Data Execution Prevention nightmare

For system help, all hardware / software topics NOTE: use Coders Corner for all coders topics.

Moderators: Krom, Grendel

Post Reply
User avatar
EngDrewman
DBB Ace
DBB Ace
Posts: 232
Joined: Mon Oct 13, 2008 12:01 am
Location: Sacramento, CA
Contact:

Data Execution Prevention nightmare

Post by EngDrewman »

DEP keeps crashing explorer over false positives with no noticeable way to override/disable it. The error occurs when I open a folder containing video files. I scanned all of the files with multiple scanners, including NOD32, and they all say the files are clean. There appears to be no BIOS setting to disable the CPU's DEP features, and control panel won't let you disable it either. Is there some kind of registry hack to shut it off?
User avatar
fliptw
DBB DemiGod
DBB DemiGod
Posts: 6459
Joined: Sat Oct 24, 1998 2:01 am
Location: Calgary Alberta Canada

Post by fliptw »

A simpler solution might be to disable preview generation.

That being said - which version of windows?
User avatar
SuperSheep
DBB Benefactor
DBB Benefactor
Posts: 935
Joined: Sun Jun 03, 2001 2:01 am
Location: Illinois

Post by SuperSheep »

Sounds like thumbnail generation needs to be turned off...

Windows XP
http://www.mydigitallife.info/2008/03/1 ... indows-xp/

Windows Vista
http://www.mydigitallife.info/2007/09/1 ... -in-vista/
User avatar
TechPro
DBB Admiral
DBB Admiral
Posts: 1520
Joined: Thu May 20, 2004 11:51 pm

Post by TechPro »

Why not just turn off DEP? Wouldn't that be better/easier?
User avatar
Jeff250
DBB Master
DBB Master
Posts: 6539
Joined: Sun Sep 05, 1999 2:01 am
Location: ❄️❄️❄️

Post by Jeff250 »

I wouldn't recommend it. It would be wiser to find out why explorer.exe is trying to execute data to begin with, since nothing good can come from that. On modern machines, memory is partitioned into executable and nonexecutable segments. When you load a program, the OS puts the instructions for it in an executable segment, whereas other data goes into nonexecutable segments. DEP prevents the program from jumping into the nonexecutable segments and interpreting the bits there as instructions and executing them. This is to help prevent e.g. someone sending you malicious machine code into a buffer and then overflowing the buffer such that the program abnormally jumps to the malicious instructions that were just sent and executes them.

In this case, it's probably just a bug in some explorer.exe hook or malware that's jumping to the wrong parts in memory due to bad coding. There's a good chance that disabling DEP will just cause it to crash some other way, since the processor will likely frown upon trying to interpret whatever bits in memory that you are jumping to as instructions. Rarely DEP can be triggered from some intentional coding trick that really never should have been coded to begin with.
User avatar
EngDrewman
DBB Ace
DBB Ace
Posts: 232
Joined: Mon Oct 13, 2008 12:01 am
Location: Sacramento, CA
Contact:

Re:

Post by EngDrewman »

SuperSheep wrote:Sounds like thumbnail generation needs to be turned off...

Windows XP
http://www.mydigitallife.info/2008/03/1 ... indows-xp/
Will that disable ALL thumbnails, or just thumbnails for vids?
User avatar
SuperSheep
DBB Benefactor
DBB Benefactor
Posts: 935
Joined: Sun Jun 03, 2001 2:01 am
Location: Illinois

Re:

Post by SuperSheep »

EngDrewman wrote:
SuperSheep wrote:Sounds like thumbnail generation needs to be turned off...

Windows XP
http://www.mydigitallife.info/2008/03/1 ... indows-xp/
Will that disable ALL thumbnails, or just thumbnails for vids?
All media files. That includes pictures.
User avatar
Krom
DBB Database Master
DBB Database Master
Posts: 16138
Joined: Sun Nov 29, 1998 3:01 am
Location: Camping the energy center. BTW, did you know you can have up to 100 characters in this location box?
Contact:

Post by Krom »

There are ways to disable thumbnail extraction from video only (in Windows XP at least), use:
http://www.nirsoft.net/utils/shexview.html
Disable: \"Video Thumbnail Extractor\", \"Video Media Properties Handler\" and \"Avi Properties Handler\". This will disable video thumbnail extraction without also disabling image thumbnails, or disabling additional information on MP3 or WAV files.

Otherwise if you don't care about the extra info on MP3s, you can also kill video thumbnails by hitting start ---> run and typing in \"regsvr32 /u shmedia.dll\" (without quotes).

Although you may be able to solve the issue without disabling thumbnails simply by updating your video codecs ( I highly recommend using CCCP for windows: http://cccp-project.net ).
User avatar
Burlyman
DBB Admiral
DBB Admiral
Posts: 1275
Joined: Sun Oct 16, 2005 5:47 pm
Location: right behind you

Post by Burlyman »

I heart DEP & NX bit (or Intel's copy of it, anyway =P).

I just thought I'd share. =P
Post Reply