Kaspersky remover causes vss error 0x81000203

The tool KAVREMOVER provided by Kaspersky is good for all kinds of collateral damage. So after running the tool, the computer protection in Windows may return the error code 0x81000203. The system recovery can then no longer be used.

The error image: Computer protection cannot be activated

Right click on the icon Computer or This PC enables via the context menu command Properties to call up the page ‘Show basic information about the computer. Alternatively the key combination Windows+Pause also works.

In the taskbar the command Computer protection are called with administrative permissions.

On the Computer protection the drives can be included in the system recovery by setting the protection to ON. Then Windows creates volume shadow copies (VSS copies) when changes are made to system files.

In this case it doesn’t work, because Windows searches for the drives and ends the attempt with the error code 0x81000203.

Then, in the event viewer, there is a VSS error with event ID 12293 (Routinedetails IVssSnapshotProvider::IsVolumeSupported() failed with 0x8000ffff [hr = 0x8000ffff, Fatal Error). Then in an administrative command prompt, try the command:

vssadmin list volumes

will not give a result. The Volume Shadow Copy Service (VSS) can apparently no longer find the VSS provider. The error is described in MS Answers forums (here).

#1: TuneUp Turbo mode is a cause

TuneUp’s Turbo mode has already been mentioned as a culprit – but there is another cause. Here it helps to switch off the turbo mode – and basically TuneUp is superfluous, but often leads to problems under Windows.

#2: The cause can also be the KAVREMOVER

If you don’t want to have the Kaspersky antivirus or their security products anymore or want to switch to another provider, you should make sure to remove all installation remnants via the Control Panel after uninstalling Kaspersky. For this purpose Kaspersky offers KAVREMOVER, which can be downloaded via the link and then executed under Windows. the tool cleans the system from Kasperky installation files.

Unfortunately, the KAREMOVER has the unpleasant property of leaving collateral damage behind. I had long ago documented the case keyboard and mouse after uninstalling Kasperky dead. But there is another trap.

this comment, a blog reader pointed out that when KAREMOVER cleans up the system, it leaves the UpperFilters-Registry entry truncated too much. In UpperFilters-entry virus scanners enter their own filter driver, which is used to analyze accesses to hard disks. Under the Class ID code:

tab is used to manage the storage volumes of Windows (i.e. the storage disks). In UpperFilters you will find registry entries for filtering the memory accesses. The KAREMOVER deletes in the branch:

the UpperFilters-entry, in which the values fltsrv and volsnap are contained, completely. This not only removes the filter server, but also the provider that should create volume shadow copies is signed out for the hard drives. This then leads to the error code 0x81000203 when the computer protection is switched on.

The case is discussed in the Kaspersky forum in the thread After using the KAVRemover the System Restore is broken Already handled since August 2016 for Windows 10. The blog reader writes:

Obviously removes the KAVREMOVER by mistake under


the entry UpperFilters of type REG_MULTI_SZ with the values "volsnap" and "fltsrv". The class stands for Storage Volumes. After restoring the entry everything works again.

Unfortunately, neither the Kaspersky forum nor the reader’s comment above provide the details of the repair. In this English blog post (see also) the registry values to restore are described.

Windows Registry Editor Version 5.00

Create the above entries with the editor in a .reg file and import it. Then the VSS provider should work again. Maybe it will help one or the other affected person. According to forum entries, the problem with KAVREMOVER should have been fixed since December 2016. On the other hand, the discussion in the Kaspersky forum thread runs until April 2017.

Like this post? Please share to your friends:
Leave a Reply

;-) :| :x :twisted: :smile: :shock: :sad: :roll: :razz: :oops: :o :mrgreen: :lol: :idea: :grin: :evil: :cry: :cool: :arrow: :???: :?: :!: