Kaspersky Removal Tool Bug

I found a bug with the Kaspersky Removal Tool. It will break System Restore on Windows 10. I've reproduced this on 4 different machines.

The error message appears as below.

There was an unexpected error in the property page. System Restore encountered an error. Please try to run System Restore again. (0x81000203). Please close the property page and try again.

Fix

After exporting the registry before and after and then comparing, I found the UpperFilters were deleted for the Storage volumes class. As far as I understand it, you need both Upper and Lower Filters in any given case.

To apply the fix, copy the following blue text, paste it into Notepad, save it as "repair.reg", then double-click to Merge it with the registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]

"UpperFilters"=hex(7):76,00,6f,00,6c,00,73,00,6e,00,61,00,70,00,00,00,00,00

If you run a hex to ASCII converter over this value, then the text is "volsnap", which corresponds with the volume snapshot service/driver, which is what System Restore uses to copy files. Note that some other backup software may not work after this, such as Aomei Backupper, which also has the driver ambakdrv and makes the hex as seen below. I would suggest reinstalling your backup software to correct this.

After applying this, restart the machine and try to open System Restore again - the error will disappear.

Tools used to help investigate

• Beyond Compare
• Registry Editor
• ProcMon
• Notepad++

This error is also caused by other programs like TuneUp Utilities - see this Microsoft support page.