BSOD with IRQL_NOT_LESS_OR_EQUAL Windows XP

[tudort]

I am encountering BSOD with the following message (see attached minidump also)

STOP: 0X0000000A(0X00000054,0X0000001C,0X00000001,0X805022D0)

This happened after I tried to increase disk performance by following recommendations in
petri.co.il/increase_hard_disk_speed_in_windows_xp_2003.htm

to increase hard disk cache as my system has 1G of RAM

Safe boot up still works

I have tried the following with no success
1. reversing the change to increase the cache size described above
2. using "last known good config"
3. restoring to previous restore points (tried various dates)
4. I have checked the memory and hard disk using the BIOS's checking utility with no errors reported

Can you help? I have no detailed computer knowledge
Thanks.

 

[Mark56]

Do you recall installing new software or updating software on the 12th June. There is an unknown driver named rapportcerberus32_27897.sys blamed for this BSOD. I can't find any report on it being Malware but it sure looks suspicious, Rapport is security software from Natwest so may be it is connected to that or it is unknown Malware that is targeting it.

One other thing, your system is not up to date with critical updates from Microsoft. You are still on service pack 2 which is no longer supported by Microsoft you should turn on Windows Update and get it updated or you are wide open to attack.

 

[tudort]

request for more information

Hi Mark,

Many thanks for your help in this.

Rapport is installed so maybe the issue.

What should I do?

Run up in safe mode and de-install
check list of drivers to see if removed
try full windows boot-up?

Many thanks

 

[Mark56]

Hi, I have just found the same file in another BSOD on the Techguy forum. I have put in a thread on their Malware forum to see if the Malware experts know anything about this file.

To solve your problem I would use System Restore to go back before the file was installed and stop the Rapport software from running automatic updates. There is a risk it did not come from NatWest so be aware. I am sure if this is a risk or a bad update NatWest will produce further updates to corect the problem, may be a quick phone call will get some answers.

I suspect I will be seeing a few more of these.

 

[tudort]

BSOD reponse

Hi MArk,
Thanks for the help
I tried restoring 2months before the 12 of June with no success
I did manage to get full windows going by removing rapport files from the \windows\system32\ subdirectory.
Up to this point I have only been able to boot up in safe mode.

However the BSOD returned when I opened Google chrome.

I also ran a MAlware scan with no infections found.

Thanks,
Tudor

 

[Mark56]

Please post the new BSOD

 

[tudort]

same BSOD

Hi MArk,

I have tried to re-create exactly the same boot-up scenario with BSOD happening on startup of chrome browser

Instead of getting this I get the same BSOD and STOP codes described earlier in the original post

However the bootup does carry on further than before and ends in a BSOD after the desktop icons have come on screen but before I get a chance to run anything.

I attach the latest minidump

Thanks again
TT

 

[Mark56]

This crash is still naming the Rapport file. I would try uninstalling the Rapport software completely.

I see several links to people having problems with uninstalling this software, this one sounds like a good solution, hope it helps.

http://www.computing.net/answers/security/surest-way-to-uninstall-rapport-from-trusteer/31287.html

 

[tudort]

getting there

Hi Mark,
Success?

I did not have success when I suspended Rapport

I had to delete 40 odd entries and sub-keys in the registry mentioning trusteer and rapport

I got the following error codes on booting up appearing in a splash with the statement "windows has recovered after a serious error": codes

BCCode : 1000000a BCP1 : 00000054 BCP2 : 0000001C BCP3 : 00000001
BCP4 : 805022D0 OSVer : 5_1_2600 SP : 2_0 Product : 256_1


This report happened about 20times before stopping

I hope this is the end of it.

Thanks very much for the help

Tudor

 

[Mark56]

Sounds like you have done a good job, fingers crossed there are no further problems.