HP Probook 6555b memory error upon login

[Jarrod Mochnick]

Hey everyone, I'd like to start off by thanking you for taking the time to read this. A laptop was brought to me last Friday afternoon that had a problem. Upon logging in, an error would come up saying 'Instruction @ 0x774024d referenced memory at 0x00000014. Memory couldn't be written.' The prompt's title was 'Werfault.exe'. Once you click okay, another error shows up, with an error along the lines of 'exception unknown, software exception. 0x40000014 occured in app location 0x0139183.' After that, another error pops up, an error along the lines 0x7623ea5c referenced 0x0000000c memory couldn't be read.'

I ran multiple virus scans and nothing came up. I looked for suspicious programs that may have been recently installed and the only one was 'Settings Alerter'. I googled what it was, and it seems as if it is safe but just bloatware. Then, during one of the restarts, Windows asked if I'd like to run a chkdsk. I ran it, and the laptop worked fine.

I returned the laptop to the owner and this morning it has the same issue. She said all of Monday it worked perfectly fine, then when she logged in today it happened. I have logged in on multiple accounts since then and they have worked for the most part, except one time I randomly got the 'no logon server' error. I am positive this is still an issue despite being able to log in fine a few times because when I went to pick up the laptop, she left the error up and I saw it for myself.

Any ideas on what the issue could be?

Thanks!

EDIT: I checked the event log and I noticed a recurring error of 'Group Policy', 'Service Control Manager', and 'DistributedCOM'. The service control manager often comes with the message of 'The M86 Security Authenticator service terminated unexpectedly. It has done this 1 time(s). The following corrective action will take place in 0 milliseconds: Restart the service.'. The 'DistributedCOM' shows the message 'THe application-specific permission settings do not grant Local Launch permission for the COM Server application with CSLID (24FF4FDC-1D9F-4195-8C79-0DA39248FF48) and AppID (B292921D-AF50-400C-9B75-0C57A7F29BA1) to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tools.' Hope this provides more information!

 

[zdbc13]

run memtest86 for a while to make sure the "memory" isn't bad. Did you run malwarebytes when you were checking for viruses? It picks up things others miss. If the hardware checks out you may have to re-load the factory default image and start over. Back up her data first.