Forum Discussion
KB4598242/KB4598229 BSOD Crash with CRITICAL PROCESS DIED errors
We started rolling out KB4598230/KB4598242/KB4598229 last week, since when we have seen widespread BSOD crashes with CRITICAL PROCESS DIED errors, and nothing useful in the crash dump. The same h...
For anyone who comes looking, we tracked this down to Webroot Anti-Virus. It looks like MS did something to VSS in these patches. On affected machines, any snapshot operation seems to cause a crash in C:\WINDOWS\system32\drivers\wrkrn.sys
Webroot have offered a work-around involving turning off some protections temporarily, but so far we're struggling to definitively prove that these work (and have at least one case where they don't). Holding out for a proper solution.
Robertoey did you get this solved? We started seeing this today again on Server 2019 with WR. This has been an ongoing battle where it seems the issue is solved and we re-enable VSS. After some time it crops up again.
WR also offered us the same solution to disable Infared or some other things in the scanner. I have not reopened a ticket with them as yet. Most likely going to be migrating off WR soon.
jasssie making the suggested changes from support definitely fixed the issue for us. I had another start crashing last week, and it turned out not to have had the correct WR policy applied - doing so fixed it.
I note that a few of my systems now have a newer version of the agent installed, which I assume is the version with the fix in for this issue, but WR support have not contacted me to confirm that, nor does it look like it is rolling out to all our systems, so perhaps they're pushing it to a proportion first. I am about to contact them to ask what is going on.
I don't want to change AV, as it is a pain to do, and WR is cost-effective and works well, until now, but this poor support is pretty annoying.