Windows XP error on opening - Trusteer Rapport related

Anonymous

Had Windows XP for 10 years, but yesterday failed on opening; after opening Desktop, I got a blue screen & very long error message implies that hardware or software installations have failed. No hardware or software installations done for many months and was fine the day before. Error message reads:

A problem has been detected and windows has been shut down to prevent damage to your computer.

INVALID-PROCESS-ATTACH-ATTEMPT

If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Start Up options, then select safe mode.

Technical Information:

***STOP: 0x00000005 (0x86E0A658, 0x86FC4830, 0x00000001, 0x86E19A90)

Had to unplug to switch off to restart, and then no response to any key stroke, unable to press F8 at any stage as suggested. Any help would be appreciated.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Would that system not boot at all and if it would not boot at all, how did you get rid of that software?

My customer's PC was in a continuous boot/BSOD/boot cycle. I broke this cycle by safe mode and then unticking "Automatically restart" in Startup and Recovery. Also in safe mode I could get the minidumps and feed them into BlueScreenView on my PC. Imagine my surprise when the stop was apparently the same as 3 that I remembered being reported on this forum the same day (31st May).

The last 4 minidumps all implicated RapportCerberus32_51755.sys so I found where it was located (only one place in the whole file system) and renamed its parent folder, which was...

C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline

Then I rebooted the PC in normal mode and there was no BSOD which was previously happening just after the desktop was displayed following (automatic) user logon.

I then installed Rapport (presumably the latest version, but maybe not fully patched) on one of my XP machines and there was no BSOD for several hours, including reboots. So I uninstalled and re-installed Rapport on my customer's PC and there was still no BSOD. I suppose that there may be an update which causes the problem not yet downloaded to my customer's PC, time will tell.

I will update this thread as and when I get more info from Trusteer. The customer now has his PC back and working, apparently none the worse for its recent trauma. But like I said, time will tell...

Tricky

EDIT (based on feedback from WAH99)

The Application Data folder mentioned above is hidden. The easiest way to get to be able to rename the baseline folder is...

Click Start
Click Run
Paste this bold text C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus into the run dialog box and hit enter

0 comments

49 additional answers

Anonymous

2013-06-02T18:25:26+00:00

It is not recommended to disable Rapport's drivers as it affects your protection.

If you are still encountering issues, we would like to run a remote access session where we can investigate it happening in real-time

The trouble is that without disabling Rapport's drivers you cannot get the PC working to provide a remote access session, except perhaps safe mode with networking, but how many users do you think are capable of understanding this?

Also, If their PC is stuck in a BSOD/boot/BSOD loop, they might not even be able to find this thread or others like it.

What are you going to do about the countless PCs that are now rendered unbootable by normal means and whose owners haven't got a clue why, let alone the means of finding out what is wrong? (Rhetorical question, I already know the answer). I believe that what we are seeing on this forum is the tip of the iceberg, or an even smaller %. I have seen one report of a single repair facility that fixed 5 PCs afflicted this way in one day.

My experience of people who have Rapport installed is that they don't even remember or know when or how it got on their PCs or even what it is for.

Tricky
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-02T14:31:04+00:00
Dear customers,

We are glad to inform you that this issue with Rapport has been resolved in the latest version.

The update should have taken place automatically, in order to confirm this please try manually checking for Rapport updates:
1. Open the Rapport console (Start > Programs > Trusteer Rapport > Rapport console)
2. Click "More settings"
3. Click "Check for updates"
4. The update status should appear on the bottom in blue letters
5. Restart your computer
It is not recommended to disable Rapport's drivers as it affects your protection.

If you are still encountering issues, we would like to run a remote access session where we can investigate it happening in real-time.

You may contact us at ******@trusteer.com.

Thank you for your cooperation.

Sincerely,

Trusteer's Technical Support
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-02T13:06:27+00:00

When will they send your consultation fee?

You should at least get a hat or T-shirt or something!

I have ~150 hats.

Today I am wearing my Elo T-shirt (gets me in the right frame of mind to work on their stuff).
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-02T12:42:38+00:00

if you install the latest version and/or updates you should be alright.
Was this answer helpful?

0 comments No comments