Windows 10: Windows Defender delete Volume Shadow Snapshot?

Discus and support Windows Defender delete Volume Shadow Snapshot? in AntiVirus, Firewalls and System Security to solve the problem; Hi folks,Recently, my antivirus applicationCrowdStrike detect and terminated that Windows Defender behavior because of it suspicious activity. My... Discussion in 'AntiVirus, Firewalls and System Security' started by Chrysolophus, Feb 23, 2022.

  1. CHRYSOLOPHUS
    Chrysolophus Win User

    Windows Defender delete Volume Shadow Snapshot?


    Hi folks,Recently, my antivirus applicationCrowdStrike detect and terminated that Windows Defender behavior because of it suspicious activity. My question is, Do Windows Defender ever try to delete Volume Shadow Snapshot itself? or there is a something real issue on my computer? Thank you.

    :)
     
    Chrysolophus, Feb 23, 2022
    #1
  2. DALCHINA
    dalchina Win User

    Failed to Create Volume Snapshot Macrium Error 0x8004230f VSS Error

    Hi, you might try this:
    Microsoft Volume Shadow Copy (VSS) Troubleshooting - Microsoft Volume Shadow Copy (VSS) Troubleshooting

    or the free cautious repair tool
    Tweaking.com - Windows Repair Free/Pro
    - observing the steps and using only the relevant repairs

    More:
    How to Fix VSS Errors Step-by-Step

    Otherwise I suggest- assuming your disk and file system are sound-
    an in-place upgrade repair install which keeps all progs, data and most settings

    You need an iso of the same base language and build- freely downloadable.
     
    dalchina, Feb 23, 2022
    #2
  3. BICONIX
    biconix Win User
    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered.

    I am getting a bunch of errors in the application log related to the Volume Copy Service. I first noticed it when I tried to create a recovery drive and the error simply said that "A problem occurred while creating the recovery drive"

    I examined the application log and noticed that this error occurs periodically, not only when I try to create the drive. I included the four errors below.

    What do I need to do to fix this?

    I am using a Surface pro 4, windows 10 with up to the minute patches. I also have installed carbonite but I doubt this is the cause as I did not encounter this problem on previous PCs

    Thanks in advance for any assistance

    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance
    on class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} and Name SW_PROV is [0x80040154, Class not registered

    ].

    Operation:

    Obtain a callable interface for this provider

    List interfaces for all providers supporting this context

    Check If Volume Is Supported by Provider

    Add a Volume to a Shadow Copy Set
    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Provider ID: {00000000-0000-0000-0000-000000000000}

    Volume Name: \\?\Volume{acda900a-c1f6-4b66-831d-a54d0f93e6db}\

    Execution Context: Coordinator

    Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    List interfaces for all providers supporting this context

    Check If Volume Is Supported by Provider

    Add a Volume to a Shadow Copy Set

    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Provider ID: {00000000-0000-0000-0000-000000000000}

    Volume Name: \\?\Volume{acda900a-c1f6-4b66-831d-a54d0f93e6db}\

    Execution Context: Coordinator

    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from
    CoCreateInstance on class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} and Name SW_PROV is [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    Add a Volume to a Shadow Copy Set

    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    Add a Volume to a Shadow Copy Set
    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Execution Context: Coordinator
     
    biconix, Feb 23, 2022
    #3
  4. RAMESH SRINIVASAN
    Ramesh Srinivasan Win User

    Windows Defender delete Volume Shadow Snapshot?

    Deleted Windows Store files from "C:\Program Files\WindowsApps"

    You may try recovering the folder from Volume Shadow Copy snapshot. Use
    System Restore Explorer     or
    ShadowCopyView     for that.

    Note: If you're using ShadowCopyView, it may not list the hidden folder in the program's lower pane list box. You need to type the following path directly.

    \Program Files\WindowsApps

    Or mount/browse the folder in Explorer.
     
    Ramesh Srinivasan, Feb 23, 2022
    #4
Thema:

Windows Defender delete Volume Shadow Snapshot?

Loading...

  1. Windows Defender delete Volume Shadow Snapshot? - Similar Threads - Defender delete Volume

  2. Why did lpksetup.exe try to delete volume shadow snapshot?

    in Windows 10 Gaming
    Why did lpksetup.exe try to delete volume shadow snapshot?: Crowdstrike detected that the Language Packaged Installer tried to delete a volume shadow snapshot. Is this expected behavior, or is this something to be worried about? Thanks in advance....

  3. Why did lpksetup.exe try to delete volume shadow snapshot?

    in Windows 10 Software and Apps
    Why did lpksetup.exe try to delete volume shadow snapshot?: Crowdstrike detected that the Language Packaged Installer tried to delete a volume shadow snapshot. Is this expected behavior, or is this something to be worried about? Thanks in advance....

  4. Why directxdatabaseupdater.exe try to delete a Volume Shadow Snapshot

    in Windows 10 Gaming
    Why directxdatabaseupdater.exe try to delete a Volume Shadow Snapshot: We are using Crowdstrike and it detected that directxdatabaseupdater.exe tried to delete a Volume Shadow Snapshot. I want to know why it did this. Is it a normal operation? Thank you....

  5. Why directxdatabaseupdater.exe try to delete a Volume Shadow Snapshot

    in Windows 10 Software and Apps
    Why directxdatabaseupdater.exe try to delete a Volume Shadow Snapshot: We are using Crowdstrike and it detected that directxdatabaseupdater.exe tried to delete a Volume Shadow Snapshot. I want to know why it did this. Is it a normal operation? Thank you....

  6. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in Windows 10 Gaming
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  7. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in Windows 10 Software and Apps
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  8. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in AntiVirus, Firewalls and System Security
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  9. Windows Defender Whitelist and Volume Shadow Copy

    in AntiVirus, Firewalls and System Security
    Windows Defender Whitelist and Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool. I was able to whitelist the executable. However, it now appears in...

  10. How to delete Volume Shadow Copies in Windows 10

    in Windows 10 News
    How to delete Volume Shadow Copies in Windows 10: [ATTACH]Missing storage space is always a problem in Windows 10. Users keep reporting about […] This article How to delete Volume Shadow Copies in Windows 10 first appeared on TheWindowsClub.com. read more...