DrWatson and DEP

Hi,
A few days ago i uninstalled norton systemworks on my mum's laptop (running XP home SP2) and replaced it with kasperky antivirus, and pretty soon afterwards it started to di

What happens is that Data Execution Prevention comes up with a message saying that it has blocked some windows applications (examples include 'Task Manager' (If I open it first), 'Run DLL As App' and 'Dr Watson'). Sometimes it even does it right after logon, supposedly blocking 'Windows Logon UI'.

Occasionally it will only do this once or twice, and then stop, but more often than not it will go into a state of blocking stuff all of the time, and then start repeatedly opening Dr Watson so rapidly that logging off becomes almost impossible. Of course, all of these Dr Watsons also get blocked by DEP, and then the windows error reporting window comes up saying Dr Watson has encountered a problem blah blah blah...

I've posted two hijackthis logs: one from the laptop in a stable state, and one from it when it is freaking out and opening up loads of Dr Watsons. You'll notice that there were a couple of windows, outlook and Add/Remove programs, open when I got the unstable log. This is because i was trying to repeat the problem by opening programs that have been open before when it occured.

Any ideas?

cheers,
luke

 

hi
you may try to bypass DEP by choosing the apps to exclude from the DEP :
ctl pannel/system/advanced/performances/parameters/DEP/unable DEP for..except..
Only to get rid for a while from these messages, but must be another solution
Regards

 

Thanks for that. I disabled DEP for everything it had blocked and the it seems to be working as usual.

Though, presumeably, disabling DEP isn't really a good idea as a permanent solution...

Thanks again. Saved my mum a lot of stress

 

Assuming your mum doesn't surf on known malicious websites, there is very few chances to get suspect software execute on her HD.. Actually DEP is a security improvement, but not supported by all comps. Set your firewall on and your antivirus up to date, don't run unknown apps, keep an eye on the logs, that's enough for most users. Regards.

 

DEP is supported by everyone. Now whether its hardware or software...thats the difference.

DEP doesn't improve security whatsoever. It was designed to keep unstable applications from running and crashing the machine.

This definately isn't normal behavior. I'd head over to the malware forum, run through the stickies, and see what comes up.

 

Waow take it easy man, I just meant all comps (hardware) don't support DEP, it's commonly admitted here to disable what is largely a security matter (regarding buffer overflow prevention). Sorry it's in french, but have a look here and see by yourself..

 

Did I miss something where you took my reply personally?

 

"The function of an expert is not to be right more than other people but to be wrong for more sophisticated reasons."
(David Butler)

 

"The function of a moderator is correct information, when partially, or entirely incorrect."
(Adrynalyne)

 

Don't take it personally, I'm not.

Re-analyze the post. This poster needs more help than just disabling DEP. Look closely, those are MS components puking on him. I merely added what needed to be added.

 

This should not be that big of an issue. If anyone else has a better way, I'm all ears. As I said in the post ' but must be another solution '..