• 6 September 2016
  • 58 replies

Show first post

58 replies

So I have the missing WRkrn.sys file on a usb that also has the installation win10 media on it. Is it possible to copy the WRkrn.sys file from the usb onto my computer with the problem through the startup repair command prompt? If it is, how do I go about doing so? Any help would be appreciated as this problem is very annoying to deal with and came out of nowhere. Thanks.
Badge +2
Low disk Space!!! Yes!
although it wasn't that low, the WRKrn.sys file was cleared to 0 bytes.  System wouldn't boot.  System repair repeatedly said that it can't find anything wrong but it couldnt fix the problem. 
SourceForge boot-repair-disk "repaired" the boot sector far enough to show, on the next attempted boot, that the file WRKrn.sys was missing or corrupted.
I copied the correct file from another computer and the system booted properly.
Now it's time for Webroot to fix this problem.  Please.
Deeply grateful! Your tip was exactly what I needed. Now working as if nothing ever happened! Tanks a lot!
Userlevel 7
Badge +31
  • Find another computer with webroot installed
  • Copy c:windowssystem32wrkrn.sys from that computer onto a network location
  • Boot the broken computer using your preferred linux OS
  • Connect to the network location with wrkrn.sys
  • Copy file to c:windowssystem32wrkrn.sys
  • Reboot computer
Today I met the same problem. with my boss computer. It refuses to restart. Windows-10-tool says wrkrn.sys is damaged. When i boot on knoppix i find the folder windows/system32/drivers but no file: wrkrn.sys. Do I have to  totally reinstall windows and all the applications my boss has, or is there an easier way to get it going again?
tnx for all advise I can get!  /Anders
I concur. Today I had 0 free disk space, tried to restart computer, now cannot boot in safe mode nor restore to last known good configuration due to a corrupt WRkrn.sys file.
P.S. 0 free disk space was because of excessively large WRData folder (40GB).
I find it's almost a for-sure thing if the system is very low on available disk space.  i.e. if the C: drive is under 1gb free or so, it seems 9/10 times when that server reboots, we'll see the issue and have to boot to a recovery prompt and remove the wrkrn.sys file, which will be zero bytes, indicating it was damaged or not properly rewritten during an update.
Do we have any idea on an ETA or a bandaid. Webroot is slowly becoming a curse word at my MSP with all the recent issues.
Userlevel 1
Badge +3
The issue has not been resolved, we had 2 computers today that had this problem.
When can we expect a permanent solution?
Hello Webroot!
I am an IT Consultant, Microsoft Partner and an MSP utilizing Continuum as my platform. I just spent an hour and a half troubleshooting the workstations at one of my clients. To save some time (as I have a spent a lot of it on this issue already), I am going to paste in the information I sent to Continuum. This issue is causes some real problems and potential damage to workstations. Thank you.
Microsoft has found that the Webroot driver wrkrn.sys is causing reboot issues when an update is being installed during reboot on Windows 10. Clients are experiencing a black screen with spinning white dots that never resolves without a forced reboot via holding down the power button. When running a fltmc.exe command on machines experiencing the issue, we find that WRkrn appears twice:

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
wcnfs 0 409900 1
WRkrn 329998.99 <Legacy>
MBAMProtector 3 328800 0
WRkrn 6 321611 0
Microsoft believes this driver is the issue and Webroot seems to have a knowledge base article potentially confirming this issue: - Microsoft points out that the altitude for the first instance of the driver should not be followed by a decimal amount.
I need a solution to this issue as the forced reboot could be causing damage to the workstations and their hard drives.
Userlevel 5
Badge +5
Any updates on this...?
We are still experiencing the issue on a few systems here and there...
Easy enough to fix but the end user freaks out...
Userlevel 7
Badge +31
We're aware of this issue and have been working hard to find the cause.   For background, WSA re-writes it's kernel driver  every so often.  We do this just in case the current driver file has been tampered with or corrupted in some way.  However, there are occasions where Windows is doing something that inteferres with this process.  We've got a solution but this is all kernel driver work and we're taking very cautious approach with our QA.  Once it's ready for release, we'll get it out to you all. 
Senior Product Manager
As per my knowledge, there is no permanent fix rolled out by Webroot so far. Please raise a ticket with Webroot, they may roll out the fix depending on the number of tickets.
I have had 12 system today that were booting to a black screen with just the mouse cursor. I went into Windows Repair (Windows 7) and then opened the Command Prompt. Renamed the file and the systems rebooted properly.
Why is this happening?
Is there a better way to fix this since it is happening to so many systems?
Is there a way to prevent this?
Boot the faulty computer with Hiren's boot usb key and copy the wrkrn.sys file from the usb key to windowssystem32drivers.
Reboot the computer.
Note: First copy the wrkrn.sys file from the working computer to the Hiren's boot usb key
Userlevel 7
Badge +26
welp I had this happen tonight on both a server 2012 R2 system and a windows 7 laptop. This is not good. Luckally I was able to command prompt and delete the file but still is not good.
I'm having this issue too. I don't have a CD drive to boot from CD, and I can't afford to go and buy another copy of windows10 to put on a flash drive. I can try to get rid of the file using command line; however, I've never done so before so it will be a risk.  Failing that, I'll reformat it and put Linux on it instead.
Are there any other suggestions that I could try before doing these two steps?
Userlevel 7
Badge +35
I believe the build that will resolve this will be coming out next Tuesday (10/18), barring any changes. 
If you're still experiencing the issue after this build update, I recommend you open a ticket so our support team can get the right information escalated up.
Having this problem with a Windows 2008 R2 server.  No wireless keybaord here, it's a VM server on an ESX host.  At first it would simply boot to recovery mode directly.
My process was having to boot to a recovery CD to get command line then do:
BCDBoot c:Windows  (was actually K: for us, but wherever your windows install is)
After this, system tried to boot but I got the WRkrn.sys error.
Booted to CD again and deleted the file.
System is now back online.
Am experiencing the same issue at the moment.  Has this been addressed & repaired?  Unable to get into Windows Safe Mode using installation DVD.
Am currently running
Userlevel 7
Badge +56
So the root cause for this one looks to be the new Microsoft Wireless keyboard driver that's been causing us issues. The good news is that the next version of the agent has a fix for this.
Userlevel 7
Badge +56
Not sure what the root cause is - I'll see if I can find out.
So, we know how to fix this. That's great.
But what causes it, and what can be done to prevent it?
Your defunct pc that refuses to boot via any of the methods of repair is due to the fact that the wrkrn.sys has been flagged as part of a critical boot file. It will refuse to boot in any of the safemode, debug, etc etc options.
the alternative is to boot from a bootable win10 setup usb/cdrom.
and proceed to click on the "REPAIR" instead of setup. Then you'll be able to select  an advance method to boot in safemode with command prompt using the win10 setup. You can delete the file in question or replace/copy on the command prompt.
If you can boot the computer into safe mode, delete the file (wrkrn.sys) located at windowssystem32driverswrkrn.sys. The Webroot tech informed me that it will get recreated after restarting the computer. We couldn't boot to safe mode, so we had to remove the hard drive from the computer and slave it onto another system to get to the file and delete it.