What causes WSA to terminate abruptly? It restarts fine until the next time.

  • 26 November 2016
  • 17 replies
  • 81 views

Folks,
 
Every now and then WSA will abruptly termiante and restarts.  The only way I know this has happened is when I look in the Windows 7 Event Viewer as it shows as an application error.  I do not have the "exception code," but will the next time it takes place.  However, has anybody had this general experience before?  Have Windows 7 (SP1 - 64 bit) with the Windows firewall operating, but not the Windows Defender (disabled).  Have Malwarebytes, but it is not loaded as anytime unless I manually choose to run a scan, then I finish and exit the program from the tray and memory when complete.
 
BTW, I have uninstalled and reinstalled several times, but it really doesn't help this issue.  Comes back at random times...perhaps 2-3 times per week, but as mentioned, always restart so I am not without protection.  I do have it set for "Boot Scan" so perhaps that might have soemthing to do with this behavior...not sure, but I do not think that has anything to do with it as the "abrupt termination" is after I am running for maybe an hour or more...never know when it will happen.
 
Thanks!
 
Chris

17 replies

Userlevel 7
Hi cstocci
 
Welcome to the Community Forums.
 
I have to admit that I have never ever come across this happening before in all of the years I have run WSA on my system be it XP, Windows 7 or now under WIndows 10.
 
I am convinced that your running of MBAM as you do would not cause the issue...the two applications are known to play well together.
 
The fact that yo are seeing something in the Event Viewer may or may not be relevant as in truth it can over egg the pudding sometimes. The next time it happens please start the Task Manager and check to see if the WSA-related processes are running:
 


If you do find them then in fact WSA has not stopped running...but either way my recommendation would be that you Open a Support Ticket and provide the details that you have hear to the Support Team...they will be best placed to review logs and get you to carry out more detailed logging of WSA on your system, and hopefully then identify & remedy the cause of the issue for you.
 
Please do keep us posted on what transpires as this sort of feedback is of great use to us in looking to help members coming with similar issues in the future.
 
Regards, Baldrick
Userlevel 7
Badge +56
I never look at Event Viewer because if i did it would drive me nuts seeing all the Errors but most things you wouldn't even notice or affect you. 😉
Userlevel 7
Badge +25
@support will probably ask you to upload the cbs.log file from your PC.  The fastest way to do this is to
 
copy the following code which brings a copy of your cbs.log to your desktop.  This will make it easier for you to upload to Tech Support.
 
1) copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
   (highlight and copy the entire code above including the word copy)

 
2) Right click on the windows key.
 
3) click on Command Prompt (Admin)
 
4) you will see this prompt C:WINDOWSsystem32>
 
5) Press the right side of your mouse or laptop pad to insert ------>    copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt       after system32>
 
6) press enter this will copy the cbs log file to your desktop and is named cbs.txt
(this is the file that Tech Support will need you to upload)
 
After pressing enter this is what you will see:
C:WINDOWSsystem32>copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
1 file(s) copied.

 
7) when finished press enter again and type the word exit which will get you out of the command prompt
 
Hope this helps.   Please post back here with any questions you may have,
Userlevel 7
Badge +56
@ I have never seen or been asked for such a thing. Have you?
Hi,
 
I got the latest CBS.log (actually named CbsPersist_20161122025102.log by the Windows) and it is HUGE (9.16Mbytes ZIPPED!).  Are you sure you will want this?
 
Chris
Userlevel 7
Badge +25
 
@ wrote:
@ I have never seen or been asked for such a thing. Have you?
Event Viewer?  No never had been asked.    I saw your earlier post regarding the event viewer. The question is, What led them to go there?   I agree with you that it would make one self crazy looking in there.  :D
Hi Julie,
 
OK...I get it!~  Just the Event Viewer description.  Unfortunately or fortunately (depends upon one's point of view), I have not had another episode of WSA terminating and then restarting.  However, when I do, I will certainly capture that description and email it along to you.  One thing, I have taken WSA out of the "Boot at Startup" mode and the isse seems to have stopped happening.  Perhaps I speak too quickly and it will happen at the next bootup with it in the usual "Scan everyday" mode.
 
Chris
Userlevel 7
Badge +56
@ wrote:
@support will probably ask you to upload the cbs.log file from your PC.  The fastest way to do this is to
 
copy the following code which brings a copy of your cbs.log to your desktop.  This will make it easier for you to upload to Tech Support.
 
1) copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
   (highlight and copy the entire code above including the word copy)

 
2) Right click on the windows key.
 
3) click on Command Prompt (Admin)
 
4) you will see this prompt C:WINDOWSsystem32>
 
5) Press the right side of your mouse or laptop pad to insert ------>    copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt       after system32>
 
6) press enter this will copy the cbs log file to your desktop and is named cbs.txt
(this is the file that Tech Support will need you to upload)
 
After pressing enter this is what you will see:
C:WINDOWSsystem32>copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
1 file(s) copied.

 
7) when finished press enter again and type the word exit which will get you out of the command prompt
 
Hope this helps.   Please post back here with any questions you may have,
 
@ wrote:
 
@ wrote:
@ I have never seen or been asked for such a thing. Have you?
Event Viewer?  No never had been asked.    I saw your earlier post regarding the event viewer. The question is, What led them to go there?   I agree with you that it would make one self crazy looking in there.  :D

 No the above? I'm confused as to why? Did webroot ever ask you to do this? I have never seen it or ever been ask to do the above?  If Webroot wants Logs they have there own Log Gathering Untility. Did you know?
Userlevel 7
Badge +56
@ wrote:
Hi Julie,
 
OK...I get it!~  Just the Event Viewer description.  Unfortunately or fortunately (depends upon one's point of view), I have not had another episode of WSA terminating and then restarting.  However, when I do, I will certainly capture that description and email it along to you.  One thing, I have taken WSA out of the "Boot at Startup" mode and the isse seems to have stopped happening.  Perhaps I speak too quickly and it will happen at the next bootup with it in the usual "Scan everyday" mode.
 
Chris
WSA must start at Boot up so don't change that. If you feel you are having issues please Submit a Support Ticket and they will be happy to look into it for you and they will let you know if you have anything to worry about.
 
Thanks,
 
Daniel ;)
 

Userlevel 7
Badge +25
 
@ wrote:
@ wrote:
@support will probably ask you to upload the cbs.log file from your PC.  The fastest way to do this is to
 
copy the following code which brings a copy of your cbs.log to your desktop.  This will make it easier for you to upload to Tech Support.
 
1) copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
   (highlight and copy the entire code above including the word copy)

 
2) Right click on the windows key.
 
3) click on Command Prompt (Admin)
 
4) you will see this prompt C:WINDOWSsystem32>
 
5) Press the right side of your mouse or laptop pad to insert ------>    copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt       after system32>
 
6) press enter this will copy the cbs log file to your desktop and is named cbs.txt
(this is the file that Tech Support will need you to upload)
 
After pressing enter this is what you will see:
C:WINDOWSsystem32>copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
1 file(s) copied.

 
7) when finished press enter again and type the word exit which will get you out of the command prompt
 
Hope this helps.   Please post back here with any questions you may have,
 
@ wrote:
 
@ wrote:
@ I have never seen or been asked for such a thing. Have you?
Event Viewer?  No never had been asked.    I saw your earlier post regarding the event viewer. The question is, What led them to go there?   I agree with you that it would make one self crazy looking in there.  :D

 No the above? I'm confused as to why? Did webroot ever ask you to do this? I have never seen it or ever been ask to do the above?  If Webroot wants Logs they have there own Log Gathering Untility. Did you know?
No Webroot didn't ask me to do it, I know how to do that.  I know they have there own way of gathering log(s). The last time Webroot used the gathering tool for me, apparently it gave them all the logs, not just the cbs.log (meaning they have to go thru and pick out the cbs.log file)  So, I just put the text file (thru code) on the desktop when Webroot request the log.   ;)
Userlevel 7
Badge +56
@ wrote:
 
@ wrote:
@ wrote:
@support will probably ask you to upload the cbs.log file from your PC.  The fastest way to do this is to
 
copy the following code which brings a copy of your cbs.log to your desktop.  This will make it easier for you to upload to Tech Support.
 
1) copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
   (highlight and copy the entire code above including the word copy)

 
2) Right click on the windows key.
 
3) click on Command Prompt (Admin)
 
4) you will see this prompt C:WINDOWSsystem32>
 
5) Press the right side of your mouse or laptop pad to insert ------>    copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt       after system32>
 
6) press enter this will copy the cbs log file to your desktop and is named cbs.txt
(this is the file that Tech Support will need you to upload)
 
After pressing enter this is what you will see:
C:WINDOWSsystem32>copy %windir%logscbscbs.log %userprofile%Desktopcbs.txt
1 file(s) copied.

 
7) when finished press enter again and type the word exit which will get you out of the command prompt
 
Hope this helps.   Please post back here with any questions you may have,
 
@ wrote:
 
@ wrote:
@ I have never seen or been asked for such a thing. Have you?
Event Viewer?  No never had been asked.    I saw your earlier post regarding the event viewer. The question is, What led them to go there?   I agree with you that it would make one self crazy looking in there.  :D

 No the above? I'm confused as to why? Did webroot ever ask you to do this? I have never seen it or ever been ask to do the above?  If Webroot wants Logs they have there own Log Gathering Untility. Did you know?
No Webroot didn't ask me to do it, I know how to do that.  I know they have there own way of gathering log(s). The last time Webroot used the gathering tool for me, apparently it gave them all the logs, not just the cbs.log (meaning they have to go thru and pick out the cbs.log file)  So, I just put the text file (thru code) on the desktop when Webroot request the log.   ;)

So Webroot Requested that from you? Very odd......
Userlevel 7
Badge +25
 
 
@ wrote:
Hi,
 
I got the latest CBS.log (actually named CbsPersist_20161122025102.log by the Windows) and it is HUGE (9.16Mbytes ZIPPED!).  Are you sure you will want this?
 
Chris

Hello @, Chris

 
I don't want any log.   That information in my post shows you how the command prompt retreives the CBS.log and places a copy on the desktop which is named cbs.txt  You only use this code when Webroot tech support wants a copy of your log or you could let Weroot use their gathering utility to obtain your log.
 
I hope this clears up any misunderstanding.
 
 
 
Userlevel 7
Badge +25
No Daniel Webroot did not request anything of me.  I knew of an easier way to abstract the cbs.log
Userlevel 7
Badge +56
@ wrote:
 
 
@ wrote:
Hi,
 
I got the latest CBS.log (actually named CbsPersist_20161122025102.log by the Windows) and it is HUGE (9.16Mbytes ZIPPED!).  Are you sure you will want this?
 
Chris

Hello @, Chris

 
I don't want any log.   That information in my post shows you how the command prompt retreives the CBS.log and places a copy on the desktop which is named cbs.txt  You only use this code when Webroot tech support wants a copy of your log or you could let Weroot use their gathering utility to obtain your log.
 
I hope this clears up any misunderstanding.
 
 
 
@ correct only if Webroot Support asks for it. Now I understand Julie but it's not info to share on the Community only if Webroot Support ask for it. I hope you understand the differance between what Webroot Support might want and what we can do on the Community? So IMO the info you supplied it's not for the Community and it's best to let the Webroot Support asks if they need such a thing. We on the Community can only do so much and in most cases Webroot support will have to look after and if need be ask for certain extra's from users via the support channel.
 
Thanks,
 
Daniel
Userlevel 7
Badge +25
Thank you Daniel I understand what your saying ;)
Userlevel 7
Badge +56
@ wrote:
Thank you Daniel I understand what your saying ;)
Kwel!
 
Thanks,
 
Daniel XD
 
http://i0.kym-cdn.com/entries/icons/original/000/017/436/XD_Face.png
 
 
Userlevel 7
Badge +25
LOL I was waiting for one of those faces but no that big  :D

Reply