DEP errors

Discussion in 'LnS English Forum' started by Uroboros, Sep 9, 2005.

Thread Status:
Not open for further replies.
  1. Uroboros

    Uroboros Registered Member

    Joined:
    Nov 9, 2003
    Posts:
    70
    DEP being Data Execution Prevention.

    Testing out LooknStop. Running WindowsXP on an Athlon64 system. Being an 64bit processor Data Execution Prevention is turned on.

    Anyhow (and sorry for not being able to be more specific about this) I notice that certain set-ups in LooknStop will start giving me Data Execution Prevention megs/errors on start-up.

    Window will pop up telling me certain programs are being stopped. Things like

    spoolsv.exe
    svchost.exe

    Thing is I can't really tell what combination of events is causing this as it's stopped right now. (in both cases I stopped doing what I thought might be causing it) The first time this occurred. seemed to have to do with me logging (in LooknStop) svchost.exe. Another time I added an application in the LocknStop list (regRun Watchdog) and I saw the same error.

    I know that's not specific enough to narrow down the cause (will have to do more testing) but i was wondering if anyone has encountered this before.

    TIA
     
  2. Uroboros

    Uroboros Registered Member

    Joined:
    Nov 9, 2003
    Posts:
    70
    Followup...

    OK..seems to be some combinations of having 'TCP Stateful Packet Inspection' and 'Watch DNS calls' turned on. Can't say if the issue is both or just one. But turning them both on will cause the system to start going haywire.

    Tried turning just 'Watch DNS calls' OFF after the system booted. But this just caused StopnLock to crash. Had to turn BOTH off and reboot to have that choice stick. (the crash of StopnLock just caused the setting to remain after reboot.)

    Using Phantom's rules BY THE WAY. But this occurred before I even tried the rules.

    Well I think I'll just leave things as they are. :)
     
    Last edited: Sep 9, 2005
  3. WSFuser

    WSFuser Registered Member

    Joined:
    Oct 7, 2004
    Posts:
    10,632
    hmm never had those issues. only BSODs when i enabled "Watch Thread Injection".
     
  4. Frederic

    Frederic LnS Developer

    Joined:
    Jan 9, 2003
    Posts:
    4,354
    Location:
    France
    Features like "Watch thread injection", "Watch DNS call" and all the new detections in the beta driver have to be disabled when DEP protection/Nx bit are activated.

    On the other hand, there should be no issue with TCP SPI.

    Frederic
     
  5. Uroboros

    Uroboros Registered Member

    Joined:
    Nov 9, 2003
    Posts:
    70
    Yes TCP SPI is working fine. Thanks again
     
Thread Status:
Not open for further replies.