Windows XP error on opening - Trusteer Rapport related

Anonymous

Had Windows XP for 10 years, but yesterday failed on opening; after opening Desktop, I got a blue screen & very long error message implies that hardware or software installations have failed. No hardware or software installations done for many months and was fine the day before. Error message reads:

A problem has been detected and windows has been shut down to prevent damage to your computer.

INVALID-PROCESS-ATTACH-ATTEMPT

If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Start Up options, then select safe mode.

Technical Information:

***STOP: 0x00000005 (0x86E0A658, 0x86FC4830, 0x00000001, 0x86E19A90)

Had to unplug to switch off to restart, and then no response to any key stroke, unable to press F8 at any stage as suggested. Any help would be appreciated.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Would that system not boot at all and if it would not boot at all, how did you get rid of that software?

My customer's PC was in a continuous boot/BSOD/boot cycle. I broke this cycle by safe mode and then unticking "Automatically restart" in Startup and Recovery. Also in safe mode I could get the minidumps and feed them into BlueScreenView on my PC. Imagine my surprise when the stop was apparently the same as 3 that I remembered being reported on this forum the same day (31st May).

The last 4 minidumps all implicated RapportCerberus32_51755.sys so I found where it was located (only one place in the whole file system) and renamed its parent folder, which was...

C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline

Then I rebooted the PC in normal mode and there was no BSOD which was previously happening just after the desktop was displayed following (automatic) user logon.

I then installed Rapport (presumably the latest version, but maybe not fully patched) on one of my XP machines and there was no BSOD for several hours, including reboots. So I uninstalled and re-installed Rapport on my customer's PC and there was still no BSOD. I suppose that there may be an update which causes the problem not yet downloaded to my customer's PC, time will tell.

I will update this thread as and when I get more info from Trusteer. The customer now has his PC back and working, apparently none the worse for its recent trauma. But like I said, time will tell...

Tricky

EDIT (based on feedback from WAH99)

The Application Data folder mentioned above is hidden. The easiest way to get to be able to rename the baseline folder is...

Click Start
Click Run
Paste this bold text C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus into the run dialog box and hit enter

0 comments

49 additional answers

Anonymous

2013-06-05T18:00:00+00:00
Thanks to everyone on here who led me to the correct fix. I did get an email from rapport:

We would like to ask you to disable two of Rapport's components and see if the issue experienced is resolved.

To do this, please follow the instructions below (you may need to write them down before restarting):
1. Restart your PC
2. Start tapping the F8 key until the Windows Advanced Options Menu appears
3. Use the up and down arrows to ensure that the Safe Mode option is selected
4. Press Enter. The computer then begins to start in Safe Mode.
5. When Windows has finished loading, Open the 'Run' command by clicking Start > Run (or by pressing the 'Windows key' and 'R' key on your keyboard simultaneously).
6. In the Run window type: C:\Program Files\Trusteer\Rapport\bin
6.1) On 64-bit Windows please type: C:\Program Files (x86)\Trusteer\Rapport\bin\x64
1. Please access this folder and change the file RapportPG.sys to contain an underscore at the beginning (so it will be called "_RapportPG.sys")
2. Once again, click Start > Run (or "Windows Key" and "R")
3. In the Run window type:
Vista or Win7 users - C:\ProgramData\Trusteer\
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-05T13:02:05+00:00

Thanks for the clarification Denise.

Tricky
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-05T12:33:25+00:00

Sorry, should have supplied this information. I found the folder in the path you outlined in an earlier post

C:\Docs and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\Rapport Cerberus\baseline.

I also found (and renamed) the folder in the following:

C:\Docs and Settings\Default User\Application Data\Trusteer\Rapport\user\store\user

C:\Docs and Settings\Denise\Applicatin Data\Trusteer\Rapport\user\logs\store\temp\user

Like the instance you quote in your last post I don't have the RapportCerberus32_51755.sys file either but thankfully the renaming worked.

Again, many thanks for all your efforts.

Denise
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-05T11:04:13+00:00
I renamed the Rapport folder but so far not been able to get the PC working. Will need to look again tomorrow in case Trusteer/Rapport files are also located elsewhere. Frustrating!

In addition to my previous post, here is another thought. I have just tried this on one of my XP machines without any adverse effects, but it was done with the latest version of Rapport which

a) was not causing BSODs, and

b) might be different to your PC's version in other ways

In safe mode, rename these two folders...

C:\Program Files\Trusteer\Rapport

C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport

...for example to...

C:\Program Files\Trusteer**duff**Rapport

C:\Documents and Settings\All Users\Application Data\Trusteer**duff**Rapport

Once you have (hopefully) started in normal mode, you can rename them back to the original. Hopefully you should then be able to uninstall Rapport.

but so far not been able to get the PC working.

By this do you mean it is still giving the same BSOD? If not, can you elaborate?

Tricky

EDIT (based on feedback from WAH99)

The Application Data folder mentioned above is hidden. The easiest way to get to be able to rename the Rapport folder is...
- Click Start
- Click Run
- Paste this bold text C:\Documents and Settings\All Users\Application Data\Trusteer into the run dialog box and hit enter
Was this answer helpful?

0 comments No comments