[SOLVED] BSOD at noon, 1pm and 6PM every day. FIX: I removed WebRoot antivirus.

[ldabney67]

I ran the BSOD collection program and have attached the zip file. Thank you in advance with your help with this.

 

[ldabney67]

The server also created a memory.dmp file that is about 600MB if you'd like that too I can upload it.

 

[x BlueRobot]

Are you running the WebRoot program at set intervals? It appears to be killing your services.exe for some reason?

3: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffff8900`23fb03c8 fffff800`ace85b3e nt!KeBugCheckEx
01 ffff8900`23fb03d0 fffff800`acdab5af nt!PspCatchCriticalBreak+0xd6
02 ffff8900`23fb0430 fffff800`acc7f25d nt!PspTerminateAllThreads+0x12b48b
03 ffff8900`23fb04a0 fffff800`acc7f014 nt!PspTerminateProcess+0x101
04 ffff8900`23fb04e0 fffff800`ac972e03 nt!NtTerminateProcess+0x9c << Kill services.exe
05 ffff8900`23fb0550 fffff800`ac966c00 nt!KiSystemServiceCopyEnd+0x13
06 ffff8900`23fb06e8 fffff801`6b1f39b0 nt!KiServiceLinkage
07 ffff8900`23fb06f0 00000000`00000000 WRkrn+0x39b0

3: kd> lmvm WRkrn
Browse full module list
start             end                 module name
fffff801`6b1f0000 fffff801`6b211000   WRkrn    T (no symbols)           
    Loaded symbol image file: WRkrn.sys
    Image path: \SystemRoot\System32\drivers\WRkrn.sys
    Image name: WRkrn.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Oct  1 19:22:10 2019 (5D939952)
    CheckSum:         00032748
    ImageSize:        00021000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

 

[ldabney67]

Yes we are running Webroot. That snippet of text is from 2019 though isn't it?

 

[x BlueRobot]

That's the timestamp of the driver, the snippets above are from your recent dump file(s).

 

[ldabney67]

Ah ok, thank you.

 

[ldabney67]

Removed Webroot and the problem went away.
Thank you so much!

 

[x BlueRobot]

No problem, glad to be of assistance. Did you manage to find out why it didn't like services.exe?