Windows XP error on opening - Trusteer Rapport related

Had Windows XP for 10 years, but yesterday failed on opening; after opening Desktop, I got a blue screen & very long error message implies that hardware or software installations have failed. No hardware or software installations done for many months and was fine the day before. Error message reads:

A problem has been detected and windows has been shut down to prevent damage to your computer.

INVALID-PROCESS-ATTACH-ATTEMPT

If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation ask your hardware or software manufacturer for any Windows updates you might need.

 

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Start Up options, then select safe mode.

Technical Information:

***STOP: 0x00000005 (0x86E0A658, 0x86FC4830, 0x00000001, 0x86E19A90)


Had to unplug to switch off to restart, and then no response to any key stroke, unable to press F8 at any stage as suggested. Any help would be appreciated.
Answer
Answer
Would that system not boot at all and if it would not boot at all, how did you get rid of that software?

My customer's PC was in a continuous boot/BSOD/boot cycle. I broke this cycle by safe mode and then unticking "Automatically restart" in Startup and Recovery. Also in safe mode I could get the minidumps and feed them into BlueScreenView on my PC. Imagine my surprise when the stop was apparently the same as 3 that I remembered being reported on this forum the same day (31st May).

 

The last 4 minidumps all implicated RapportCerberus32_51755.sys so I found where it was located (only one place in the whole file system) and renamed its parent folder, which was...

C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline

 

Then I rebooted the PC in normal mode and there was no BSOD which was previously happening just after the desktop was displayed following (automatic) user logon.

 

I then installed Rapport (presumably the latest version, but maybe not fully patched) on one of my XP machines and there was no BSOD for several hours, including reboots. So I uninstalled and re-installed Rapport on my customer's PC and there was still no BSOD. I suppose that there may be an update which causes the problem not yet downloaded to my customer's PC, time will tell.

 

I will update this thread as and when I get more info from Trusteer. The customer now has his PC back and working, apparently none the worse for its recent trauma. But like I said, time will tell...

 

Tricky

 

EDIT (based on feedback from WAH99)

The Application Data folder mentioned above is hidden. The easiest way to get to be able to rename the baseline folder is...

  • Click Start
  • Click Run
  • Paste this bold text C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus into the run dialog box and hit enter

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

 
 

Question Info


Last updated October 12, 2018 Views 3,306 Applies to: