Page 1 of 1
Data Execution Prevention nightmare
Posted: Thu Aug 06, 2009 11:43 pm
by EngDrewman
DEP keeps crashing explorer over false positives with no noticeable way to override/disable it. The error occurs when I open a folder containing video files. I scanned all of the files with multiple scanners, including NOD32, and they all say the files are clean. There appears to be no BIOS setting to disable the CPU's DEP features, and control panel won't let you disable it either. Is there some kind of registry hack to shut it off?
Posted: Thu Aug 06, 2009 11:54 pm
by fliptw
A simpler solution might be to disable preview generation.
That being said - which version of windows?
Posted: Fri Aug 07, 2009 6:18 am
by SuperSheep
Posted: Fri Aug 07, 2009 8:27 pm
by TechPro
Why not just
turn off DEP? Wouldn't that be better/easier?
Posted: Fri Aug 07, 2009 8:46 pm
by Jeff250
I wouldn't recommend it. It would be wiser to find out why explorer.exe is trying to execute data to begin with, since nothing good can come from that. On modern machines, memory is partitioned into executable and nonexecutable segments. When you load a program, the OS puts the instructions for it in an executable segment, whereas other data goes into nonexecutable segments. DEP prevents the program from jumping into the nonexecutable segments and interpreting the bits there as instructions and executing them. This is to help prevent e.g. someone sending you malicious machine code into a buffer and then overflowing the buffer such that the program abnormally jumps to the malicious instructions that were just sent and executes them.
In this case, it's probably just a bug in some explorer.exe hook or malware that's jumping to the wrong parts in memory due to bad coding. There's a good chance that disabling DEP will just cause it to crash some other way, since the processor will likely frown upon trying to interpret whatever bits in memory that you are jumping to as instructions. Rarely DEP can be triggered from some intentional coding trick that really never should have been coded to begin with.
Re:
Posted: Sat Aug 08, 2009 2:39 pm
by EngDrewman
Will that disable ALL thumbnails, or just thumbnails for vids?
Re:
Posted: Sat Aug 08, 2009 5:18 pm
by SuperSheep
EngDrewman wrote:
Will that disable ALL thumbnails, or just thumbnails for vids?
All media files. That includes pictures.
Posted: Sun Aug 09, 2009 7:27 am
by Krom
There are ways to disable thumbnail extraction from video only (in Windows XP at least), use:
http://www.nirsoft.net/utils/shexview.html
Disable: \"Video Thumbnail Extractor\", \"Video Media Properties Handler\" and \"Avi Properties Handler\". This will disable video thumbnail extraction without also disabling image thumbnails, or disabling additional information on MP3 or WAV files.
Otherwise if you don't care about the extra info on MP3s, you can also kill video thumbnails by hitting start ---> run and typing in \"regsvr32 /u shmedia.dll\" (without quotes).
Although you may be able to solve the issue without disabling thumbnails simply by updating your video codecs ( I highly recommend using CCCP for windows:
http://cccp-project.net ).
Posted: Tue Aug 18, 2009 3:16 pm
by Burlyman
I heart DEP & NX bit (or Intel's copy of it, anyway =P).
I just thought I'd share. =P