I'm always getting explorer crashes? XP. Data Execution Prevention. it just restarts.

I'm always getting explorer crashes? it just restarts teh explorer. (XP)

usually when I'm browsing through different windows and opening a new one

also sometimes when i surf the internet.

i always thought this was the start of a hijacking

I use
kaspersky
malware bytes anti malware

I've ran super anti spyware too.

nothing found?

It started a while back, near after a hijacking

and also i changed the way windows displayed the windows so there was no right hand side bar. and single click to open files. (I've changed the single click to open back - but still crashes)

i get messages about "Data Execution Prevention error"

i tried to change this setting in the options but it still crashes

http://bubble.ro/Data_Execution_Prevention_error_message_in_Windows_XP.html

it getting a bit annoying because when it restart i loose some options for my sound card in the bottom right.

also it closes all windows.

Any ideas what might be happening? or any fixes?

Or is this a needle in a haystack kind of problem?

are there any good windows diagnostic programs to fix this?

where can i find what is casuing this?

Can you guys help?

 

i looked in the event viewer and found lots of these

explorer.exe followed by dr watson crashes

not all had dr watson some were just the explorer?

this is fairly typical:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/05/2010
Time: 1:35:46 AM
User: N/A


Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x4ec683bd.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 34 65 63 fset 4ec
0050: 36 38 33 62 64 683bd


followed by.......but not always.....

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/05/2010
Time: 1:35:59 AM
User: N/A
Computer:
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 35 35 31 2600.551
0048: 32 20 61 74 20 6f 66 66 2 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d

 

I would try a different antivirus software. Also get rid of all your antispyware software. See if that fixes anything, maybe you have a compability problem with your security software. Disabling security software won't help because they always run in the background, you have to completely remove the software.

Also on these windows that you are opening are there video files in them? Explorer on xp is known to crash sometimes if the video file thumbnail setting is enabled on folders. You can disable that setting

Solution: Windows XP:
1. Go to Start -> Run... and type regsvr32 /u shmedia.dll
Press enter. Done.
If for some reason you want it back, simply do the same thing again, but remove the "/u". That is: Start -> Run... regsvr32 shmedia.dll
This will only disable movie thumbnails/previews, not picture thumbnails.

My system
xp sp3
1. zone alarm free firewall
2. avira free antivirus
3. firefox browser
4. safespace free version (used instead of antispyware)

 

thanks i'll try the thumnail off idea

i tried this solution I hope its ok:



Disable Data Execution Prevention (DEP) completely

Click Start, and then click Control Panel.
Under Pick a category, click Performance and Maintenance.
Under or Pick a Control Panel icon, click System.
Click the Advanced tab, and in the Startup and Recovery area, click Settings.
In the SystemStartup area, click Edit.
In Notepad, click Edit and then click Find.
In the Find what field, type /noexecute and then click Find Next.
In the Find dialog box click Cancel.

Replace the policy_level (for example, "OptIn" default) with "AlwaysOff" (without the quotes).

WARNING: Be sure to enter the text carefully. Your boot.ini file switch should now read:

/noexecute=AlwaysOff

In Notepad, click File and then click Save.
Click OK to close Startup and Recovery.
Click OK to close System Properties and then restart your computer.
This setting does not provide any DEP coverage for any part of the system, regardless of hardware DEP support.

 

Hi

I'm still getting crashes after disabling data execution prevention

i am using Kaspersky and malware bytes (paid for resident protection)

should i uninstall Malware bytes to see if that's the problem?

Can Malware bytes resident and Kaspersky run happily together?


.....

How can i tell whats causing the explorer to crash?

 

I believe that there were/are(?) issues with running Kaspersky alongside Mbam.You needed to create an exclusion in Kaspersky for Mbam's files:

http://forums.malwarebytes.org/index.php?showtopic=43469

 

'Dr. Watson' and the 'dbghelp.dll' are what's causing the issue (or at least one of the issues):

Dr. Watson and the dbghelp.dll are part of your machine's debugging engine.

Something causes the debugger to want to run, and it can't/doesn't run, so Explorer crashes.
It's possible that whatever is causing the debugger to want to run would crash Explorer anyway-- but Windows wants to debug explorer.exe and can't run the necessary tools to do it.

I can't give you any reasons or solutions right off, but that's a place for you to start.

Also, check the WINDOWS/Minidump folder to see what .dmp files you have there.
If there are any, posting the contents of a recent one might help.

 

thanks for the replies

I have set up MBAM exclusions in Kaspersky

I found a few entries in minidump but not as many as the explorer crashes.

How do i read these .dmp files?

 

Probably you don't.

Open the most recent one with Notepad, then copy & paste the contents here.

Someone with debugging tools can then take a look at it.

 

http://forums.majorgeeks.com/showthread.php?t=35246

It says they are created after blue screen crashes

I am not getting blue screen crashes

I'm getting a message "explorer needs to be restarted" and it restarts, but the pc stays running. A bit like if you restart the explorer.exe using the task manager.

Its not really the same as a blue screen crash

 

on the above post was this

 

post the latest minidump file here (rename the extention to .txt)

otherwise to read minidump files you use something like Windows Debugging tools
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

 

Hi thanks for the extra info

but I am not getting blue screen crashes

I'm getting a message "explorer needs to be restarted" and it restarts, but the pc stays running.

A bit like if you restart the explorer.exe using the task manager.

 

ok sounds good, so how can i get too the root of the problem?

Any suggestions welcome.

I get the explorer.exe restart but XP stays on

some logos and stuff are missing form the bottom right but the things that are not shown still work.

Is there a way to track or monitor the PC's behaviour so i can pin point what is forcing the explorer.exe to restart?

 

http://www.resplendence.com/downloads WhoCrashed 2.0
"Sometimes when your PC crashes, the cause is obvious. At other times it will be a total mystery. Knowing the reason for the problem is important because you'll have information that should help prevent your PC from crashing again. WhoCrashed will tell you what happened and which driver or piece of hardware or software was responsible."
Min requirements: Windows XP/Vista/7
File size: 755KB

 

Data Execution means someone want to execute a segment of code marked as "data". usually, it is a bug, not attack, so disable data execution would not avoid crashed.

sysinternals has a free tool "autoruns.exe"(simliar as hijackthis with good ui, can be downloaded from microsoft), run it, select explorer page, then you will see all dlls would be added to explorer.exe when running, compare it with other good machine, try delete these modules until not crashed(right click the module, select delete in popup menu).

 

Hi

I ran the program and got this

My computer is not REBOOTING or BLUE SCREEN. It is just restarting the windows explorer.exe

I have no idea why its doing it.

thanks guys keep the suggestions coming

 

ok

what if i did a repair

http://www.tweakxp.com/article36955.aspx

is this a good idea? what are the risks?

 

I'm still getting the explorer.exe restarting. it happened 4 times today

Its a bit of a pain because sometimes it hangs

I removed Dr Watson from the registry

Thanks for the advice so far, and who crashed seems like a really good program, but i am not getting CRASHES. I am getting the explorer.exe restarting while the PC stays running. (a bit like if you open the device manager and kill explorer.exe and then RUN explorer.exe - that's how these symptoms look)

Has anyone got any idea what might be causing the explorer.exe 'restarting while the pc is running' ?

Cheers

 

Uh, yes you are. Exploder restarts as you have described are a result of a crash as noted by the title of your thread

 

My guess is one of your programs, it doesn't even have to be a security program, does not like DEP. I used to get these errors when I had XP. I wish I remembered what program it ended up being that was causing it, but the removal of it did the trick. Also, as it was said before, thumbnails, especially AVI files, can cause these. It's usually when one or more files are corrupted.

 

This.
But instead of deleting left and right, like removing drwatson, try to analyze what's important, and what's not. Don't delete, instead disable items (the tick box).
Autoruns can hide Windows/Microsoft entries, and signed programs. Hide those, and see what's left in autorun's explorer tab.
Post what's left if you want advice/suggestions.

Just my 2 cents, i'm no expert.

 

You prolly wont like my suggestion,but if it's a big enough pain,I'd just reformat and be done with it.Sometimes it's just alot easier to start fresh IMO.