File System Filter 'klbackupflt' failed to attach to volume '\Device\HarddiskVolume10'...

[Snacko]

Please help!

I tracked this Event Log Warning down to Kaspersky by searching the Windows Registry. 

I have been getting tons and tons of this error for both my volume 8 and 10.  (I’m not sure which disk or partition those are?). 

• I have restore my system (C:) from backup 10 days ago and still receive these errors. 
• So, I uninstalled Kaspersky, and rebooted and these errors stopped.  So, I hoped reinstalling would fix this.  But it didn’t   I still get these errors.
• I did find this information at Microsoft’s website.  And the AttachWhenLoaded  was 1 on my system.  So, I changed it to 0.  But that also didn’t help.  I suppose a minifilter (from Kaspersky??) has registered with the FilterManager?

File System Filter 'klbackupflt' (Version 6.1, ‎2020‎-‎10‎-‎06T00:18:25.000000000Z) failed to attach to volume '\Device\HarddiskVolume10'.  The filter returned a non-standard final status of 0xC000000D.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.

 

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          2/16/2021 4:18:22 PM
Event ID:      4
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      MAXIMUS-12-HERO
Description:
File System Filter 'klbackupflt' (Version 6.1, ‎2020‎-‎10‎-‎06T00:18:25.000000000Z) failed to attach to volume '\Device\HarddiskVolume8'.  The filter returned a non-standard final status of 0xC000000D.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-02-16T21:18:22.3299340Z" />
    <EventRecordID>741466</EventRecordID>
    <Correlation />
    <Execution ProcessID="6408" ThreadID="17424" />
    <Channel>System</Channel>
    <Computer>MAXIMUS-12-HERO</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0xc000000d</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">11</Data>
    <Data Name="DeviceName">klbackupflt</Data>
    <Data Name="DeviceTime">2020-10-06T00:18:25.0000000Z</Data>
    <Data Name="ExtraStringLength">23</Data>
    <Data Name="ExtraString">\Device\HarddiskVolume8</Data>
  </EventData>
</Event>

I have a lot of drives on my system.    They all work fine.    I have no idea why Kaspersky causes this Warning 100s and 100s of times.  I have ran a FULL Scan on my entire system and found 0 problems.  Help!

 

[Flood and Flood's wife]

Please help! I tracked this Event Log Warning down to Kaspersky by searching the Windows Registry. I have been getting tons and tons of this error for both my volume 8 and 10. 

File System Filter 'klbackupflt' (Version 6.1, ‎2020‎-‎10‎-‎06T00:18:25.000000000Z) failed to attach to volume '\Device\HarddiskVolume10'.  The filter returned a non-standard final status of 0xC000000D.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.

 I have no idea why Kaspersky causes this Warning 100s and 100s of times.  I have ran a FULL Scan on my entire system and found 0 problems.  Help!

 

Hello @Snacko, 

Welcome!

• Please log a case with Kaspersky Technical Support, fill in Application malfunction, Other template; Support will request Logs, Traces & other data, they will advise you: 

• After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will be in touch, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in the MyKaspersky account.

🔷 Please share the outcome with the Community when it’s available? 

Thank you🙏

Flood🐳 +🐋

[Snacko]

Ok, I thought someone in the forums might have seen this before.

Thanks, I will put in a support ticket.

[cosymaggie]

Hi Snacko,

 

I hope your problem could be solved. To be honest I’ve never seen this before. Maybe after a reinstallation would be one of the last but not least solutions I would try.

 

Kindest regards, Maggie

[Wesly.Zhang]

Hello,

Please check that does this bahavior happened that removable scan doesn't finish when removable disk remove from your machine.

Regards.

[Snacko]

Hello,

Please check that does this bahavior happened that removable scan doesn't finish when removable disk remove from your machine.

Regards.

 

I did have 2 USB sticks on a USB Card on the ‘inside’ ports of the card.  I removed them, but I still get this error.  I have over 25,000 of these warnings in the Event Viewer just for today.

[Snacko]

I think that I fixed it.  Time will tell…

I had a filter on in the Event Viewer to only show Critical, Error, and Warning (and skip all the Information events).  Today I noticed that there was a Information Event just before each of those Warnings.  The one for volume8 said the drive was ‘System Reserved’.  I have 3 Windows installs on my rig.  The new one.  The old one.  And a clean dual boot.  I couldn’t tell which hidden partition it was referring to.  So, I figured I was done with my old Windows and deleted all the partitions and created one for that entire drive.  

It seems that the Filter Manager warning/info is gone.  I’ll watch it for a day or so and report back on my Ticket the results.

But volume10’s information event said the drive was ??  And I haven’t seen any new warnings for volume10.  So, maybe this problem is fixed..  💃

[Flood and Flood's wife]

Hello @Snacko, 

Excellent work👏

Thank you for updating us👌

Flood🐳 +🐋