Windows 10: Windows Defender delete Volume Shadow Snapshot?

Discus and support Windows Defender delete Volume Shadow Snapshot? in AntiVirus, Firewalls and System Security to solve the problem; Hi folks,Recently, my antivirus applicationCrowdStrike detect and terminated that Windows Defender behavior because of it suspicious activity. My... Discussion in 'AntiVirus, Firewalls and System Security' started by Chrysolophus, Feb 23, 2022.

  1. CHRYSOLOPHUS
    Chrysolophus Win User

    Windows Defender delete Volume Shadow Snapshot?


    Hi folks,Recently, my antivirus applicationCrowdStrike detect and terminated that Windows Defender behavior because of it suspicious activity. My question is, Do Windows Defender ever try to delete Volume Shadow Snapshot itself? or there is a something real issue on my computer? Thank you.

    :)
     
    Chrysolophus, Feb 23, 2022
    #1
  2. DALCHINA
    dalchina Win User

    Failed to Create Volume Snapshot Macrium Error 0x8004230f VSS Error

    Hi, you might try this:
    Microsoft Volume Shadow Copy (VSS) Troubleshooting - Microsoft Volume Shadow Copy (VSS) Troubleshooting

    or the free cautious repair tool
    Tweaking.com - Windows Repair Free/Pro
    - observing the steps and using only the relevant repairs

    More:
    How to Fix VSS Errors Step-by-Step

    Otherwise I suggest- assuming your disk and file system are sound-
    an in-place upgrade repair install which keeps all progs, data and most settings

    You need an iso of the same base language and build- freely downloadable.
     
    dalchina, Feb 23, 2022
    #2
  3. BICONIX
    biconix Win User
    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered.

    I am getting a bunch of errors in the application log related to the Volume Copy Service. I first noticed it when I tried to create a recovery drive and the error simply said that "A problem occurred while creating the recovery drive"

    I examined the application log and noticed that this error occurs periodically, not only when I try to create the drive. I included the four errors below.

    What do I need to do to fix this?

    I am using a Surface pro 4, windows 10 with up to the minute patches. I also have installed carbonite but I doubt this is the cause as I did not encounter this problem on previous PCs

    Thanks in advance for any assistance

    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance
    on class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} and Name SW_PROV is [0x80040154, Class not registered

    ].

    Operation:

    Obtain a callable interface for this provider

    List interfaces for all providers supporting this context

    Check If Volume Is Supported by Provider

    Add a Volume to a Shadow Copy Set
    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Provider ID: {00000000-0000-0000-0000-000000000000}

    Volume Name: \\?\Volume{acda900a-c1f6-4b66-831d-a54d0f93e6db}\

    Execution Context: Coordinator

    Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    List interfaces for all providers supporting this context

    Check If Volume Is Supported by Provider

    Add a Volume to a Shadow Copy Set

    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Provider ID: {00000000-0000-0000-0000-000000000000}

    Volume Name: \\?\Volume{acda900a-c1f6-4b66-831d-a54d0f93e6db}\

    Execution Context: Coordinator

    Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from
    CoCreateInstance on class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} and Name SW_PROV is [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    Add a Volume to a Shadow Copy Set

    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Execution Context: Coordinator

    Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {3e02620c-e180-44f3-b154-2473646e4cb8} [0x80040154, Class not registered

    ].
    Operation:

    Obtain a callable interface for this provider

    Add a Volume to a Shadow Copy Set
    Context:

    Provider ID: {74600e39-7dc5-4567-a03b-f091d6c7b092}

    Class ID: {3e02620c-e180-44f3-b154-2473646e4cb8}

    Snapshot Context: 4194304

    Execution Context: Coordinator
     
    biconix, Feb 23, 2022
    #3
  4. RAMESH SRINIVASAN
    Ramesh Srinivasan Win User

    Windows Defender delete Volume Shadow Snapshot?

    Deleted Windows Store files from "C:\Program Files\WindowsApps"

    You may try recovering the folder from Volume Shadow Copy snapshot. Use
    System Restore Explorer     or
    ShadowCopyView     for that.

    Note: If you're using ShadowCopyView, it may not list the hidden folder in the program's lower pane list box. You need to type the following path directly.

    \Program Files\WindowsApps

    Or mount/browse the folder in Explorer.
     
    Ramesh Srinivasan, Feb 23, 2022
    #4
Thema:

Windows Defender delete Volume Shadow Snapshot?

Loading...

  1. Windows Defender delete Volume Shadow Snapshot? - Similar Threads - Defender delete Volume

  2. Volume shadow copy error

    in Windows 10 Software and Apps
    Volume shadow copy error: Event viewer error.Unexpected error calling routine ConvertStringSidToSidS-1-5-21-442981339-3756801702-44240739-1001.bak hr=0x80070359.The security structure is invalid.Any clues, please?...

  3. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in Windows 10 Gaming
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  4. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in Windows 10 Software and Apps
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  5. Windows Defender incorrectly reports threat in Volume Shadow Copy

    in AntiVirus, Firewalls and System Security
    Windows Defender incorrectly reports threat in Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows...

  6. Windows Defender Whitelist and Volume Shadow Copy

    in AntiVirus, Firewalls and System Security
    Windows Defender Whitelist and Volume Shadow Copy: In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool. I was able to whitelist the executable. However, it now appears in...

  7. Delete Hyper-V Snapshots

    in Windows 10 Customization
    Delete Hyper-V Snapshots: Hi, I am running out of space on one of my drives which contains many checkpoints/snapshots, some of which dated as far back as 2018. I have looked online for the best way to remove these to recoup some space, however, other than "do not delete by hand" I cannot seem to...

  8. How to delete Volume Shadow Copies in Windows 10

    in Windows 10 News
    How to delete Volume Shadow Copies in Windows 10: [ATTACH]Missing storage space is always a problem in Windows 10. Users keep reporting about […] This article How to delete Volume Shadow Copies in Windows 10 first appeared on TheWindowsClub.com. read more...

  9. Macrium Reflect Free - creating volume snapshot

    in Windows 10 Backup and Restore
    Macrium Reflect Free - creating volume snapshot: I recently downloaded and installed Macrium Reflect Free for my computer running windows 10 Home Edition (I also have a computer that has windows 10 pro - but this is in regards to the computer running windows 10 home) I started to create the backup and noticed a Failed:...

  10. Macrium fails to create a volume snapshot

    in Windows 10 Backup and Restore
    Macrium fails to create a volume snapshot: A few days ago I installed Macrium Home V6 on four Win10 PCs (three Dell Desktops and a Dell laptop). Installs went well and I was able to create full and differential backups. Since Macrium was functioning correctly, I decided to uninstall Acronis True Image 2015 from all...