WRSVC service restarts constantly

Discussion in 'Prevx Releases' started by Compman60, Feb 25, 2012.

Thread Status:
Not open for further replies.
  1. Compman60

    Compman60 Registered Member

    Joined:
    Feb 25, 2012
    Posts:
    3
    Hello;

    I have used Webroot software for some time now. I recently upgraded to Webroot SecureAnywhere Essentials with a 3 user license. On two of my PC's it installs without a problem. But on the third PC SecureAnywhere won't install.

    When I run the wsainstall.exe file the directory C:\Program Files\Webroot is created with the file WRSA.exe in it but I never get the window where I have to enter the keycode like I did with the other two PC's. After searching around I found out that the service wrsvc keeps restarting every several seconds.

    I compared the properties of wrsvc on all three PC's and they seem identical. The accounts I am using to run wsainstall.exe all have administrator privileges so I am at a loss as to what is happening.

    The PC that I am having trouble with is running Windows 7 Ultimate Version 6.1 Service Pack 1. I ran McAfee and Malwarebytes to look for viruses or malware but all scans come up empty. Any help will be appreciated.

    Thanks;

    Ron
     
  2. STV0726

    STV0726 Registered Member

    Joined:
    Jul 29, 2010
    Posts:
    900
    I am certain Joe will have a more definitive answer.

    I was about to suggest restarting your Windows Installer service when I remembered Webroot doesn't use a Windows Installer.

    You can try to download a randomized filename and see if that works, but as you indicated you do not believe it is a malware problem.
     
  3. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,408
    Location:
    Ontario, Canada
    On that system did you have an older version of Webroot on it and any other security that could of blocked the installation as it needs full access to the Internet to install?

    Thanks,

    TH
     
    Last edited: Feb 26, 2012
  4. Compman60

    Compman60 Registered Member

    Joined:
    Feb 25, 2012
    Posts:
    3
    I have McAfee Internet Security loaded, but I loaded that after Webroot failed to run. I did modify the Internet Connections for Programs in McAfee and added both wsainstall.exe and WRSA.exe for full internet access, but it didn't help.

    After looking at the Event Viewer, I did find this event:

    Log Name: Application
    Source: Microsoft-Windows-Winsrv
    Date: 2/26/2012 2:51:49 PM
    Event ID: 10001
    Task Category: None
    Level: Information
    Keywords:
    User: Custom-PC\Ron
    Computer: Custom-PC
    Description:
    The following application attempted to veto the shutdown: schedhlp.exe.



    And this event:

    Log Name: Application
    Source: Application Error
    Date: 2/26/2012 2:43:47 PM
    Event ID: 1000
    Task Category: (100)
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Custom-PC
    Description:
    Faulting application name: WRSA.exe, version: 8.0.1.95, time stamp: 0x4f28d498
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc0000005
    Fault offset: 0x00000000
    Faulting process id: 0x19b4
    Faulting application start time: 0x01ccf4c7551719fe
    Faulting application path: C:\Program Files\Webroot\WRSA.exe
    Faulting module path: unknown
    Report Id: 9410e585-60ba-11e1-9ef1-6c626de6b77a


    Ron
     
  5. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,408
    Location:
    Ontario, Canada
  6. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    It could sound as if McAfee is blocking/removing WSA during the installation process. Could you try booting into safemode and manually removing the Webroot components, then temporarily disable McAfee and try reinstalling?

    Please let me know your results!
     
  7. Compman60

    Compman60 Registered Member

    Joined:
    Feb 25, 2012
    Posts:
    3
    I deleted all instances of Webroot SecureAnywhere that I found and disabled McAfee Antivirus and Firewall. This time the service wrsvc remained in the "starting" state and didn't cycle through startinig and stopping.

    This time this event showed up. It seems similiar to the one event in my previous post but the fault offset is different this time:

    Log Name: Application
    Source: Application Error
    Date: 2/26/2012 9:37:32 PM
    Event ID: 1000
    Task Category: (100)
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Custom-PC
    Description:
    Faulting application name: WRSA.exe, version: 8.0.1.95, time stamp: 0x4f28d498
    Faulting module name: WRSA.exe, version: 8.0.1.95, time stamp: 0x4f28d498
    Exception code: 0xc0000005
    Fault offset: 0x0001c73e
    Faulting process id: 0xad0
    Faulting application start time: 0x01ccf50121012833
    Faulting application path: C:\Program Files\Webroot\WRSA.exe
    Faulting module path: C:\Program Files\Webroot\WRSA.exe
    Report Id: 60e69bf5-60f4-11e1-bf99-6c626de6b77a


    There was also this event, which is new:

    Log Name: Application
    Source: Windows Error Reporting
    Date: 2/26/2012 9:37:31 PM
    Event ID: 1001
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: Custom-PC
    Description:
    Fault bucket 2746339056, type 5
    Event Name: BEX
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: WRSA.exe
    P2: 8.0.1.95
    P3: 4f28d498
    P4: StackHash_4c4a
    P5: 0.0.0.0
    P6: 00000000
    P7: 00000000
    P8: c0000005
    P9: 00000008
    P10:

    Attached files:
    C:\Users\Ron\AppData\Local\Temp\WER7F82.tmp.WERInternalMetadata.xml

    These files may be available here:
    C:\Users\Ron\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_WRSA.exe_42a59c18fdd36eb9e22c7b12b8c3309d6564cedd_1dd68b07

    Analysis symbol:
    Rechecking for solution: 0
    Report Id: 5ef51c5c-60f4-11e1-bf99-6c626de6b77a
    Report Status: 0


    And finally, these messages from Service Control Manager (in reverse order of when they occurred:

    (1)
    Log Name: System
    Source: Service Control Manager
    Date: 2/26/2012 9:37:10 PM
    Event ID: 7045
    Task Category: None
    Level: Information
    Keywords: Classic
    User: Custom-PC\Ron
    Computer: Custom-PC
    Description:
    A service was installed in the system.

    Service Name: WRSVC
    Service File Name: "C:\Program Files\Webroot\WRSA.exe" -service
    Service Type: user mode service
    Service Start Type: auto start
    Service Account: LocalSystem

    (2)
    Log Name: System
    Source: Service Control Manager
    Date: 2/26/2012 9:37:17 PM
    Event ID: 7031
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Custom-PC
    Description:
    The WRSVC service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    (3)
    Log Name: System
    Source: Service Control Manager
    Date: 2/26/2012 9:37:27 PM
    Event ID: 7032
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Custom-PC
    Description:
    The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the WRSVC service, but this action failed with the following error:
    An instance of the service is already running.

    Ron
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.