Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD & error message 'INVALID_PROCESS_ATTACH_ATTEMPT


  • Please log in to reply
15 replies to this topic

#1 Alex__M

Alex__M

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 31 May 2013 - 04:47 PM

Hi

 

I have a HP Compaq 6510b laptop with Windows XP Professional.  I have started getting the dreaded BSOD immediately as Windows starts up, with the error message mentioned above.  Also the following error message further down the screen:-

 

** STOP 0x00000005 (0x83D52020, 0x86FC43E0, 0x00000001, 0x83AFA020)

 

Initially the laptop would only flash the BSOD up for a second or two then restart, until I turned off the auto restart on failure. 

 

I've trawled though this forum and done lots of Google searches but cannot seem to find the answer.  I'm aware this can be some sort of hardware related problem however I have not downloaded/installed any new hardware or software in the last few weeks.  I recently changed from McAfee to Norton security but that was several weeks ago.

 

Any help would be greatly appreciated!

 

Thanks

Alex



BC AdBot (Login to Remove)

 


#2 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 01 June 2013 - 04:50 AM

Hi

 

Can you boot the laptop to safe mode ? .  If yes, please follow the below instructions.

 

1 ) Open C:\Windows\Minidump folder and look if there are any files with .dmp extension. Either copy all of them or zip the "Minidump" folder and upload it to a free file sharing site. For example http://www.mediafire.com/

 

  Analyzing those files are necessary to get a basic idea about what is wrong with the system.

 

2 ) Download MinitoolBox from  http://www.bleepingcomputer.com/download/minitoolbox/

 

     Run the tool and select only the following items.

  

     -List last 10 event viewer errors

 

     -List installed programs

   

     -List minidumps

 

     -List users, partition and memory size.

 

Click GO and  post the details in next reply.



#3 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 01 June 2013 - 10:48 AM

Hi

 

Thanks very much for helping me. 

 

I cannot seem to open Media Fire, is there another similar site I can use? 

***EDIT*** - I have now managed to sign up to Media Fire however having trouble uploading files, I think maybe because I am running in safe mode?  There are a total of 28 .dmp files in the minidump folder. 

 

I have run MiniTool, the report is below

 

 

MiniToolBox by Farbar  Version:21-04-2013
Ran by User1 (administrator) on 01-06-2013 at 16:46:51
Running from "C:\Documents and Settings\User1\Local Settings\Temporary Internet Files\Content.IE5\XSIEW8JA"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Network
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (05/28/2013 08:25:00 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (05/27/2013 09:47:50 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/27/2013 09:47:48 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/26/2013 09:15:55 PM) (Source: Application Error) (User: )
Description: Faulting application zclientm.exe, version 1.2.626.1, faulting module bckg.dll, version 1.2.626.1, fault address 0x00006532.
Processing media-specific event for [zclientm.exe!ws!]

Error: (05/18/2013 09:45:46 AM) (Source: Application Error) (User: )
Description: Faulting application ccSvcHst.exe, version 12.3.1.2, faulting module coDataPr.dll, version 2013.3.3.19, fault address 0x0005a3e4.
Processing media-specific event for [ccSvcHst.exe!ws!]

Error: (05/15/2013 09:44:04 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/15/2013 09:32:47 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/15/2013 09:32:44 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/15/2013 09:32:40 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (05/15/2013 09:32:24 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

System errors:
=============
Error: (06/01/2013 04:43:40 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx86
ccSet_N360
eeCtrl


Edited by Alex__M, 01 June 2013 - 11:00 AM.


#4 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 01 June 2013 - 11:57 AM

Hi

 

You can use 7 zip to compress the dump files to reduce size. Download 7zip from http://www.7-zip.org/download.html

 

after installing it, right click on the Minidump folder and choose 7-zip-->Add to archive.. . Now 7 zip window will open. Choose the output fie location and in the compression level setting, choose Ultra and press OK. 

 

You can also use other free file hosting sites. for example  https://www.box.com/

 

Also http://lifehacker.com/388284/best-online-file-sharing-services


Edited by Anshad Edavana, 01 June 2013 - 11:59 AM.


#5 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 01 June 2013 - 03:01 PM

OK I've uploaded the .dmp files to box.com.  Whats the best way to give you access to them? The link to the folder is :-

https://www.box.com/s/xxqwgam0jfscdmjicboz

 

Thanks



#6 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 02 June 2013 - 01:58 AM

Hi
 
Just completed a preliminary analysis of the dumps you posted. There are 28 crash dumps in total. While most of them shows third party drivers are the reason while some of them points to a possible disk error. Here is the quick summary of the analysis.
 
1 ) Majority of the dumps blames RapportCerberus32_51755.sys as the possible reason of the crash. This driver is developed by Trusteer Ltd and used by a number of online banking solutions and other security related softwares. Do you have an online banking software installed in the system ?. Another driver named rapportpg.sys blamed in one BSOD is also belongs to the same software.
 
2 ) A number of other dumps shows drivers related to Roxio and remnants of previous  MacAffee installation.
 
3 ) 6 dumps shows hard disk related STOP codes -
 
       A ) KERNEL_DATA_INPAGE_ERROR (7a)
            The requested page of kernel data could not be read in.  Typically caused by
             a bad block in the paging file or disk controller error.
 
       B ) KERNEL_STACK_INPAGE_ERROR (77)
            The requested page of kernel data could not be read in.  Caused by
             bad block in paging file or disk controller error.
 
       C ) NTFS_FILE_SYSTEM (24) . It blames Ntfs.sys which is a file system driver - points to the possibility of a failing HDD.
 
       D ) Unknown Error which blames  iAstore.sys  (disk controller driver )
 
 
From the dumps it is hard to say whether it is a hardware related or driver related issue. A step by step approach is required to find the exact reason. Since STOP codes shows disk related errors, we should start with diagnosing the hardware first. Follow the below steps.
 
1 ) Open Computer Setup by turning on or restarting the computer, and then pressing f10 while the "F10 = ROM Based Setup" message is displayed in the lower-left corner of the screen.
 
2 ) Navigate to the Diagnostics tab using arrow keys. There you will see option to check hard disk and memory.  Run a full diagnostics on both. Post result of the test.
 
3 ) If the HDD and RAM tests are passed (run extended test if available), reboot the system in to Safe mode with networking. We need to collect a list of installed programs in your system before start any software repair attempt. To do that follow the below steps.
 
  a ) Run Minitoolbox again and select only List installed programs tick box. Run the tool and post the result.
 
  b ) Download CCleaner from http://www.piriform.com/ccleaner
  
         1.    In CCleaner, click the Tools icon at left.
         2.    In the Uninstall screen, click the Save to text file... button.
         3.    Choose a location and type a name for the text file (the default is install.txt), and then click Save.
     Upload both CCleaner install.txt and Minitoolbox result.txt in next reply.
 
 
 


Edited by Anshad Edavana, 02 June 2013 - 04:55 AM.


#7 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 02 June 2013 - 03:37 AM

OK, I have run the memory test which was passed.  However with the HDD test, at first I get a message saying it should take around 52 minutes to complete, but then when I run the test after about 15 seconds a get a message saying there has been an error and the search is aborted. 

 

I did install Rapport software sometime ago, however I very rarely use this laptop for online banking so I can just remove this software if that may help?  Also I never use Roxio so could just remove this as well if that would help.

 

Thanks again for your help so far. 



#8 tricky300

tricky300

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 02 June 2013 - 04:35 AM

IMO this is definitley related to Rapport. See...

http://answers.microsoft.com/en-us/windows/forum/windows_xp-system/windows-xp-error-on-opening/6cb21940-66c6-4390-924d-ff78288e32c2

...for details.

 

Tricky



#9 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 02 June 2013 - 04:52 AM

Hi

 

That is bad news  :huh:  . Failure to complete the hard disk test indicates bad sectors in the HDD surface. At this point i suspect a combination of hardware and software issue. That is you are receiving two types  of blue screens. One due to the faulty RapportCerberus32_51755.sys driver and other due to the possibly failing hard disk. Do the following steps.

 

1 ) We need to test your hard disk thoroughly. Download Seagate Seatool For DOS from http://www.seagate.com/support/downloads/item/seatools-dos-master/

 

    Burn the ISO to a blank CD using "image to Disc" option. Refer http://knowledge.seagate.com/articles/en_US/FAQ/201431en . You can use any ISO burning tool like Imgburn or ISORecorder

 

http://www.softpedia.com/get/PORTABLE-SOFTWARE/CD-DVD-Tools/Windows-Portable-Applications-Portable-ImgBurn.shtml

 

 

2 )Boot from the CD and run a "long test" with Seatool. Report the output shown by Seatool and we will proceed to the next step.


Edited by Anshad Edavana, 02 June 2013 - 04:52 AM.


#10 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 02 June 2013 - 12:02 PM

OK, thanks for your help so far.  I dont have any blank CDs at home but will swipe some from work tomorrow and try and run the Seatool test!

 

Thanks again



#11 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 02 June 2013 - 12:11 PM

Hi

 

I will be around  :thumbup2:  .

 

Trying to repair OS without fixing the hardware is pointless. That is why we are testing the health of your HDD and RAM in the first place.

 

BTW - There is a way to create a bootable USB flash drive with Seatool. Read this link : http://www.megaleecher.net/Seagate_SeaTools_For_DOS_Bootable_USB_Maker_Kit

 

I didn't personally tested it yet, but looks like a working solution. Your laptop should support booting from USB. Read the instructions about changing boot order and check if your system supports boot from removable media.

 

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&taskId=115&prodSeriesId=3368537&prodTypeId=321957&objectID=c00364979


Edited by Anshad Edavana, 02 June 2013 - 12:15 PM.


#12 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 03 June 2013 - 04:22 PM

OK, I have completed the Seatool test although I don't think this was very succesfull!  The test ran for about an hour, then I recieved a series of error messages at the end. 

 

The first message was titled 'Long Test Errors' and stated the following:-

"Your Seagate hard drive has failed an important diagnostic test, possibly caused by problem sectors which are difficult to read'.

 

The second message was just a very short message stating that errors were detected on a non-seagate drive, and suggesting I contact the maker of the disk drive.

 

The third and final message was titled 'Sector Repair Failure' stating that a repair was unsuccesful on the hard drive. 

 

Is there some way I can export the results of the search from Seatool so I can post it here?

 



#13 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:07:42 AM

Posted 03 June 2013 - 11:11 PM

Hi Alex_M

 

Your hard disk have serious bad sectors in the surface. In case you don't know, a sector is the smallest portion of the storage space. Each hard disk's storage space will be divided to millions of sectors each one is 512 bytes in size.

 

http://en.wikipedia.org/wiki/Disk_sector

 

A bad sector is a sector that cannot be used due to permanent damage such as physical damage to the disk surface (or sometimes sectors being stuck in a magnetic or digital state that cannot be reversed)

 

Even a single bad sector means the drive is failed. From the seatool output it seems that your HDD had developed serious bad sectors which can't be repaired. You should replace the hard disk immediately. Using that HDD will put your data in danger.

 

Bad sectors in the HDD caused instability and that is the real reason behind the blue screens.  You can replace the hard disk yourself. It can be accessed via removing a small cover in the bottom. Refer page 50 of the service manual if you are in doubt.

 

http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c01566982/c01566982.pdf



#14 tricky300

tricky300

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 04 June 2013 - 02:56 AM

The STOP 0x00000005 errors are not related to the problems that you are having with your disk. However, they are probably an irrelevance if you are going to get a new disk and re-install everything.

 

They are definitely associated with Trusteer's Rapport. Trusteer themselves have acknowledged this.


Edited by tricky300, 04 June 2013 - 04:10 AM.


#15 Alex__M

Alex__M
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:12 AM

Posted 04 June 2013 - 03:15 AM

OK Anshad & Tricky, thank you both for your help.  I will look into getting a new disk drive.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users