I’ve been troubleshooting an issue that’s propped up on my laptop. Context:
- Windows 10 x64 - patched up with all available updates
- Surface Pro 5 - i5/8Gb/256
- Office 365, including all Office apps
- OneDrive configured to sync a number of libraries. Files On Demand enabled.
- Keepass (any version)
- Keepass database file stored in the Dropbox folder
- Webroot SecureAnywhere 126.96.36.199
Previously everything worked fine. The process I’m about to describe is something I would use multiple times a day (sometimes, multiple times an hour) and it would work perfectly. About 2 weeks ago, I started getting BSOD from Windows - completely repeatable.
- Open KeePass, and open the database file stored in the Dropbox folder.
- Keepass opens fine, and decrypts the password vault. I can see / add / change password entries or anything else within the database file.
- If I SAVE the file, or if I CLOSE the Keepass app, this now triggers a BSOD within windows - faulting module is cdflt.sys (the OneDrive Cloud Filter driver file).
- HOWEVER! If I open the file and SAVE AS to a different file name (either in Dropbox, or OneDrive, or a local folder on the PC) - no problems. Until I try to SAVE *that* file, and it blue-screens straight away.
I’ve rebuilt the PC a number of times now from scratch, and the problem does not occur at all until I install WebRoot. As mentioned, up until a couple of weeks ago this was bulletproof. I’ve not updated Keepass itself, but obviously somethign is getting triggered by the way it does it’s file operations.
- Disabling the Real Time Shield in Webroot via the policy console (and updating the config of the local agent). Real Time Shield turns off in the local Webroot app. Problem still exists.
- Disabling the Identity Shield in Webroot via the policy console. Problem still exists
- Adding the c:\Windows\System32\drivers\cldflt.sys file to the Overrides section in the policy console. Hard to tell if the local agent picks up this change - the date/time stamp on the c:\ProgramData\WRData\Ovr.db file does change. Problem still exists.
- Adding the C:\Program Files (x86)\KeePass\*.* files to the Overrides section in the policy console. Problem still exists.
As a workaround, I’ve installed the alternate KeepassXC app, which is working seamlessly. That said, I’d rather go back to the official app if I can get this sorted.
Is anyone else seeing this behaviour with Keepass and WebRoot? What can I do to either fix this, or bypass the webroot protection for this scenario?