Wilders Security Forums  

Go Back   Wilders Security Forums > Other Security Topics > malware problems & news
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old March 26th, 2005, 01:29 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Unhappy "Data Execution Prevention" Need HELP!!

Hi,

I use a Celeron Mobile 1.4 Ghz, 256 RAM notebook running Avast Prof, Spybot, Ad-aware, Windows XP firewall etc.

For the past 4-5 days, whenever I am watching movies on Windows Media Player 10, my Windows Explorer gets closed. Some movies run fine, some collapse explorer.exe. Finally, my computer displayed the message that said that its a "Data Execution Prevention" and explorer needs to close.

Is it a virus thats causing this trouble? Microsoft knowledgebase says its very much possible.

I ran Avast, but it detected nothing on my PC.

What should I do?

Regards,
Abhishek
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #2  
Old March 26th, 2005, 01:40 PM
Bubba's Avatar
Bubba Bubba is offline
Global Moderator
 
Join Date: Apr 2002
Posts: 11,260
Default Re: "Data Execution Prevention" Need HELP!!

Quote:
Originally Posted by abhi_mittal
whenever I am watching movies on Windows Media Player 10....my computer displayed the message that said that its a "Data Execution Prevention"
Is your XP updated to SP2....which has DEP enabled by default in Service Pack 2 ?
Also....are these movies in any way associated with DIVX ?
  #3  
Old March 26th, 2005, 01:44 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

I use Genuine MS Windows XP Home with SP2 with automatic updates turned on. Some of these files are associated with DivX, but not all of them.

The error report says:
C:\DOCUME~1\Mittal\LOCALS~1\Temp\ba10_appcompat.txt
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #4  
Old March 26th, 2005, 01:57 PM
Bubba's Avatar
Bubba Bubba is offline
Global Moderator
 
Join Date: Apr 2002
Posts: 11,260
Default Re: "Data Execution Prevention" Need HELP!!

Quote:
Originally Posted by abhi_mittal
The error report says:
C:\DOCUME~1\Mittal\LOCALS~1\Temp\ba10_appcompat.txt
Is that txt file to large to post ?
  #5  
Old March 26th, 2005, 02:08 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Well, I tried to view the movie again. Same Problem. I went to the path listed above.....there is NO file by that name there!!!!!!!!!

Something very nasty is happening it seems!
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #6  
Old March 26th, 2005, 02:27 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Every time I get the error report, it shows a new appcompat text file and when I go the the path, there is nothing to be found there.
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #7  
Old March 26th, 2005, 02:31 PM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

Hi abhi_mittal,

Might be worth it to disable DEP temporarily and see if it is actually the cause. You will have to change the DEP switch in your boot.ini to /noexecute=AlwaysOff and reboot. You can find detailed instructions here: System-wide configuration of DEP.

Nick
  #8  
Old March 26th, 2005, 02:47 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Thumbs down Re: "Data Execution Prevention" Need HELP!!

Nick,
Did what you said, didnt help me in any way. The problem persists and, ofcourse, nags!

Regards
Abhishek
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #9  
Old March 26th, 2005, 02:54 PM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

Are these errors showing up in your event logs (go Start, Run, type eventvwr.msc, hit Enter)?

Nick
  #10  
Old March 26th, 2005, 02:59 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Yup, I can see them in the Event Viewer. The technical details are::

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/27/2005
Time: 1:10:59 AM
User: N/A
Computer: MITTAL
Description:
Faulting application explorer.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x00000020.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 30 30 30 fset 000
0050: 30 30 30 32 30 00020
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #11  
Old March 26th, 2005, 02:59 PM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

This link offers some info: Why does the Player keep crashing?.

Nick
  #12  
Old March 26th, 2005, 03:07 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

I do not have any codecs installed currently. I installed a month back and uninsalled them then only.
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #13  
Old March 26th, 2005, 03:14 PM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

Are you using System Restore? If you are, you might consider restoring to a point before these errors started occuring.

Nick
  #14  
Old March 26th, 2005, 03:20 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Well I can use System Restore, but that may translate into Data Loss. I experienced it some months back. Cant take that risk.
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #15  
Old March 26th, 2005, 03:36 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Any thing else that can be done??
  #16  
Old March 26th, 2005, 03:41 PM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

Another option would be Rolling back to a previous version of the Player and see if your movies are playable. If they are, then you could attempt to reinstall WMP 10 and see if a fresh install resolves the problem.

Nick
  #17  
Old March 27th, 2005, 08:32 AM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Well I uninstalled WMP10, repaired XP and reinstalled WMP.

The problem is that if I go to My Computer/D:/ MovieslList/ ....my explorer shuts down with an appcompat.txt file in the error report. And when I use WMP to go File/open/file name...it works fine.

Why is explorer shutting down?
Pls help me!!!
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #18  
Old March 27th, 2005, 11:22 AM
nick s nick s is offline
Very Frequent Poster
 
Join Date: Nov 2002
Posts: 1,426
Default Re: "Data Execution Prevention" Need HELP!!

Quote:
Originally Posted by abhi_mittal
Well I uninstalled WMP10, repaired XP and reinstalled WMP.

The problem is that if I go to My Computer/D:/ MovieslList/ ....my explorer shuts down with an appcompat.txt file in the error report. And when I use WMP to go File/open/file name...it works fine.

Why is explorer shutting down?
Pls help me!!!
The most likely cause (Google Search Results) is DEP. There are two approaches to resolving explorer-related DEP crashes. The first involves disabling DEP via the boot.ini switch (mentioned above). The second involves turning on DEP for all programs except explorer.exe. I would try the second approach and see if it works.

Nick
Attached Images
 
  #19  
Old March 27th, 2005, 04:25 PM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

Looks like certain files in my movie directory simply crash explorer when I try to access them. I deleted some files and the problem has stopped!

Can large movie files have malicious code?
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #20  
Old April 11th, 2005, 08:01 PM
Bakadeshi
 
Posts: n/a
Default Re: "Data Execution Prevention" Need HELP!!

I've been having this same problem, but I may be able to shed more light on the problem. It is indeed video files causing the problem, but its NOT limited to divx/xvid type files, I tried moving all those out of the folder and DEP still closes explorer when you click on a video file. It apears that if you open it to the folder and don't do anything its fine. double click a file so it starts playing, and a few seconds later, DEP closes explorer and notifies me. The Video continues playing fine, and explorer still works fine until you click on "Close message" in the DEP window. Also I am using BSPlayer as the media player and not windows Media player, although I think BSPlayer might use components from Media player. The file I am attempting to play is a 900 MB AVI file compressed using the Lagarith lossless codec. I do video editing.

I don;t think its a virus or anything, just an anoyance that I would like to fix without disabling explorer in DEP, since I would think Explorer could possibly be manipulated by hostile code to do strange things that DEP might stop if its enabled.

Hope this helps.
  #21  
Old April 12th, 2005, 02:29 AM
abhi_mittal's Avatar
abhi_mittal abhi_mittal is offline
Frequent Poster
 
Join Date: Mar 2005
Location: Bangalore
Posts: 887
Default Re: "Data Execution Prevention" Need HELP!!

I realised too that the problem was with the files..So I deleted them and the problem is gone.

Thanks
__________________
Coincidences are God's Way of Remaining Anonymous.
My Blog- Touching the Void...
  #22  
Old January 24th, 2006, 09:24 AM
brad p
 
Posts: n/a
Default Re: "Data Execution Prevention" Need HELP!!

I had a problem with Windows explorer blowing up in which it would give me the error in the event log about faulting application explorer.exe. Whenever it would blow up, DEP would come up. Also when it blew up, the task bar, and the desktop icons would dissappear then reappear. The way I could cause the problem to occurr instantly was to right-click the start menu and select explore. I was able to resolve the issue by first disabling the DEP as reccomended then downloading and installing ShellExView. After installing it I disabled the items that did not say they were from Microsoft. This fixed my problem after trying many different solutions I found about photoshop conflicts, Microsoft patch conflicts, .avi conflicts, etc. I downloaded ShellExView from http://www.nirsoft.net/utils/shexview.html. I hope this helps.
  #23  
Old June 25th, 2006, 01:27 PM
MasterDeus MasterDeus is offline
Infrequent Poster
 
Join Date: Jun 2006
Posts: 1
Default Re: "Data Execution Prevention" Need HELP!!

I tried everything above and then some, NOTHING WORKED!! I've had this problem many times before as well and never figured out what exactly it was that i did to fix it, lol. But today i simply installed this: DIVXPro511 and it sovled everything!! So I suggest googling this program and installing it. Certainly worth a try.
 

Wilders Security Forums > Other Security Topics > malware problems & news « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 06:15 AM.


Powered by vBulletin® Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2010, Wilders Security Forums