Help! DEP vs. Windows Explorer; DEP is winning
-
Folks, Recently I've been getting these popup windows saying Windows Data Execution Prevention has intercepted an attempt by an executable to access reserved memory. The program is Windows Explorer! This is getting very annoying, as it then resets my desktop, sometimes even removing the taskbar! (Try shutting down or logging off without it.) I've searched the usual places, but cannot find anything very informative so I now turn to you, the CP wizards! Any ideas? 'til next we type... HAVE FUN!! -- Jesse
Most likely it's an explorer extension that's causing the problem, not explorer itself. I think there are some tools out there to enumerate what explorer extensions you've got installed. Not sure offhand. ---------------------------------------- ----I said my name wasn't important ---------------------------SlartiBartFast
-
Install that WMF patch yet?
---- Scripts i've known... CPhog 0.9.9 - make CP better. Forum Bookmark 0.2.1 - bookmark forum posts on Pensieve Print forum 0.1.2 - printer-friendly forums
Shog9 wrote:
Install that WMF patch yet?
Not manually. Are you implying this behavior is due to being infected by WMF? Or is this from the patch you mention. 'til next we type... HAVE FUN!! -- Jesse
-
Folks, Recently I've been getting these popup windows saying Windows Data Execution Prevention has intercepted an attempt by an executable to access reserved memory. The program is Windows Explorer! This is getting very annoying, as it then resets my desktop, sometimes even removing the taskbar! (Try shutting down or logging off without it.) I've searched the usual places, but cannot find anything very informative so I now turn to you, the CP wizards! Any ideas? 'til next we type... HAVE FUN!! -- Jesse
Jesse Evans wrote:
as it then resets my desktop, sometimes even removing the taskbar!
in the event this does happen, I'd also go to TaskManager, kill the explorer.exe process, then run it to re-start it. This should help with the taskbar My articles BlackDice
-
Shog9 wrote:
Install that WMF patch yet?
Not manually. Are you implying this behavior is due to being infected by WMF? Or is this from the patch you mention. 'til next we type... HAVE FUN!! -- Jesse
Jesse Evans wrote:
Are you implying this behavior is due to being infected by WMF?
The WMF vulnerability would cause such effects, i believe. Not saying that's what's going on... just the same, it wouldn't be a bad idea to install the patch.
---- Scripts i've known... CPhog 0.9.9 - make CP better. Forum Bookmark 0.2.1 - bookmark forum posts on Pensieve Print forum 0.1.2 - printer-friendly forums
-
Folks, Recently I've been getting these popup windows saying Windows Data Execution Prevention has intercepted an attempt by an executable to access reserved memory. The program is Windows Explorer! This is getting very annoying, as it then resets my desktop, sometimes even removing the taskbar! (Try shutting down or logging off without it.) I've searched the usual places, but cannot find anything very informative so I now turn to you, the CP wizards! Any ideas? 'til next we type... HAVE FUN!! -- Jesse
I assume you have an AMD 64 processor or similar (I have the X2 4800+ for example). I came across the same issue, and it was due to a DLL produced by Pinnacle to create thumbnails when using XP Explorer in Thumbnail view. You can set how XP (SP2) handles this through the control panel, i.e. you can say apply to all applications apart from windows explorer (however the DEP is still generated using the standard file open dialog in thumbnail mode). I uninstalled the Pinnacle software and no longer have the issue (Pinnacle were not exactly helpful, and have no plans on bringing out a version of the DLL that does not cause this error). Gary Flickr Photos[^]
-
I assume you have an AMD 64 processor or similar (I have the X2 4800+ for example). I came across the same issue, and it was due to a DLL produced by Pinnacle to create thumbnails when using XP Explorer in Thumbnail view. You can set how XP (SP2) handles this through the control panel, i.e. you can say apply to all applications apart from windows explorer (however the DEP is still generated using the standard file open dialog in thumbnail mode). I uninstalled the Pinnacle software and no longer have the issue (Pinnacle were not exactly helpful, and have no plans on bringing out a version of the DLL that does not cause this error). Gary Flickr Photos[^]
Gary, Interesting! I started getting this error after purusing some image folders in thumbnail view, so I may be having the same problem you were. Is this dll from Pinnacle part of the XP system? I don't recognise the name, so I'm pretty sure it's not something I installed myself. My system has an AMD Athlon XP 3000+ processor (32-bit). Anywho, what's the name of the Pinnacle dll? 'til next we type... HAVE FUN!! -- Jesse
-
Most likely it's an explorer extension that's causing the problem, not explorer itself. I think there are some tools out there to enumerate what explorer extensions you've got installed. Not sure offhand. ---------------------------------------- ----I said my name wasn't important ---------------------------SlartiBartFast
If I remember right, the Microsoft Anti-Spyware beta does this. John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek. -
Gary, Interesting! I started getting this error after purusing some image folders in thumbnail view, so I may be having the same problem you were. Is this dll from Pinnacle part of the XP system? I don't recognise the name, so I'm pretty sure it's not something I installed myself. My system has an AMD Athlon XP 3000+ processor (32-bit). Anywho, what's the name of the Pinnacle dll? 'til next we type... HAVE FUN!! -- Jesse
The DLL gets installed as part of Pinnacle Studio, this is what they say on their site Pinnacle Studio DEP[^] There may be other issues DLLs at fault, I tracked down the problem DLL using the Visual Studio debugger then searching for it. Gary Flickr Photos[^]
-
The DLL gets installed as part of Pinnacle Studio, this is what they say on their site Pinnacle Studio DEP[^] There may be other issues DLLs at fault, I tracked down the problem DLL using the Visual Studio debugger then searching for it. Gary Flickr Photos[^]
Gary Thom wrote:
The DLL gets installed as part of Pinnacle Studio
Well, I don't have Pinnacle studio, so that's not it.
Gary Thom wrote:
I tracked down the problem DLL using the Visual Studio debugger
Interesting approach! What, exactly, did you do (attach debugger to Explorer.exe)? Sounds like a nice way to spend a weekend :-D 'til next we type... HAVE FUN!! -- Jesse
-
Folks, Recently I've been getting these popup windows saying Windows Data Execution Prevention has intercepted an attempt by an executable to access reserved memory. The program is Windows Explorer! This is getting very annoying, as it then resets my desktop, sometimes even removing the taskbar! (Try shutting down or logging off without it.) I've searched the usual places, but cannot find anything very informative so I now turn to you, the CP wizards! Any ideas? 'til next we type... HAVE FUN!! -- Jesse
I had the same problem on my notebook when simply clicking on certain .AVI files (most often AVI's produced by my digital camera). It got so annoying, and to make matters worse, the setting to ignore DEP for certain applications would never stick. I ended up creating a second boot option, which I only use when I know I am going to run into this problem. See here[^] for details on how to disable DEP at the boot loader. Hope this helps. :)
-
Gary Thom wrote:
The DLL gets installed as part of Pinnacle Studio
Well, I don't have Pinnacle studio, so that's not it.
Gary Thom wrote:
I tracked down the problem DLL using the Visual Studio debugger
Interesting approach! What, exactly, did you do (attach debugger to Explorer.exe)? Sounds like a nice way to spend a weekend :-D 'til next we type... HAVE FUN!! -- Jesse
Jesse Evans wrote:
Interesting approach! What, exactly, did you do (attach debugger to Explorer.exe)? Sounds like a nice way to spend a weekend
I actually waited till asked Ok/Cancel, do you wish to debug. Said yes, did a quick stack trace and determined the name of the dll, then googled it. Took only a few mins total. You could of course attach the debugger first like you said :) Gary Flickr Photos[^]
-
Jesse Evans wrote:
Interesting approach! What, exactly, did you do (attach debugger to Explorer.exe)? Sounds like a nice way to spend a weekend
I actually waited till asked Ok/Cancel, do you wish to debug. Said yes, did a quick stack trace and determined the name of the dll, then googled it. Took only a few mins total. You could of course attach the debugger first like you said :) Gary Flickr Photos[^]
Gary Thom wrote:
Ok/Cancel, do you wish to debug
Don't recall seeing this option, but I'll pay more attention next time this occurs. Thanks a bunch! 'til next we type... HAVE FUN!! -- Jesse
-
If I remember right, the Microsoft Anti-Spyware beta does this. John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek.I believe any code that uses ATL (the version that comes with VC6) to implement a window will do this. The problem class is
CWndProcThunkfrom "ATLWIN.H". It doesn't follow the rules and set PAGE_EXECUTE_??? permission of the page that holds is thunking code. Steve -
I believe any code that uses ATL (the version that comes with VC6) to implement a window will do this. The problem class is
CWndProcThunkfrom "ATLWIN.H". It doesn't follow the rules and set PAGE_EXECUTE_??? permission of the page that holds is thunking code. SteveI was referring to his statement that I think there are some tools out there to enumerate what explorer extensions you've got installed.