sure if this case is the same.
I checked in the registry and found "UpperFilters REG_MULTI_SZ ambakdrv volsnap".
Will Watts, should I run the script?
Please advise!
 
Awesome! I found my System Restore had this error code System Restore not working: error 0x81000203 after uninstalling AOMEI Backupper Pro and I guess it removed the Reg key so I used the fix to put it back and again System Restore is working!

Thanks a bunch! I love searching for fixes! (y)

2020-07-08_15-22-32.png2020-07-08_15-23-21.png
 
Last edited:
Will Watts said:
Okay great - at some point it looks like the Kaspersky Removal Tool has deleted the registry key - this registry key is part of the Volume Shadow Copy service, which handles system restore points.

To fix it - please carry out the following steps:

  1. Open a new Notepad window
  2. Copy / Paste the below script into Notepad, and save as "kaspersky_fix.reg":
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]
"UpperFilters"=hex(7):76,00,6f,00,6c,00,73,00,6e,00,61,00,70,00,00,00,00,00


This will update the "UpperFilters" value at this location to be "volsnap" (the hex code decodes to "volsnap"). Once you've copy/pasted the registry key, save this in a location you can easily access (e.g. desktop), and double click on the script to run the fix.


You will need to restart your machine once the fix has run, then check if you get the same issue accessing System Restore.


Optional extra: If you want to check if this has run correctly, you can enter the Registry Editor (Search > regedit), and navigate to Computer/HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} in the address bar. The correct settings should look something like below:


View attachment 49762
Click to expand...
Thank you very much for this post. You have solved my problem.
 
Will Watts said:
Okay great - at some point it looks like the Kaspersky Removal Tool has deleted the registry key - this registry key is part of the Volume Shadow Copy service, which handles system restore points.

To fix it - please carry out the following steps:

  1. Open a new Notepad window
  2. Copy / Paste the below script into Notepad, and save as "kaspersky_fix.reg":
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]
"UpperFilters"=hex(7):76,00,6f,00,6c,00,73,00,6e,00,61,00,70,00,00,00,00,00


This will update the "UpperFilters" value at this location to be "volsnap" (the hex code decodes to "volsnap"). Once you've copy/pasted the registry key, save this in a location you can easily access (e.g. desktop), and double click on the script to run the fix.


You will need to restart your machine once the fix has run, then check if you get the same issue accessing System Restore.


Optional extra: If you want to check if this has run correctly, you can enter the Registry Editor (Search > regedit), and navigate to Computer/HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} in the address bar. The correct settings should look something like below:


View attachment 49762
Click to expand...
WOW! Thank you for your expertise. No one had the correct answer except you!

I can confirm that in my case it was NOT Kaspersky. The culprit is Aomei Backupper pro version 6.2 and 6.3 . It removed volsnap and changed it to ambakdrv .

Its ashame, Aomei Backupper pro is fantastic to transfer everything from a desktop to a new laptop. This is the only downside I have noticed so far.

BTW, this happened on a win 10 pro laptop and win 10 pro desktop.

This procedure also solved issues that I was having with windows 10 backup and restore, windows 10 system protection and/or with windows 10 create a system image:


Has anyone opened a new thread about this?
 
Last edited:
Will Watts said:
Okay great - at some point it looks like the Kaspersky Removal Tool has deleted the registry key - this registry key is part of the Volume Shadow Copy service, which handles system restore points.

To fix it - please carry out the following steps:

  1. Open a new Notepad window
  2. Copy / Paste the below script into Notepad, and save as "kaspersky_fix.reg":
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]
"UpperFilters"=hex(7):76,00,6f,00,6c,00,73,00,6e,00,61,00,70,00,00,00,00,00


This will update the "UpperFilters" value at this location to be "volsnap" (the hex code decodes to "volsnap"). Once you've copy/pasted the registry key, save this in a location you can easily access (e.g. desktop), and double click on the script to run the fix.


You will need to restart your machine once the fix has run, then check if you get the same issue accessing System Restore.


Optional extra: If you want to check if this has run correctly, you can enter the Registry Editor (Search > regedit), and navigate to Computer/HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} in the address bar. The correct settings should look something like below:


View attachment 49762
Click to expand...

Hi I have the same issue as the original poster 'Hapaxoromenon'. I have previously followed the three bits of advice:1- Volume Shadow Copy service (started, automatic); 2- Microsoft Software Shadow Copy service (started, set to automatic); 3- Group Policy (changed Disable System restore to '0' ). None of these solved the problem.

I am nervous about modifying registry values. So, before I apply the 'kaspersky_fix.reg', I went to the registry key position (Registry Editor image above). The current value of UpperFilters is shown as 'ambakdrv' (not 'volsnap').

Could I modify this some other way, e.g. via the Edit Multi-string window (which opens when I double-click UpperFilters)?

Thanks
 
Thanks a lot.
I never had Kaspersky software on my PC. I renamed your script in upperfilters.reg and imported it.
It worked thx a lot.
:-)
Johan
 
Kes said:
Could I modify this some other way, e.g. via the Edit Multi-string window (which opens when I double-click UpperFilters)?
Click to expand...

Imo, given that it is a multi-string value, I would put volsnap as first value and ambakdrv (aomei backupper) as second value.
Or the opposite!

volsnap.png
 
xilolee said:
Imo, given that it is a multi-string value, I would put volsnap as first value and ambakdrv (aomei backupper) as second value.
Or the opposite!

View attachment 65034
Click to expand...

Thank you Xilo, I'll re-introduce 'ambakdrv' into the field. My original problem (of creating restore points) has been solved with 'volsnap'. I'd like to thank Will Watts for the original solution.
Kes
 
Kes said:
Thank you Xilo, I'll re-introduce 'ambakdrv' into the field. My original problem (of creating restore points) has been solved with 'volsnap'. I'd like to thank Will Watts for the original solution.
Kes
Click to expand...

It would be interesting to know if all MS and AOMEI functions work with those two values both present in the same registry item.
Will you update us? :-)
 
xilolee said:
It would be interesting to know if all MS and AOMEI functions work with those two values both present in the same registry item.
Will you update us? :-)
Click to expand...

I recently asked the same question of AOMEI support. Here is the reply of 'Admin'.

---
admin
January 25

@Daddybear, @Kes, "volnap" is the driver of VSS service, while the "ambakdrv" is the driver of AOMEI Backupper.
Sorry that AOMEI Backupper 6.3 accidentally delete the "volnap" when installing it. But, when you re-add the "volnap", AOMEI Backupper will not delete it again when you using AOMEI Backupper.
We have fixed the problem in the next version. We will release the new version asap.
---

I wonder if anyone has also flagged the registry corruption issue with Kaspersky, and what their response has been.
 
xilolee said:
It would be interesting to know if all MS and AOMEI functions work with those two values both present in the same registry item.
Will you update us? :-)
Click to expand...
xilolee said:
It would be interesting to know if all MS and AOMEI functions work with those two values both present in the same registry item.
Will you update us? :-)
Click to expand...
I had the same problem with system restore caused by Aomei Backupper Pro v 6.5.1. I entered volsnap after ambakdrv in the 'upperfilters' string & both Aomei Backupper Pro & system restore work fine (manually created a restore point & a full backup as a test)
 
Hello, I just want to say this solution worked. My PC refused to run chkdsk and hibernate, and adding UpperFilters solved the problem. In my case, I didn't have Aomei Backupper installer, but I did a Windows Update disk cleanup. Thank you.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top