Data Execution Prevention

[ianclarke]

Hi

I'm getting a repeating error since rebooting my laptop immediately after scanning with AVG, Ad-Aware, SpyBot and Bazooka and then running a disk check which required the reboot. The scans returned no viruses and only 3 objects were removed by Ad-Aware. I missed the end of the disk checking and only got back to the laptop as windows was restarting.

Since then I have been getting a Data Execution Prevention notification. It states that in order to protect my computer it has closed Windows Explorer. Once I click on the 'Close Message' button my desktop refreshes and a rundll32.exe - Application Error appears stating:
'The instruction at "0x71ab98b4" referenced memory at "0x71ab98b4". The memory could not be "written".'

This repeats indefinitely. Intially rundll32 was not the only application error to appear - also rasautou.exe and Task Manager! All showed errors regarding memory referencing itself.

Please help - I've got assignments due on Tuesday and can't afford to re-install Windows!!

Ian

 

[jdemmi]

Do you have time, once the PC boots, to go to control panel --> system --> advanced tab, performance settings button and check the DEP settings?

you may need to set them to default (only on for windows services).

can you boot into safe mode with network support and a run a free virus scan from trenmicro.com (house call)?

can you run system file checker? SFC /SCANNOW for a command prompt (in your case may need to be done in safe mode OR use SFC /SCANBOOT (for one reboot and then turn it off using SFC /REVERT)

-- Jason
"It's Just Ones and Zeros

 

[linney]

Check out this part of the following article - "DEP configuration for the system is controlled through switches in the Boot.ini file. If you are logged on as an administrator, you can now easily configure DEP settings by using the System dialog box in Control Panel".

A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2 and Windows XP Tablet PC Edition 2005

http://support.microsoft.com/kb/875352

HOW TO: Edit the Boot.ini File in Windows XP (Q289022)

http://support.microsoft.com/support/kb/articles/q289/0/22.asp

You receive a "Data Execution Prevention" error message in Windows XP Service Pack 2 or in Windows XP Tablet PC Edition 2005

http://support.microsoft.com/default.aspx?scid=kb;en-us;875351&FR=1&PA=1&SD=HSCH

Hardware (DEP)-enabled computer may unexpectedly quit after you resume from standby or from hibernation in Windows XP Service Pack 2

http://support.microsoft.com/default.aspx?scid=kb;en-us;889673&FR=1&PA=1&SD=HSCH

 

[ianclarke]

Your responses are much appreciated!

Jason:
I have checked the DEP settings and they were already on for Windows services only - it is only Windows services that are returning the errors, i.e. Explorer / Task Manager / ConnectionsTray / rundll32.exe.

I have run AVG anti-virus again and all's clean there. I updated AVG last night.

I ran scannow and the errors still persist, although I have not yet rebooted again. Perhaps I should do that?

Linney:
I had not seen the last link that you posted. It refers to hardware related issues with DEP that cause random memory corruption and ceasation of response. This fits with the symptoms of my laptop. It also says that there is a hotfix for this, but you must contact Microsoft via phone to request it to be sent out. Isn't there somewhere these things can be downloaded? Time is of the....blah blah!

 

[ianclarke]

I have just shutdown and restarted. Still the same errors!

 

[linney]

Only apply it to systems that are experiencing this specific problem."

If the support person agrees that this hotfix may be the solution to your problem they will supply you with a download link. I don't think there is any other way to obtain a special hotfix, unless you happen to know someone who has a copy on hand.

At least the support staff work 7 days per week.

 

[dglienna]

I would get the most current Hotfix that you can get. Unless your computer was a clone of someone else that had the same symtoms, with the same hardware and software, you'd have only a 50% chance of it being correct, at best. You don't know how many calls they've gotten for a similar problem, which caused them to develop a hotfix for a new problem. Best thing is to call them.

-David
2006 Microsoft Valueable Professional (MVP)

 

[ianclarke]

Hey All

I have just solved the problem by removing Atomic Log from startup. I can't believe it caused all these problems. I have not uninstalled it - just removed it from startup.

What a relief. Thanks for your time and replies.

Ian