STATUS_FLT_FILTER_NOT_FOUND (0xC01C0013) fix

Over 80% of the time: A failed antivirus or security software uninstall

The culprit here is almost always a leftover filter driver from an antivirus program that didn't clean up after itself. Think Norton, McAfee, Kaspersky, or even some older Malwarebytes versions. These programs register filter drivers in the registry, and when you yank them out with their crappy uninstaller, the registry entry stays. The system then tries to load that driver on boot, can't find the .sys file, and throws 0xC01C0013.

You'll often see this error in the System event log with source FltMgr and event ID 37. It can also pop up when you try to mount a volume, attach a VHD, or run a backup tool that relies on volume shadow copy.

Step 1: Identify the dead filter

Open CMD as admin and run this:

fltmc filters

Look for any filter with a Frame value of 0 but a blank or weird Altitude. That's your ghost. For example, something like norton or mfeaskm. Write down its name.

If fltmc filters shows nothing useful, check the registry directly:

reg query HKLM\SYSTEM\CurrentControlSet\Services /s /f "Filter"

Look for services with a Type value of 0x2 (file system driver) or 0x8 (file system filter). If the ImagePath points to a non-existent file, you found it.

Step 2: Unload and delete the broken filter

First, unload it with fltmc:

fltmc unload <filtername>

If that fails because the filter is 'in use', don't panic. Boot into Safe Mode and try again. Safe Mode loads minimal drivers — the dead filter won't attach there.

Once unloaded, delete the registry key for the service:

reg delete HKLM\SYSTEM\CurrentControlSet\Services\<servicename> /f

Replace <servicename> with whatever showed up in the query. Reboot. The error should be gone.

Step 3: Reinstall the security software properly

After you've cleaned out the junk, download the official removal tool for whatever antivirus you had. For Norton, use the Norton Remove and Reinstall tool. For McAfee, the MCPR tool. Running these after you've manually deleted the driver ensures nothing's left in the filter chain.

Second most common cause: A corrupted filter driver from a Windows update

Sometimes a Windows update replaces a filter driver's .sys file but doesn't update the registry entry correctly. This happened a lot with the Windows 10 20H2 and 21H2 updates. The error shows up right after a reboot following a feature update.

Check for pending updates and roll back if needed

Go to Settings > Update & Security > Windows Update > View update history. Look for any failed updates around the time the error started. If you see one, uninstall it by clicking Uninstall updates at the top. Reboot.

Use DISM to repair the filter driver store

Don't bother with SFC first — it rarely helps with filter drivers. Go straight to DISM:

DISM /Online /Cleanup-Image /RestoreHealth

This pulls fresh driver files from Windows Update. Run fltmc filters after it finishes to see if the filter issue is resolved. If the altitude or frame count looks weird, you may need to reset the filter manager:

fltmc reset

That re-initializes all filter drivers. Reboot afterward.

Third most common: A third-party backup or dedup tool left a filter behind

Programs like Veeam, Acronis, or Windows Server Deduplication can register filters. If you uninstalled them improperly or the uninstall failed halfway, you get this error. The fix is the same as the first scenario — use fltmc unload and remove the registry key. But for dedup specifically, you might need to disable the feature via PowerShell:

Disable-WindowsOptionalFeature -Online -FeatureName Dedup-Core

If the error appears on a server running Hyper-V, also check for storage filter drivers from third-party storage vendors (like Dell EqualLogic or NetApp). Their multipath drivers sometimes register filters too.

Quick-reference summary table

One last thing — if none of these work, boot from a Windows installation media, open Command Prompt (Shift+F10), and run chkdsk C: /f. A corrupted MFT can sometimes trigger false filter errors. But honestly, 99 times out of 100, it's a leftover antivirus driver. Start there.