The latest Webroot release 126.96.36.199 with its updated wrkrn.sys file seems to have caused some BSOD's with 2008r2 after our systems rebooted last night. I was able to delete the file from a repair command prompt and then reboot into normal operating mode.
I have a ticket in with Webroot support about this issue, but I thought my issue should be shared.
Update: I have talked with an MSP using Webroot who has had the same problem today. They also report that if you reboot your machine again after Webroot has a chance to reinstall the wrkrn.sys file it will start throwing up BSOD messages again.
Already have an account? Login
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
Please reach out to Support at your earliest convenience for further instruction:
Business Technical Support: Call 1-866-254-8400
Open a Support Ticket: http://mysupport.webrootanywhere.com/supportwelcome.aspx?SOURCE=ENTERPRISEWSA
This is the driver that loads the pagefile and is the Windows Driver Foundation - User Mode Driver Framework.
Since this service is failing to load, its not able to load the page file.
Do you or anyone else in this thread have a kernel memory dump from the BSOD you can provide to me? They are normally located at C:WindowsMEMORY.DMP. They are written when the BSOD occus, if it isn't present you may have forcefully restarted your computer before allowing the dump to complete or it was purposfully disabled in the system configuration (sysdm.cpm > Advanced > Startup and recovery > Settings...).
If anyone is able to reproduce this make sure that "Complete memory dump" is set and the dump file is set to "%SystemRoot%MEMORY.DMP". Also make sure the DisablePagingExecitve registry key is set to 1.
Software Engineer | Webroot Inc.
File System Filter 'WRkrn' (6.1, ?2016?-?11?-?18T12:49:11.000000000Z) has successfully loaded and registered with Filter Manager.
File System Filter 'WRkrn' (6.1, ?2016?-?09?-?14T17:14:42.000000000Z) has successfully loaded and registered with Filter Manager.
If you are one of those customers, we sincerely apologize and ask that you contact Webroot’s Business Technical Support team by calling 1-866-254-8400 or by opening a Support Ticket: http://mysupport.webrootanywhere.com/supportwelcome.aspx?SOURCE=ENTERPRISEWSA
Thank you for the great information. Please keep an eye out for the C:WindowsMEMORY.DMP file.
Software Engineer | Webroot Inc.
Has anyone seen that happening? Can this be confirmed?
We had a Windows Small Bsuiness Server 2008 machine crash 2 nights ago and are running from our backup device now.
I was able to only recreate the issue in a lab environment on 2012R2 if I set paging file staticly on the 😨 volume.
My account manager thinks this is related to an NVidia driver that has been out for 5 weeks, I don't quite agree with that
It did restart last night, but it shows version 9.10.21 in add/remove programs and the portal, so not sure if it tried updating or what.
Edit#1 I logged in in safe mode, added registry key to be able to run msiexec, uninstalled WR and rebooted. Went through finninshing applying updates and then rolled back, but then booted to Windows fine, so maybe not that version of WR, but a Windows update / WR combination.
Edit#2 This is the update that shows failed now fromlast night
January, 2017 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB3212646)
Also wondering if anyone who has had this issue did NOT also have the January Quality update from Microsoft installed? I'm wondering if perhaps it was this version of WR and the Quality update.
We installed the security only update and so far to my knowledge have not had issues.