Sunday, 16 October 2011

Trusteer Rapport Problems


Over the past month or so I have had half-a-dozen PCs in with serious problems which turned out to be caused by Trusteer Rapport. Now, fixing PCs is what I do for a living so I guess I shouldn't complain that all the online banks who promote Rapport are generating work for me. Nevertheless, it just seems wrong that a product which is supposed to protect people ends up stopping them using their computers. Anyway, a lot of my customers I have known for years and I hate to see their time and money wasted.

Half of the crippled PCs simply wouldn't start at all: windows was just giving a BSOD (Blue Screen Of Death) and promptly rebooting. The other half started okay but Internet Explorer wouldn't run. These are, of course, typical virus symptoms, so I wasted time (and money) running thorough virus checks.

The BSOD machines would start in Safe Mode so, once viruses were ruled out, I was able to load a tool I use which tells me which drivers have crashed the system. Once I had identified that the drivers causing problems had names like 'rapportxx' I was able to rename all Rapport drivers and so start Windows properly. After that I restored the driver names and (without rebooting) uninstalled Rapport. Problem solved, and I simply added a note to the invoice to tell the customer what the problem was and suggesting that, if they believe Rapport to be useful protection, they should talk to their bank to download a fresh copy from scratch.

In the cases where Internet Explorer wouldn't run, once I had eliminated the thousand and one other causes of IE problems, I was able to find a FAQ entry on the Trusteer website telling me what to do in that situation - quite how anyone is meant to find that FAQ when their internet browser isn't working is another matter. The FAQ tells us to start Rapport Console (a program in the Start/All Programs list), to burrow deep into its settings to find the one which is about protecting Rapport from tampering, and to turn it off. Hey presto, the internet is back. The fact that there is a FAQ entry there implies that this is not an uncommon problem; the fact that Rapport fails to give any error messages as it disables Internet Explorer implies that people are unlikely to look at the Trusteer website for their FAQ because they wouldn't know they need to.

If Rapport was just another piece of Internet Security software, chosen and installed by the users themselves, these problems wouldn't be so bad - all software has its issues and antivirus programs in particular are inclined to go wrong, because they are always on the frontline of the battle against the bad guys trying to use our PCs to steal money. But Trusteer Rapport is not just another security program: it is very heavily pushed by the internet banks onto users who are not technologically savvy and who believe what their banks tell them. Those banks should not be promoting software which doesn't have the quality control in place to avoid breaking users' PCs and/or disabling their internet access, particularly when it does not even give clues that it is Rapport doing the breaking.

The first couple of Trusteer Rapport problems I encountered, I just assumed that they had released a duff update and it was a one-off. Now I am suggesting to customers that they might want to have a word with their bank to find out just why they are promoting software which is costing said customers time and money by breaking their computers.

37 comments:

  1. Thanks BlackPhi for this info.. i was at my bank site and they suggested i download rapport,, being i'm really leary of a bank giving away something for free and also my concern of the internet and my money,i did a google search on the product and came to your site.I won't be downloading until i see a note on my bank site saying it's safe and they will guarantee it .

    ReplyDelete
  2. To be fair, I haven't seen any Rapport problems for a couple of months now. Nevertheless, I don't have it installed on my main PC, and don't intend to do so, as I really don't trust them that far (but then I do trust my other layers of virus protection, and Rapport is mostly aimed at those who are not so well protected).

    ReplyDelete
  3. What's the setting that you have to change? I've got a user with the problem. She's logged onto our bank site and it requires this to be installed before it will let you in. Once it's installed, IE 8 will not start. It just starts and then closes out. Firefox will start, but then other sites won't pull up popups and such. I went into the security policy of Rapport and set everything to never, but then the bank site acts as though Rapport isn't installed and you're back to square one. I need a link the FAQ or just an answer. Thank you.

    ReplyDelete
  4. I have to say that if I had a bank who refused to give me online access to my account unless I had a piece of third-party software installed which is known to cause problems for some users then I would be looking for another bank.

    However, to answer your question: the setting I changed was described at http://www.trusteer.com/support/en/solve-issue# under the heading 'I cannot connect to the Internet - my browser does not work'.

    Basically it says:-

    1. Open Rapport Console:

    a. Click the Rapport icon, located next to the browser's address bar, and then click "Open Console", or

    b. Click Start -> All Programs -> Trusteer Rapport -> Rapport Console

    2. Change the policy by following these steps:

    a. At the bottom of the console there is a green right arrow - click it

    b. Click "Edit Policy"

    c. Enter the letters as they are shown in the image and then click OK.

    d. Find "Protect Rapport from Unauthorized Removal " (11th row)

    e. Next to "Protect Rapport from Unauthorized Removal ", Click the drop down menu and choose "Never"

    f. Click "Save"

    3. Reboot your computer

    ReplyDelete
  5. Hi,

    I'm having problems with this (or at least I think I am). I've tried the fix above but no joy. The Console won;t even open. How can I get in touch so I can bring my computer in for you to take a look?

    Thanks,
    Matt

    ReplyDelete
  6. Hi Matt. Assuming you live in or near to Caversham/Reading, then give me a ring on 0118-9479395 and we can arrange a time.

    Cheers,
    Phil

    ReplyDelete
  7. Perfect, thanks!

    ReplyDelete
  8. I had the same problems, starting in February 2013. I had had rapport (from NatWest) running perfectly well for a year or so before this. I had never had the blue-screen crash before, so I was seriously disconcerted. Every time I did a system restore, Rapport kept reinstalling itself. Eventually I went into programmes and deleted any reference to Rapport, and have had no probs since. Interestingly I notified Trusteer about this and they denied there was any chance of their software causing my problems!

    ReplyDelete
  9. If in doubt, deny everything.

    To be fair, we live in an age when a frank comment can go around the world in minutes. I suspect the banks - nice people that they are - would drop them in a second if they thought their own bottom lines were threatened.

    It is disappointing that Rapport problems are back though. Hopefully this time it'll be a one-off and they'll get the problem fixed immediately, rather than taking months to get a grip, like last time.

    ReplyDelete
  10. BSOD and continual auto-re-boot last week. My computer whizz kid has just phoned to say: "Rapport" . It has been installed since first release without problem. I'll notify Trusteer and my bank - perhaps they will pay the bill !

    ReplyDelete
  11. You never know! I'm now getting more PCs in with Rapport problems too, so they clearly haven't sorted their update testing. I don't object so much to things going wrong, that's the nature of frequently updated software, what I do hate is the way that it cripples your PC when it does go wrong. There's no graceful failover at all.

    If you can get into Windows at all, then remove and reinstall seems to work with current problems. Assuming you want to put the troublesome software back, of course - although I have been told some banks insist on you having it before they'll let you use their online banking.

    ReplyDelete
  12. The problem I have seen today is with the newest version of Trusteer Endpoint Protection using all available RAM when IE9 starts on a Vista system with McAfee Security Centre 11.6.

    This problem goes away if the McAfee Site Advisor addon is disabled in IE.

    ReplyDelete
  13. They're probably both trying to intercept the same calls and failing to handle it. Another example of a design that cannot cope with the unexpected. I'll keep my eyes open for that one, thanks.

    ReplyDelete
  14. I never had any major problems with Rapport other than the icon disappearing from the address bar after an update in Firefox. A reinstall always fixes the problem.

    ReplyDelete
  15. Another possible Rapport issue is getting a blank screen for 5-10 seconds when switching users on a machine (see http://www.bleepingcomputer.com/forums/t/502501/black-screen-when-switching-users/). Have you also seen this problem? Any solutions?!
    Thanks.

    ReplyDelete
    Replies
    1. To update this - I was experiencing 22-24 sec of black screen when logging off (after the 'Logging off...' prompt appeared, to when the list of users appeared) or switching users. I just uninstalled Trusteer and there is now just a momentary pause of less than a second! So this was definitely caused by Trusteer Rapport in some way.

      Delete
  16. Hi Ian. Trusteer can be quite aggressive in protecting itself - for example, as the bleepingcomputer conversation illustrates, it refuses to turn off for a clean boot. It is possible that it is refusing to shut down cleanly for a log off/switch.

    Sometimes I have found that uninstalling then reinstalling helps with Trusteer problems: they seem to be quite slow rolling updates out, including fixes. Otherwise, if you really want to keep the product installed, you could try their support system: see http://www.trusteer.com/support/troubleshooting.

    Or, unless your bank is stroppy about it, you could leave Rapport uninstalled and use an antivirus that checks websites (and/or just make sure you always enter your bank's website address yourself, rather than using a dodgy link from an email or mistyped search).

    ReplyDelete
  17. Hi,
    I also fix computers for a living, and over the past two years, I must have forcibly remove Rapport from about 30 computers due to the problems you have detailed.
    It normally seems to coincide with an entry in the System Restore that Rapport has just done an update.
    Rapport do have a removal tool that you can download, should you only be able to gain access to Safe Mode.
    Regards,

    ReplyDelete
  18. Hi Darren.
    Yes, I too am pretty sure it is updates that cause the problems. Basically their testing process isn't up to scratch. Other a/v products have also had problems over the years, but Trusteer appear to me to have an architecture which leaves it far too likely to trash the PC when something goes wrong.
    Thanks for the info on the removal tool, although I see that even this is a pain to get at: at present, you have to fill in a form to request a link to get it (see rapport.trusteer.com/installer/troubleshoot_uninstall). IMO this is really shoddy.
    Cheers,
    BlackPhi

    ReplyDelete
  19. I finally installed this. Thought since the bank recommended it I would be OK. Firefox screen started going black when a page was loading, sometimes it would come back, sometimes it would stay black, then intermittent freezing, finally Firefox would crash. I work with my computer and was visiting the same web pages I do every day. I am not very computer savy, but it seemed this program was using so much ram that there was not enough to run all programs. I used their uninstall tool to remove it, and the black screens, freezing and crashing immediately stopped, but now many safe webpages will not load in Firefox and I am forced to use chrome for work.. Very big mistake installing this..Jim

    ReplyDelete
  20. It is very difficult when your bank recommends something to ignore that recommendation.

    I would recommend that (if you haven't already) you do a full system scan with a trustworthy and up-to-date anti-virus program ... just in case. Note that most anti-virus programs have an upgraded version released every year, and most of them are NOT updated automatically for this. Many of them have a year in the title, so you can tell; Norton requires that you find the option to 'Check for new version'. If you download such an upgrade, watch out for attempts to up-sell you to a more expensive option.

    It may be worth trying a 'reset' on Firefox to see if that clears the problem, see https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems .

    ReplyDelete
  21. Had Rapport (from Barclays, I think) for some time with no problems. But have just had week of computer hell, unable to add attachments to emails or download images to website I'm responsible for. Everything just froze. BSOD, which I'd never seen before, came up umpteen times. System Restore showed Rapport updates/reinstalls at every problem moment. Doing complete uninstall (using Revo Uninstaller to get rid -- I hope -- of all the awkward bits that otherwise linger) has worked a treat.

    ReplyDelete
  22. DO NOT INSTALL this software. It will slow down your computer and worse, it will crash and crash and crash...

    ReplyDelete
  23. Had Rapport for some time without a problem. Updated my Firefox browser and now Rapport will not work. Contacted the company and they were unable to help so I have deleted the program. There are masses of registry entries to get rid of. I suggest you do not download this piece of crap!

    ReplyDelete
  24. I think I have had the same problem - I can't even open Trusteer websites to find the solution. It has affected Chrome and IE11.

    ReplyDelete
    Replies
    1. I suggest uninstalling Trusteer Rapport, then you have a choice of reinstalling their latest version or making sure you have a paid-for security solution which includes online banking protection - Kaspersky Internet Security springs to mind.

      Delete
  25. This product has caused me grief under windows xp and now windows 8.1 stay far away unless you want to spend countless hours fixing things.

    ReplyDelete
  26. I have just uninstalled Rapport from a customers machine (they had put it on at the banks request)

    It was causing eventid 41's (which is related to power). Havinb spent a couple of days chasing that with diags I noticed rapport installed recently and removing it has stopped the PC rebooting

    ReplyDelete
  27. In my view that is one of the worst things about Rapport (or even 'Trusteer Endpoint Protection' as it now seems to be calling itself): the symptoms never sensibly relate to the Rapport drivers which cause the problem. Troubleshooting becomes a nightmare.

    ReplyDelete
  28. Just ran into this myself - what absolutely terrible software. My customer unwittingly installed it, and it immediately killed their Kaspersky a/v and slowed down the computer. Then they called me this morning after getting a message about an ianywhere service crashing. I checked and saw that this Trusteer Endpoint Protection had been installed a couple days ago, did a quick Google search to find this article and promptly uninstalled this crap.

    The uninstall was horrible, too - I was using a remote Teamviewer connection and was actually locked out while the user had to manually enter a code to shut down the Trusteer service. Teamviewer never gets locked out, even with Windows UAC messages. What absolutely floored me, though, was at the end of the uninstall process, when the message popped up pleading with me to not uninstall if the computer or Internet browser had stopped working, and that Trusteer tech support would help fix the problem for free. Truly unbelievable! This article was published in 2011, and talks about the same problems that my customer is having 3 years later. So instead of fixing the problem they made a conscious decision to leave the broken software broken and instead devote resources to band-aiding the issue after causing people problems. This company should be shut down.

    ReplyDelete
  29. Thank the Lord I have been justified by this article. Back in July when Firefox updated to V31 or whatever I had also purchased a new Epson XP600 printer and installed it. The problem was almost instantaneous,BSOD - 0x7F !
    Explanation "recently installed hardware and/or drivers", needless to recount the number of re-installs and software removals/regedits/and msconfig exercises I have performed in the last 6 weeks, meticulously avoiding circumventing my security.Three days ago I bit the bullet and as there was almost nothing else to remove I began by uninstalling (c)Rapport.
    Since doing so my (XP) startup time is now back to 30 seconds or so, I have no issues with missing 'services' items, at one stage I was unable to get at the "Start -> Run" box nor "System Restore" except from safe mode ? I had trusted this software fo 4 years and looking back it has gotten slower for a good many months before bringing these problems to my door. I have wasted 50 to 60 hours removing hardware and software and waiting up to 11 minutes for access from restarts. This is a piece of crap software that I will now refer to as CRAPPORT ! Good riddance.

    ReplyDelete
  30. I think one of the biggest problems with Trusteer (they seem to be calling the product Trusteer Endpoint more these days - maybe other people are adding that 'c' :) ) is how unclear it is when it does cause problems. I am getting fewer bricked PCs caused by Trusteer these days, but many more with mysterious performance issues which go away when it is removed. But I have yet to find an indicator which shows that Trusteer is the culprit - there are also many PCs where Trusteer is working fine, and no obvious difference. It is a real time waster!

    ReplyDelete
    Replies
    1. I started having issues with my laptop immediately after August's Patch Tuesday. IE11 was locking regularly as was windows Explorer, I could not start programmes from desktop or start menu shortcuts and right click would not work. I could only get online or start programmes in Safe Mode.

      I went through removing then reinstalling all the updates to Windows one by one trying to isolate the update responsible without joy. From Control Panel uninstall program list i discoverd Trusteer Rapport had updated itself that same day. i had been using the previous version without problem for several months.

      Anyway I went to a local shop and had my laptop wiped and Windows reinstalled. While going through the process of recovering all my data and reinstalling each program one by one I recreated the problem when I reinstalled Trusteer Rapport from the current download version.

      It is now off my laptop and will never return!!!!!

      Delete
  31. Yehouda Harpaz1 November 2014 23:08

    I just had a second BSOD in 9 days. In both cases it mentioned repportcerebrussXX in the message. After the first crash I tried to disable the service (unsuccessfully). After the second today I uninstalled it.

    At least the word rapport appeared in the error message (I think it was actually the name of the driver that the crash occurred in).

    I got it because Natwest recommended it.

    ReplyDelete
  32. That's a pity: it had seemed that there were fewer BSOD problems these days, with performance issues being more common. Evidently the drivers are still not fully stable; although I suppose it is helpful (kind of) that the rapport name is visible on the BSOD.

    ReplyDelete
  33. Just had to remove this programme from my wife's laptop after several days of problems resulting in BSOD every time I tried to boot the laptop up.

    Rapport came up as cause, started in safe mode and managed to remove rapport now starting fine, what a crap programme.

    This is second time my daughter has installed this and second time I've had to remove it, she only installed it because the bank pressured her into installing it, she was told that without it she may not ne covered for internet fraud, going to enjoy having a go at my bank.

    ReplyDelete