3 issues: no padlock, repeated 'Do You Want' popups, WRSVC constantly shutting down/restarting

  • 26 December 2015
  • 18 replies
  • 194 views

Userlevel 3
I am assuming that all 3 of these issues are related to an update from December 16th because they all began at the same time:
 
Regularly (although not every time) at startup, I get the "Do you want to allow Webroot to make changes to your computer" popup; I have been allowing it.
 
At the same time this started, the yellow padlock icon disappeared entirely from all websites; sites that are https normally triggered it but now, nothing, no padlock ever. According to the Webroot panel, my browser (Firefox) is protected and all systems (Realtime Shield, Web Shield, Firewall, Identity Shield, Phishing Shield) are 'green' -- however, the padlock is gone and it is also allowing screen visibility of credit card #s as I type, which it did not do before. I have been avoiding buying anything online because of this issue, just in case.
 
And lastly, in Windows Event Viewer there is a recurring error literally about every minute: "Event ID: 7031
The WRSVC service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service." And so it restarts itself, shuts down, restarts, shuts down, again and again. The first instance of this error message occurred on December 16th.
 
I have Windows 7, SP 1. My Webroot product was originally Webroot Essentials which seems to have been replaced via renewals as "Antivirus"? On my console it says 'Antivirus' as the product (verison 9.0.7.4s).
 
Is there a fix in the works for whatever became FUBAR on December 16th? Thanks!

18 replies

Userlevel 7
Hi gardener
 
To answer you succintly I hope:
 
1. Yes, this is a known issues that the Support Team are working to resolve. The best approach is to do what you are doing, i.e., answer 'Yes' to the prompt. Hopefully the Support Team will have a solution to the issue shortly.
 
2. GIven what you say it sounds like the items that where protected by the Identity Shield have for some reason been 'unprotected'. Please try this; for one of the apps that you would normally get the padock showing, go into Identity Protection > Application Protection and scan through the list of applications logges for rotection. If you do not find the application logged then please add it to the list and once yo uhave done that go into it and see if the padlock now appears. If it does then that is the answer; you need to re. log all items you want protected that are not currently logged.
 
If the applicaiton does appear in the list but the padlock is not appearing then you need to Open a Support Ticket to let the Support Team know, as that is not right.
 
3. In this case I would Open a Support Ticket if you have not already as a result of 2. above, as when it comes to the Event Viewer and what it is reporting you need to be a real Windows expert, plus it is clearly linked to what has started happening since 16th December.
 
Hope that helps some?
 
Regards, Baldrick 
Userlevel 3
Hi Baldrick, many thanks for the prompt reply :-)
 
As for #2, there are actually five separate Firefox-related processes shown as being protected. They are:

firefox.exe (there two of these listed, in two different files within the usersappdatalocal emp folder)
 
firefox.exe.moz-backup (in c:program filesmozilla firefoxupdated)

firefox.ecr.moz-callback (in c:program filesmozilla firefox)

nsq1888.tmp (in c:[rogram filesmozilla firefox obedeleted)
 
I'm no techie but it seems odd that the two listings for "firefox.exe" would be living in a temp folder rather than in Program Files?
 
Support Ticket coming right up, LOL
 
Many thanks and hope you had/have a good holiday! I'll report back on the result of the Support ticket in case others are having the same issue(s).
 
Userlevel 7
Hi gardner
 
No worries...we are always glad to help as and when we can. :D
 
As for the 2 instances of firefox.exe...as they are on different paths, i.e., running from different folders that is not so unusual...as to why you would have them running from 2 different folders is another question...perhaps for another time.
 
Ticket is the right way to go in the circumstances...please be aware that what with the holidays etc., the usual sterling response time from the Support Team may be some what reduced...but I am sure that they will get to you.
 
Thanks for your wishes; here's hoping that you too have had/are having a good holiday.
 
Thanks adavnce for the reporting back...it really does help us volunteers hone the responses for current & future users...it is most helpful. :D
 
Regards, Baldrick
 
Userlevel 3
No tech reply as yet, but I do have a change in WR behavior to report: Turned the computer on a few minutes ago and got the "Do you want to allow changes" popup again, and I said Yes. Immediately afterward, a brand-new (to me) slider box appeared above the Webroot icon, showing green checkmarks next to the name of the four Shields. Faded away after 5 seconds or less. Never had a slider popup before. So I proceeded to launch Firefox, which starts with a blank page as usual, then went to a web page and voila! The lock icon is back! 😃 I am assuming (dangerous, I know, lol) that whatever this last "change" was, fixed that issue. Going to reboot and take a look at the Windows Event Viewer to see if that Webroot process is still constantly shutting itself off and immediately restarting again, as it has been doing for the past 10 days, or whether the "change" fixed that as well. Also will see if the new slider popup also returns (might be the New Normal).
Userlevel 3
No popup slider on restart, but also no 'new' Events connected to Webroot in Windows either; the last few were all within the same timeframe of that most recent "allowed changes".
 
However, something new has now appearned in the Protected Applications tab:
firefox.exe in c:program filesmozilla firefox
 
I did update my Firefox (from v41 to v43.0.1) before shutting down the computer a couple of hours ago, and am wondering if somehow my existing version "disappeared" from Webroot but then when I updated the browser it was put back on?
 
So apparantly those Firefox entities in the AppData folders and elsewhere are not enough; the one that lives in Program Files has to also be among the Protected applications in order to generate the Foreground Window Padlock.
 
So maybe the most recent Webroot 'change' shouldn't take the credit for the reappearance of the padlock after all, LOL
 
Will continue to follow what happens with the "do you want to allow change" popup, and with any Webroot errors in Windows as well, though.
Userlevel 3
Aaaargggghh!!!
 
Guess I spoke too soon.
 
Just restarted the computer after a couple hours' break and guess what? The padlock icon has gone missing again. :-(
 
However, Firefox.exe in c:program filesmozilla firefox is still there on the Applications Protected list.
 
What would make the icon appear for one session of computer use and disappear the next??
 
No "do you want to make changes" dialog box on startup this time, no slider popup,
 
And we are back to the same original Webroot Event Error: "The WRSVC service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service."
 
*headdesk*headdesk*headdesk*
 
 
Userlevel 3
Well, this makes absolutely NO sense whatsoever, but I'm reporting it here anyway. I've replicated it three times in the past half hour.
 
For some unfathomable reason, if I turn the computer on in the normal way (by pressing the power button), the Webroot padlock icon goes missing (probably into some black hole to the left of Alpha Centauri, who knows?) and will not reappear, no way nohow.  If I shut down the computer in the normal way (Start ->Shut Down) and then start it again using the power button, same thing happens.
 
However................!!!
 
If I instead REBOOT (Start -> Retstart), guess what? On the Restart, the padlock icon reappears and remains there for EVERY website (even those without https).  Which probably makes sense because I have Firefox set to Always Use Private Browsing.... the padlock icon was always there, before things went crazy with Webroot,lol
 
So there is something going on between Webroot and Windows, when it comes to booting up 'cold' (from power button) versus Restart.
 
What that is, I have no idea and am hoping that Webroot tech can figure it out when we communicate.
 
Still... it makes no sense... right? lol
Userlevel 7
Hi gardener
 
I am sorry that you are experiencing these issues and am hoping that the Support Team get to you as soon as possible.
 
If I may suggest that if you have not already done so you update your Support Ticket and make sure that you include a link to this thread in it as (i) you have garnered a lot of useful information here & (ii) that will save you rekeying it all in to the support ticket.
 
Thanks for keeping us posted on what is going on with your system...I am sure that in the end it will help resolve the situation more quickly.
 
Regards, Baldrick
Userlevel 7
Badge +7
Here is what has worked flawlessly for me since 17 Dec on 5 computers using 5 browsers each..Edge IE Firefox Chrome and Palemoon when nothing else would work.  Don't ask me why or how!...WSA>Utilities>Antimalware Tools>Check Reset System Policies>Restart.  I did this after UAC prompt>Allow...and after Windows Update KB......which rolled out on same day.  IE Firefox Chrome gold locks reappeared permantly.  Edge, EdgeCP, and PaleMoon had to be added manually.  All things failed until I did this.
Userlevel 7
Badge +7
Minor correction...WSA>Utilities>Antimalware Tools>Check box Reset System Policies>Run Tool>Restart.
Userlevel 7
Hi BlazeTen
 
Hope that you are well?
 
Thanks for the feedback...sounds mighty promising. However, could I ask that you precise exactly where you are applying or doing this as it is not clear to me. Also, what operating system are you running and which version?
 
Many thanks, Baldrick
Userlevel 7
Badge +7
Hi @...from within WSA gui desktop  Win 10 (1511).  Thanks!
Userlevel 7
Hi BlazeTen
 
OK, thanks...I got you!
 
Please be advised that these tools are really only for use under the direction of a Webroot Support techinican as if used incorrectly or in the wrong circumstances they can cause real issues.
 
Having said that if this has worked for you then I would open a support ticke anbd let the Support Team know ASAP as it may give them some food for thought as to the reason for the issue and therefore production of a suitabel and more user friendly 'fix'.
 
Regards, Baldrick
Userlevel 7
Badge +7
Hi@Baldrick  That is why I like to begin posts that may be construed as advice with "This is what works for me" or "This is what has worked for me" always making it clear that I'M not giving advice.  Regards !  or "This is what I did."  Thanks!
Userlevel 3
Hello all, here are a couple of updates.
 
Received a reply from Tech saying they are aware of the issue and planning to resolve with next updates, but in the meantime provided a link to a WRSVCFix , which I installed and then rebooted the computer.  It is a fix for the Registry key. Although Tech said that it should fix the "do you want" dialog box and the constant restarting of WRSVC, that event still continues. It also generated an Application Error event. No "do you want" popup as yet, but it has not been appearing each and every time the computer is started -- seems to pop up when it wants to, LOL
 
It also did not solve the Padlock Icon problem. I've responded to the Service Ticket to advise them of the non-fix, the new Error, and the anomaly of a computer restart bringing the icon back to life whereas a normal cold start apparantly kills it.  Will be interesting to hear their thoughts on that.
 
BlazeTen, actually I did try the Set System Policies to Defaults reset the other day, after reading of it in several posts here and before posting my own thread. I have Windows 7, SP1; I'm also among the "lucky" people who have not been able to connect to Windows Update for several months because it hangs on Checking For Updates indefinitely (this is a known issue since Windows 10 arrived and for which Microsoft seemingly has no fix; general consensus seems to be that the update servers are prioritizing Windows 10 updaters and anything previous to that can just go hang -- literally.)
Userlevel 3
Well, this is annoying: After installing the WRSVCFix, the "computer restart brings back padlock icon" trick no longer works. 😕 Looks like the Fix fixed the wrong thing, LOL
Userlevel 3
For anyone else experiencing these issues, another member has discovered a way to get the padlock back, at least temporarily/per-session:
 
https://community.webroot.com/t5/Webroot-SecureAnywhere-Complete/The-Yellow-Lock-on-my-WSA-icon-in-the-toolbar-no-longer-appears/td-p/232312/highlight/false/page/2
Userlevel 3
All three issues now fixed by an update that apparantly came through on the 30th or 31st (good New Years' present, LOL), thus all is now working fine. Padlock is back, popup is gone, and Windows Event Viewer is no longer throwing hissyfits. Happy 2016, and thanks!

Reply