Skip to main content
To Customer Support To Customer Support
I have a computer that will not boot and is displaying the error "File:windowssystem32driverswrkrn.sys" on windows 10 OS. All searches point to an error with WebRoot. How do I fix this issue?
Can you boot into safe mode with command prompt or recovery mode? If so, once booted up, rename that file and then reboot and that should take care of it.
No, we can not boot into safe mode. We get the screen that indicates press F8 and then get about 8 options including, boot to safe mode, safe mode with networking, etc..., unfortunately, no matter which option we choose, it reverts back to the previous screen. We are a reseller of your product and this is on a computer of one of our clients. I found this issue last week and they brought the computer into our office. I completely removed WebRoot and reinstalled it hoping it would fix it, but today they are having the same issue.
Let me have support follow up with you again. If you're ok with that, I'll open up a ticket for you.
Thank You
Ok ticket is created.
I just spoke to a tech support person. So you can close this ticket.
Ok will do
I am having exactly the same problem on windows 10.  What is the resolution?
If you can boot the computer into safe mode, delete the file (wrkrn.sys) located at windowssystem32driverswrkrn.sys. The Webroot tech informed me that it will get recreated after restarting the computer. We couldn't boot to safe mode, so we had to remove the hard drive from the computer and slave it onto another system to get to the file and delete it.
Your defunct pc that refuses to boot via any of the methods of repair is due to the fact that the wrkrn.sys has been flagged as part of a critical boot file. It will refuse to boot in any of the safemode, debug, etc etc options.

 

the alternative is to boot from a bootable win10 setup usb/cdrom.

 

and proceed to click on the "REPAIR" instead of setup. Then you'll be able to select  an advance method to boot in safemode with command prompt using the win10 setup. You can delete the file in question or replace/copy on the command prompt.

 

 
So, we know how to fix this. That's great.

 

But what causes it, and what can be done to prevent it?
Not sure what the root cause is - I'll see if I can find out.
So the root cause for this one looks to be the new Microsoft Wireless keyboard driver that's been causing us issues. The good news is that the next version of the agent has a fix for this.
Am experiencing the same issue at the moment.  Has this been addressed & repaired?  Unable to get into Windows Safe Mode using installation DVD.

 

Am currently running 9.0.12.52.
Having this problem with a Windows 2008 R2 server.  No wireless keybaord here, it's a VM server on an ESX host.  At first it would simply boot to recovery mode directly.

 

My process was having to boot to a recovery CD to get command line then do:

BCDBoot c:Windows  (was actually K: for us, but wherever your windows install is)

 

After this, system tried to boot but I got the WRkrn.sys error.

 

Booted to CD again and deleted the file.

 

System is now back online.
I believe the build that will resolve this will be coming out next Tuesday (10/18), barring any changes. 

 

If you're still experiencing the issue after this build update, I recommend you open a ticket so our support team can get the right information escalated up.
I'm having this issue too. I don't have a CD drive to boot from CD, and I can't afford to go and buy another copy of windows10 to put on a flash drive. I can try to get rid of the file using command line; however, I've never done so before so it will be a risk.  Failing that, I'll reformat it and put Linux on it instead.

 

Are there any other suggestions that I could try before doing these two steps?
welp I had this happen tonight on both a server 2012 R2 system and a windows 7 laptop. This is not good. Luckally I was able to command prompt and delete the file but still is not good.
Boot the faulty computer with Hiren's boot usb key and copy the wrkrn.sys file from the usb key to windowssystem32drivers.

Reboot the computer.

 

Note: First copy the wrkrn.sys file from the working computer to the Hiren's boot usb key
I have had 12 system today that were booting to a black screen with just the mouse cursor. I went into Windows Repair (Windows 7) and then opened the Command Prompt. Renamed the file and the systems rebooted properly.

 

Questions:

 

Why is this happening?

 

Is there a better way to fix this since it is happening to so many systems?

 

Is there a way to prevent this?
As per my knowledge, there is no permanent fix rolled out by Webroot so far. Please raise a ticket with Webroot, they may roll out the fix depending on the number of tickets.
Folks,

 

We're aware of this issue and have been working hard to find the cause.   For background, WSA re-writes it's kernel driver  every so often.  We do this just in case the current driver file has been tampered with or corrupted in some way.  However, there are occasions where Windows is doing something that inteferres with this process.  We've got a solution but this is all kernel driver work and we're taking very cautious approach with our QA.  Once it's ready for release, we'll get it out to you all. 

 

 

Regards

 

Jonathan.giffard

Senior Product Manager

WSA

 
Any updates on this...?

 

We are still experiencing the issue on a few systems here and there...

 

Easy enough to fix but the end user freaks out...
Hello Webroot!

 

I am an IT Consultant, Microsoft Partner and an MSP utilizing Continuum as my platform. I just spent an hour and a half troubleshooting the workstations at one of my clients. To save some time (as I have a spent a lot of it on this issue already), I am going to paste in the information I sent to Continuum. This issue is causes some real problems and potential damage to workstations. Thank you.

 

Microsoft has found that the Webroot driver wrkrn.sys is causing reboot issues when an update is being installed during reboot on Windows 10. Clients are experiencing a black screen with spinning white dots that never resolves without a forced reboot via holding down the power button. When running a fltmc.exe command on machines experiencing the issue, we find that WRkrn appears twice:



Filter Name Num Instances Altitude Frame

------------------------------ ------------- ------------ -----

wcnfs 0 409900 1

WRkrn 329998.99 <Legacy>

MBAMProtector 3 328800 0

WRkrn 6 321611 0

 

Microsoft believes this driver is the issue and Webroot seems to have a knowledge base article potentially confirming this issue: https://community.webroot.com/t5/Product-Questions/windows-system32-drivers-wrkrn-sys/m-p/287006#M4830 - Microsoft points out that the altitude for the first instance of the driver should not be followed by a decimal amount.

I need a solution to this issue as the forced reboot could be causing damage to the workstations and their hard drives.
The issue has not been resolved, we had 2 computers today that had this problem.

 

When can we expect a permanent solution?

Reply


Terms & Conditions