"Data Execution Prevention" Need HELP!!

Discussion in 'malware problems & news' started by abhi_mittal, Mar 26, 2005.

Thread Status:
Not open for further replies.
  1. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Hi,

    I use a Celeron Mobile 1.4 Ghz, 256 RAM notebook running Avast Prof, Spybot, Ad-aware, Windows XP firewall etc.

    For the past 4-5 days, whenever I am watching movies on Windows Media Player 10, my Windows Explorer gets closed. Some movies run fine, some collapse explorer.exe. Finally, my computer displayed the message that said that its a "Data Execution Prevention" and explorer needs to close.

    Is it a virus thats causing this trouble? Microsoft knowledgebase says its very much possible.

    I ran Avast, but it detected nothing on my PC.

    What should I do?

    Regards,
    Abhishek
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Is your XP updated to SP2....which has DEP enabled by default in Service Pack 2 ?
    Also....are these movies in any way associated with DIVX ?
     
  3. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    I use Genuine MS Windows XP Home with SP2 with automatic updates turned on. Some of these files are associated with DivX, but not all of them.

    The error report says:
    C:\DOCUME~1\Mittal\LOCALS~1\Temp\ba10_appcompat.txt
     
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Is that txt file to large to post ?
     
  5. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Well, I tried to view the movie again. Same Problem. I went to the path listed above.....there is NO file by that name there!!!!!!!!!

    Something very nasty is happening it seems!
     
  6. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Every time I get the error report, it shows a new appcompat text file and when I go the the path, there is nothing to be found there.
     
  7. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi abhi_mittal,

    Might be worth it to disable DEP temporarily and see if it is actually the cause. You will have to change the DEP switch in your boot.ini to /noexecute=AlwaysOff and reboot. You can find detailed instructions here: System-wide configuration of DEP.

    Nick
     
  8. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Nick,
    Did what you said, didnt help me in any way. The problem persists and, ofcourse, nags!

    Regards
    Abhishek
     
  9. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Are these errors showing up in your event logs (go Start, Run, type eventvwr.msc, hit Enter)?

    Nick
     
  10. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Yup, I can see them in the Event Viewer. The technical details are::

    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Date: 3/27/2005
    Time: 1:10:59 AM
    User: N/A
    Computer: MITTAL
    Description:
    Faulting application explorer.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x00000020.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 65 78 70 ure exp
    0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
    0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
    0028: 30 30 2e 32 31 38 30 20 00.2180
    0030: 69 6e 20 75 6e 6b 6e 6f in unkno
    0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
    0040: 2e 30 20 61 74 20 6f 66 .0 at of
    0048: 66 73 65 74 20 30 30 30 fset 000
    0050: 30 30 30 32 30 00020
     
  11. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
  12. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    I do not have any codecs installed currently. I installed a month back and uninsalled them then only.
     
  13. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Are you using System Restore? If you are, you might consider restoring to a point before these errors started occuring.

    Nick
     
  14. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Well I can use System Restore, but that may translate into Data Loss. I experienced it some months back. Cant take that risk.
     
  15. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Any thing else that can be done??
     
  16. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
  17. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Well I uninstalled WMP10, repaired XP and reinstalled WMP.

    The problem is that if I go to My Computer/D:/ MovieslList/ ....my explorer shuts down with an appcompat.txt file in the error report. And when I use WMP to go File/open/file name...it works fine.

    Why is explorer shutting down?
    Pls help me!!!
     
  18. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    The most likely cause (Google Search Results) is DEP. There are two approaches to resolving explorer-related DEP crashes. The first involves disabling DEP via the boot.ini switch (mentioned above). The second involves turning on DEP for all programs except explorer.exe. I would try the second approach and see if it works.

    Nick
     

    Attached Files:

  19. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    Looks like certain files in my movie directory simply crash explorer when I try to access them. I deleted some files and the problem has stopped!

    Can large movie files have malicious code?
     
  20. Bakadeshi

    Bakadeshi Guest

    I've been having this same problem, but I may be able to shed more light on the problem. It is indeed video files causing the problem, but its NOT limited to divx/xvid type files, I tried moving all those out of the folder and DEP still closes explorer when you click on a video file. It apears that if you open it to the folder and don't do anything its fine. double click a file so it starts playing, and a few seconds later, DEP closes explorer and notifies me. The Video continues playing fine, and explorer still works fine until you click on "Close message" in the DEP window. Also I am using BSPlayer as the media player and not windows Media player, although I think BSPlayer might use components from Media player. The file I am attempting to play is a 900 MB AVI file compressed using the Lagarith lossless codec. I do video editing.

    I don;t think its a virus or anything, just an anoyance that I would like to fix without disabling explorer in DEP, since I would think Explorer could possibly be manipulated by hostile code to do strange things that DEP might stop if its enabled.

    Hope this helps.
     
  21. abhi_mittal

    abhi_mittal Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    887
    Location:
    Bangalore
    I realised too that the problem was with the files..So I deleted them and the problem is gone.

    Thanks
     
  22. brad p

    brad p Guest

    I had a problem with Windows explorer blowing up in which it would give me the error in the event log about faulting application explorer.exe. Whenever it would blow up, DEP would come up. Also when it blew up, the task bar, and the desktop icons would dissappear then reappear. The way I could cause the problem to occurr instantly was to right-click the start menu and select explore. I was able to resolve the issue by first disabling the DEP as reccomended then downloading and installing ShellExView. After installing it I disabled the items that did not say they were from Microsoft. This fixed my problem after trying many different solutions I found about photoshop conflicts, Microsoft patch conflicts, .avi conflicts, etc. I downloaded ShellExView from http://www.nirsoft.net/utils/shexview.html. I hope this helps.
     
  23. MasterDeus

    MasterDeus Registered Member

    Joined:
    Jun 25, 2006
    Posts:
    1
    I tried everything above and then some, NOTHING WORKED!! I've had this problem many times before as well and never figured out what exactly it was that i did to fix it, lol. But today i simply installed this: DIVXPro511 and it sovled everything!! So I suggest googling this program and installing it. Certainly worth a try.
     
Loading...
Thread Status:
Not open for further replies.