WRkrn.sys causes blue screen failure

hi peeps. i have a problem with this file, that is located inside the folder drivers of system32.
this is what WHOCRASHED reported to me:
On Thu 05/04/2012 07:13:50 GMT your computer crashed
crash dump file: C:WindowsMinidump40512-21418-01.dmp
This was probably caused by the following module: wrkrn.sys (WRkrn+0x6076)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF88000DCB076, 0xFFFFF8800AA9BA90, 0x0)
file path: C:Windowssystem32driverswrkrn.sys
product: Webroot SecureAnywhere
company: Webroot
description: Webroot SecureAnywhere
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: wrkrn.sys (Webroot SecureAnywhere, Webroot).
Google query: wrkrn.sys Webroot SYSTEM_SERVICE_EXCEPTION
any clues on how to overcome this failure? 
thanks in advance

Best answer by MikeR 5 April 2012, 15:15

View original

67 replies

Userlevel 7
Hey saintshaka,
Welcome to the Community and thank you for the detailed post.
I would like you to open a support ticket so that we may gather specific information about this minidump. Please use the email address your product may be registered under as well as any keycodes for your product when you open the ticket. You can also copy and paste the information on the minidump that you provided below.
Thank you!
I am very disappointed. I opened the ticket and i reported what you read above in this topic, but i received an useless email:
      To manage your subscriptions or to change your subscription options, click here.
If this link doesn't work:
  1. Log on to Webroot Community.
  2. Click My Profile.
  3. Click the Subscriptions & Bookmarks tab.
  4. Change your settings and click Save Changes.
Thanks for being a Webroot Community member.
Your Webroot Community Team
well i dont know how to overcome this problem and nobody of the staff seems to be able to help me, even though i bought several licenses...
Userlevel 7
Did you receive that in an email, or did you receive an email saying there was a reply to your ticket and to log in to the support system to view it?  If it was the former, then it's an autoresponse that tries to guess based on what you write and the ticket was potentially not viewed yet.  The response time can be up to 72 business hours officially.  Normally it isn't, but i do know that support was changing floors in the building at the end of last week, so  it slowed things down a touch.
how long is it gonna take before somebody from the staff explains me how to overcome this issue cuased by wrkrn.sys ?
do i have to uninstall the whole os and put it back cleaned?
this is what i received from the staff:

You have submitted a trouble ticket for Webroot’s 2011 edition (or older) product line. We would like to inform you that if you are currently experiencing an issue with Spy Sweeper, Webroot AntiVirus, Webroot Internet Security Essentials, or Webroot Internet Security Complete, you can now upgrade to the 2012 version of these products for free. Our new product line is called Webroot SecureAnywhere, and is already getting rave reviews. 

If you are currently using a Webroot SecureAnywhere product and you require assistance, please submit a support request using the Help and Support link in the software or on our website at

If you submitted this ticket regarding Window Washer, or if upgrading to the new Webroot SecureAnywhere product is not a solution for you, skip the instructions below and reply to this message for further assistance.

In order to upgrade to Webroot SecureAnywhere, follow the steps below. Keep in mind that this new product version runs differently, so any previous issues you have experienced may be resolved. For more information about the new product line, see:

-- -- -- -- -- -- -- -- 

The following instructions will guide you through the process of upgrading from the 2011 edition (or older) Webroot Security software to the new Webroot SecureAnywhere 2012 version. 

** Note: If you currently have the Beta or Trial version of Webroot SecureAnywhere 2012 installed on your computer, please uninstall it before following these instructions. To uninstall, navigate to Start > Programs > Webroot SecureAnywhere > Tools > Uninstall Webroot.

To upgrade to the Webroot SecureAnywhere 2012 software: 

1. Ensure that you are connected to the Internet.

2. Open your 2011 or older Webroot Security product and click “Check for Updates”. 

In Spy Sweeper, this button is available on the main screen and under Options > Update > Check for Updates. 
In the 2011 version of Webroot Security software, you can check for updates by opening the main interface, then navigating to Settings > Updates > Check for updates now.

**Note: We recommend that you use the “Check for Updates” method to download the Webroot SecureAnywhere software. If you are unable to use this method because your previous Webroot Security software is not currently installed or is not functioning as desired, skip the following steps and reply to this message. Be sure to include why you are unable to use the Check for Updates button to upgrade in your reply.

3. When you click “Check for Updates”, a web page appears with download instructions for Webroot SecureAnywhere. Click the button labeled “Install Free Update”. This action initiates the download process. When prompted, save the installer file to your desktop.

4. Locate the “wsainstall” file on your desktop. Double-click it to begin the installation.

5. The installer searches for currently installed legacy Webroot Security software on your computer. If found, a “Thank you for upgrading!” dialog appears. If this dialog appears, click Continue.

6. When the installer launches, it searches for previously used keycodes on your system. If it locates a keycode, the installer displays the keycode in the installation window. If the keycode is correct, click “Agree & Install” to proceed. If no keycode, or the wrong keycode, is displayed, enter the correct one before clicking “Agree & Install”.

**Note: While performing this upgrade to Webroot SecureAnywhere, you may receive an informational pop-up message (containing a blue circular icon) from the 2011 version of the software. The message reads “Product Update Complete” and provides two options: “Restart Now” and “Restart Later”. DO NOT select “Restart Now”. This can result in an incomplete or damaged upgrade to the new Webroot SecureAnywhere software. Be sure to select “Restart Later”. (A restart is not necessary to complete installation of SecureAnywhere.) If you choose “Restart Now” unintentionally, skip the steps below and reply to this message with this information.

7. After clicking “Agree & Install”, the keycode is validated and the installer searches for and applies updates. You may be provided a new keycode during this process. Be sure to use this new keycode for all future installations.

The installation process itself takes a matter of seconds, and an initial system scan runs upon completion. Please do not cancel this initial scan; it will only take a few minutes.

8. Once the initial scan is complete, the Webroot SecureAnywhere software is fully installed and protecting your system. The Webroot SecureAnywhere user interface will appear for you to explore. To close it, simply click the “X” at the top right corner.

-- -- -- -- -- -- -- -- 

We hope you find this information helpful. Once Webroot SecureAnywhere has been installed, it is not recommended that your reply back to this ticket since this ticketing system is dedicated to our previous 2011 edition and older product lines. Rather we recommend you visit our new self-help, user guides, FAQs and other support options, including the ability to start a conversation with us in our new support ticket/conversation interface, available to you at any time at:

Thank you,

The Webroot Technical Support Team
Now do you think there is something tied up with what i reported above with the minidump of the software WHOCRASHED?
Userlevel 7
Hello saintshaka,
I am sorry that you are still experiencing this issue and we do want to resolve it for you!
Kit and I wanted to find where you had submitted your ticket before troubleshooting the issue. I had previously given you instructions on how to open a support ticket for our newer software. Based on your last response I see that you had opened a support ticket under our old system, this is why you received an automated response. 
You may be experiencing this issue because of remnants of the older software. Please open a support ticket here so that we can help you remove the older software and get the necessary logs to troubleshoot further. Use the same email address you registered your account under.
Thank you,
thanks a lot. Im gonna wait another wekk, then i will format the whole notebook and put the os back...
Userlevel 7
Hey saintshaka,
Thank you for opening a support ticket. I just found the ticket you submitted today and I have replied with instructions for you to follow. This will allow us to gather logs so we may research the mini-dumps and crashes you have experienced.
However, if you would like to reformat your notebook as you have mentioned, you may use this  to reinstall the latest SecureAnywhere software.
Thank you,
Userlevel 7
I'll add just a touch to this.
Firstly, you normally should not need to reformat the system.  If something is crashing, remediating the thing that is crashing is much more effective than wiping out everything.
Secondly, utilities that try to determine what crashed are not usually fully correct.  As a good example, one of my prior machines had horrible trouble with a security driver, crashing multiple times per day.  The security driver was fine though, it turned out that the RAM (Computer memory) was bad and had to be replaced.  The driver in question was just the lucky thing stuck at the bad part of the memory space.
Now that we have you in the correct support system, things should go much better for getting solutions to the problem.  Mike will be able to help you out from there.
I have the same problem too. Twice already seen this BSOD. It seems that I have at least a third user with this problem.
wrkrn.sys is the file nominated by my startup repair as corrupt. Startup reppair cannot fix this fault, so I can't use my computer at the moment. 
Userlevel 7
Hi cracker
Welcome to the Community Forums.
Sorry to hear that you are experiencing this issue.  One course of action, and probably the most appropriate unless you are computer savvy/happy to tweak your system, is to follow MikeR's advice ealier in the thread (actually Post 2), and Open a Support Ticket  and let the Support Team deal with it for you.
Following on from that may I ask as to why you would be running Windows Repair?  Can I ask as to whether you may have uninstalled WSA and following that you have been getting BSODs (Blue Screen of Death)?
The reason I ask is because this has been seen before and is due to WRkrn.sys being left over after an uninstall (especailly if done with a 3rd party uninstaller rather than the Add/Removew Program option built into Windows.
If the above is true, and only if the above is the case in all aspects, i.e, uninstall  & BSODs, etc., then what I suspect that you need to do is to delete the left over WRkrn.sys....and as we are talking about dabbling in the System File area YOU NEED TO BE CONFIDENT ABOUT YOU TECHNICAL SKILLS before doing so.
If confident you most probably need to boot into Safe Mode WITHOUT Networking, navigate to the location of the file (this is usually C:WindowsSystem32driversWRkrn.sys) and RENAME it to something like WRkrnOLD.sys (always better than a straight delete), and then reboot.
That should now mean that the fiel won't be found at boot and so not cause the issue.
But again, I caution that this is just based on my assumptions that you may have uninstalled WSA and following that you have been getting BSODs.  If that is not correct or you have any dubts then please go the Support Ticket route, as it is the safest.
Please do post back to let us know what you decide/opt to do.
Regards, Baldrick
Just had to look this up for a client. Didnt find a solution so had to improvise.
It has a simple enough solution but does require you to have a boot device like a rescue DVD. Just something to let you get to the file system. If you do not have a boot DVD made or something use another computer and simple create one.
Once you can get to the file system navigate to the file and delete it. Restart the pc and your good to go. make sure to COMPLETELY remove Webroot then reinstall it. This last step is critical and do not miss it.
Whole thing takes maybe 10mins.
Good luck
Userlevel 7
^ The above may work, however if you delete the WRKrn.sys driver the service will still try to run and it may cause a boot failure. 
I just got the WRkrn.sys blue screen of death.  And I do mean death!  It crashed my laptop and it won't even start up now. :-(
I don't think it can be fixed.  It will probably have to go to the computer scrapyard now.  If anyone knows how to start up a dead computer I'm all ears.
after some years my post is still populated and, most important thing, this issue is still there....ridiculous.
There is a solution, DO NOT use this product anymore
Userlevel 7
This most likely because it affects a minute number of users and is most likely due to an issue on those user's systems.  My suggestion is to take the advice of a couple of posts above your and do complete uninstall/clean reinstall of WSA and that will most likely resolve the local issue.
Of course, if the very small number sof user affected cannot get WSA to work on their systems after that then they should indeed look for and find a suitable alternative to WSA (I personally have had similar problems with other major anti virus/anti malware names to be mentioned...which has meant that I cannot use them).
Regards, Baldrick 
Userlevel 7
Hi NancyProut
Welcome to the Community Forums.
You say it won't even start up; can you explain exactly what occurs when you try to start it?  WHat version of Windows are you running on the laptop? Do you manage to start it and it BSODs?  
Because if that is the case and you have a WIndows Recovery disc then you should be able to use that to boot up and then have a go a repairing WIndows so that you can boot or at the very least booting up into Safe Mode, after which you should be able to uninstall WSA, and then see if you can boot normally.
Regards, Baldrick
HI NancyProut
Had a similar issue recntly and i allplied the following fix. How will need to have the following to carry out this process.
1. Working PC/Laptop
2. Internet Connection
3. Empty USB Pen Drive
4. Another Storage device
Method 1:
Step 1:
Download Ubuntu OS and mount it on the empty pen drive (using a mounting program such as rufus) 
Insert the Pen drive into the spoilt PC and let it boot into the USB. Use Try ubuntu so you dont need to install the OS (i.e you run it live out of the pen drive) 
Navigate to your root drive:/Windows/System32/drivers and find WRkrn.sys file.
Step 2:
Rename the fie to WRkrnOLD.sys
Shut down your PC and remove you pen drive.
Restart and it should work fine.
Uninstall webroot and reinstall it. Take a backup once everything is done for future use if needed
Method 2: (If method 1 doesnt work)
Step 1: (is the same)
Step 2:
You will most likely have to replace the WRkrn.sys file instead of renaming it. you can find this file in a working PC that has webroot installed. copy it and replace the file in the PC that isnt working.
This worked for me. (I didnt bother with method 1 since i had another PC with webroot installed)
Shut down and take the pen drive out. Start and it should work.
Backup your PC
If anyone needs a working copy of the WRkrn.sys file reply to me with you mail IDs and I can send it to you
Let me know if this worked for you guys !
Could you please send me the WRkrn.sys file? I can't find it and my computer says it is missing. My email is Removed email for security reasons
Thanks in advance!
Userlevel 7
Badge +56
@ wrote:
Could you please send me the WRkrn.sys file? I can't find it and my computer says it is missing. My email is Removed email for security reasons
Thanks in advance!
Hello and Welcome to the Webroot Community!
Please do a clean reinstall and that will get you the driver back as this is a very old thread.
Please follow the steps closely!
  • Make sure you have a copy of your 20 Character Alphanumeric Keycode! Example: SA69-AAAA-A783-DE78-XXXX
  • KEEP the computer online for Uninstall and Reinstall to make sure it works correctly
  • Download a Copy Here (Best Buy Subscription PC users click HERE) Let us know if it is the Mac version you need.
  • Uninstall WSA and Reboot
  • Install with the new installer, enter your Keycode and do NOT import any settings if offered by the installer as you can set it up as you like once it's done
  • Let it finish it's install scan
  • Reboot once again
Please let us know if that resolves your issue?
Daniel 😉
Hi I got this screen of death after restarting my laptop, and never had this problem. Can you help me?
Userlevel 7
Hi Emicska
Welcome to the Community Forums.
Please follow the advice provided by TripleHelix in the post just before yours, i.e., undertaken an uninstll/cclean reinstall of WSA by carefully following the instructions he has provided.
Regards, Baldrick
If it is,due to the windows 10 update, what could I do not letting me to go to safe mode
Userlevel 7
Badge +56
Who said anything about safe mode? Did you try the above first?
Hi there,
Fixed this issue yesterday as follows.
1. Boot up using my HiRens Disk.
2. Rename WRkrn.sys to WRkrn.sys.old in C:WindowsSystem32Drivers
3. Reboot PC
4. Update Webroot.