webroot seems to be causing kbdclass.sys bsod in win10 with ms keyboard

Hi adamusncgfp
 
Welcome to the Community Forums.
 
I have not come across WSA as the cause of this and would suggest that you check out this thread from the MS Support Forums, on this subject to see if it is of any help.
 
If you have tried temprarily shutting down WSA and find that the crashes stop then you can try an uninstall/clean reinstall of WSA to see if a faulty installation my have been causing the issue. If you want to try that then please follow the steps below closely!
 

• Make sure you have a copy of your 20 Character Alphanumeric Keycode! Example: SA69-AAAA-A783-DE78-XXXX
• KEEP the computer online for Uninstall and Reinstall to make sure it works correctly
• Download a Copy Here (Best Buy Subscription PC users click HERE)
• Uninstall WSA and Reboot
• Install with the new installer, enter your Keycode and do NOT import any settings if offered by the installer; to as you can set it up as you like once it's done
• Let it finish it's install scan
• Reboot once again

and try your keyboard again.
 
Post back to let us know how you have got on/if the issue is resolved or not.
 
Regards, Baldrick

This is a known issue with Webroot right now. Contact support and they'll provide you with a registry file as a work around until they fix it in Webroot itself. 

I got around this on several Windows 10 machines with Webroot installed by going into Device Manager , right-click HID Keyboard Device, select properties, then the Driver tab, then click 'Roll back driver'.
 
It is possible that Windows 10 will reinstall the driver due to Microsoft update policy preventing you from disabling problematic drivers, but so far it hasn't happened to me.

I'm having this exact same problem - rolling back drivers hasn't helped. 
I'd love to get this registry patch so I can continue using Webroot until it gets properly fixed. 
Thanks!

Hi Panamon
 
Welcome to the Community Forums.
 
If you want to get hold of the Registry fix for this issue you will need to Open a Support Ticket to request it from the Support Team directly.
 
That is the safest approach as at least you can be sure of the source and therefore what you get hold of to run on your system. Just explain the postition and they should be able to supply this.
 
Regards, Baldrick

Here is the information I received from Support:
 
The Webroot Development team has been notified of this issue. We do have a resolution available by modifying some of the Webroot settings to switch the way we monitor keyboard activity on the system.

You can do this via your management console policy:
Identity Shield Settings > Compatibility Mode = ON

For instructions on modifying policy settings, please refer to our online help below.
href="http://live.webrootanywhere.com/content/779/Changing-policy-settings" target="_blank">http://live.webrootanywhere.com/content/779/Changing-policy-settings</a>

It will create the following registry key:
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceswrkrncompat]
"Enabled"=dword:00000006

The system WILL require a reboot for the change to be applied fully. If the issue persists, please check if the registry key was successfully created, in some cases the agent may need to be shut down in order for the key to be applied. For these cases I have included the manual method below.

To apply the fix please follow the steps below:

1. Please download the following Zip file:
http://download.webroot.com/CompatibilityFlag.zip
2. Locate the SecureAnywhere icon in your system tray.
3. Right-click the system tray icon and select "Shut down protection." (You may need to adjust your policy to allow Webroot to be shut down manually via the tray icon. This is under "Basic Configuration".
4. A prompt confirming whether you want to shut down appears. Click Yes.
5. Depending on your settings, you may have to complete a CAPTCHA for confirmation as well.
6. Import CompatibilityFlag.reg from the .zip by double clicking on the file.
7. Reboot the machine after confirming the import.

Hi ahildreth
 
Many thanks for posting back and sharing. This is useful to know.
 
Regards, Baldrick

Can this affect machines that have identity shield turned off through central management? I'm seeing the exact same crash patterns, with webroot listed in my dump files.

@ wrote:
Yes - you need to do the full fix in the KB to get it to stop. Turning off ID Shield isn't sufficient.

Any timeline for a permanent fix?
 
Thanks,
 
Daniel 😉

Not that I've heard. It's still being investigated by our escalation and dev teams.

this is bloody annoying cos even with the registry patch workaround, somehow 5 pc's in the office (using ms keymo) were working fine then somehow a win update came around then bsoded with kbdclass.sys and corrupted the wkrnl.sys rendering the pc unable to boot.

After restoring wkrnl.sys, reboot was slow, then proceeded to bsod with kbdclass.sys again! This time i pulled out the wireless ms dongle reapplied the patch via a vnc session! but still bsoding after the reboot!

got frustrated and replaced all of the 5 ms keymouse with a logitec one and are now humming nicely!

We've been hit by this bug again thanks to the Windows 10 anniversary update. I've discovered that installing the update, the registry key for Webroot compatibility mode was removed. It was present before I updated my computer, and the policy had compatibility mode enabled. Once updated, it was no longer there.
 
I tried refreshing the configuration, but this did not recreate the key. I created they key manually (as detailed earlier in this thread) and rebooted, and this fixed it for me.
 
We have a base of around 30 machines, all using Windows 10 and Microsoft wireless keyboard and mice. I've created a GPO that ensures the compatibility registry key is present and replaces it if it gets removed for any reason - hopefully this will cover machines taking the anniversary update in the future.

Hello and Welcome to the Webroot Community!
 
Just to add to this thread anyone that has issues with the "WRkrn.sys causes blue screen failure" and Microsoft keyboards try this fix: https://www5.nohold.net/Webroot/ukp.aspx?pid=12&login=1&app=vw&solutionid=2544&donelr=1
 
If the fix doesn't work for you then please contact support! Webroot Customer Service
 
Or call them:
 
Call 1-866-612-4227
M-F 7am?6pm MT
 
Thanks,
 
Daniel
 
I will quote from them:
 
"Hi Daniel,
 
I concur with Brad, customers who can address their own wireless keyboard BSOD by applying the fix offered in the noHold article is the best first step. If customers are unable to resolve the issue on their own for whatever reason should contact support so that our trained team can assist further.
 
Thanks,
 
Shai"
 
 

I am getting this BSOD before I can shut down WSA protection.
I think that  typing in the captcha is triggering the BSOD.
So it's kind of a catch22 situation. 
what to do?
What if I use a different keyboard? Will I have to disconnect the MS keyboard wireless dongle?

That should do the trick, and yes remove the wireless dongle.

So glad I checked the boards out, because this happened to me overnight. I sure hope there will be a fix soon because using the plug in kb is driving my crazy. It is so small. I did try the fix but I can not get it to work for me. 
 
Remsie

I recently started have the Driver IRQL not less than equal BSOD.   I too have the MS wireless keyboard.   So the fix is to remove the dongle and use a differed (wired) keyboard?  What comes next?  Is there some fix or patch so I can go back to my wireless keyboard?

Hi shewfekj,
 
Welcome to the Webroot Community.

The issue you are having with Webroot and your wireless keyboard has been reported to the Webroot Development team and they are working on a fix.

In the meantime, we do have a workaround you can utilize to modify some of Webroot's settings to switch the way we monitor keyboard activity on your device. This should prevent this issue from reoccurring until our fix is available. 

To apply the workaround, please follow the steps below:

1.     Please download the following .zip file: http://download.webroot.com/CompatibilityFlag.zip 
2.     Locate the SecureAnywhere icon in your system tray.  
3.     Right-click the system tray icon and select Shut down protection.
4.     A prompt confirming whether you want to shut down appears.  Click Yes.
5.     Depending on your settings, you may have to complete a CAPTCHA for confirmation as well.
6.     Import CompatibilityFlag.reg from the .zip by double clicking on the file.
7.     Reboot the machine after confirming the import.

Once the machine has rebooted, the issue should be resolved.

Should you have any futher questions or concerns, please open a support ticket.
 
Hope this info helps,
BD

Thank you for the greeting and response. I look forward to applying the workaround this evening and will report back.

@ wrote:
Thank you for the greeting and response. I look forward to applying the workaround this evening and will report back.

You're very welcome, shewfekj. Please let us know either way how it goes.
 
Have a good day :)
BD

The patch worked just fine, thank you. Wish I didn't have to spend $100 to have my computer reimaged due to inability to reboot when the problem first arose. 

We Beta Testers have a version with the fix and very soon it will be out to everyone! So we can put this bed per say!
 
Thanks,
 
Daniel 😉

I appreciate the attempt of giving this fix bt it did not work with my Microsoft 2000 wireless keyboard/mouse. I have purchased a different AV software and the kdbclass.sys blue screen problem is gone. Faster start ups too. I was happy with Webroot for a couple of years. But W10 Anniversary did it in. 

@ wrote:
 I was happy with Webroot for a couple of years. But W10 Anniversary did it in. 

Why blame Webroot for the issues that Microsoft Caused? I'm a Microsoft Windows Insider MVP and Unbelievable how others have had issues and some even worse but Webroot is always fixing these issues.
 

@ wrote:
 I have purchased a different AV software and the kdbclass.sys blue screen problem is gone. Faster start ups too.

And another AV has faster start ups? Now that's a laugh as WSA is the Fastest and Lightest. https://webroot-cms-cdn.s3.amazonaws.com/1214/5445/6840/Passmark_Endpoint.pdf
 
??
 
??