Author Topic: Data Execution Prevention--Looks like an Infection  (Read 10908 times)

0 Members and 1 Guest are viewing this topic.

abhi_mittal

  • Guest
Data Execution Prevention--Looks like an Infection
« on: March 26, 2005, 08:09:46 PM »
Hi,

I use a Win XP Home with SP2 Celeron Mobile 1.4 Ghz, 256 RAM notebook running Avast Prof, Spybot, Ad-aware, Windows XP firewall etc.

For the past 4-5 days, whenever I am watching movies on Windows Media Player 10, my Windows Explorer gets closed. Some movies run fine, some collapse explorer.exe. Finally, my computer displayed the message that said that its a "Data Execution Prevention" and explorer needs to close.

Is it a virus thats causing this trouble? Microsoft knowledgebase says its very much possible.

I ran Avast, but it detected nothing on my PC.

What should I do?

Regards,
Abhishek

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Data Execution Prevention--Looks like an Infection
« Reply #1 on: March 26, 2005, 08:29:08 PM »
For the past 4-5 days, whenever I am watching movies on Windows Media Player 10, my Windows Explorer gets closed. Some movies run fine, some collapse explorer.exe. Finally, my computer displayed the message that said that its a "Data Execution Prevention" and explorer needs to close.
Is it a virus thats causing this trouble? Microsoft knowledgebase says its very much possible.

Maybe not...
Can you check your Data Execution Prevention options? (Control Panel > System > Advanced > Performance (Configuration) > Data Execution Prevention
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Data Execution Prevention--Looks like an Infection
« Reply #2 on: March 26, 2005, 08:47:04 PM »
It's just a guess, but it may be caused by a buggy video codec (especially when you say that only specific movies are affected). Did you install or update any codecs recently (or let Media Player download one)?

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #3 on: March 26, 2005, 08:50:27 PM »
Checked them. Initially they were On for all major windows services. I turned it off for Explorer and Windows Media Player. Didnt Help. The problem persists.
The error report says that it contains the file: C:\DOCUME~1\Mittal\LOCALS~1\Temp\ba10_appcompat.txt

When I go to this path, there is nosuch file as it!!

HELP!

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #4 on: March 26, 2005, 08:53:01 PM »
I installed Nimo Codec Pack a month back but uninstalled it that time only. WMP didnt download any new codecs for sure.

BanziBaby

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #5 on: March 26, 2005, 09:28:22 PM »
I had a similar prob with a dodgy plugin crashing WMP 10, try looking in the "background plugin" section in the options & remove or delete any that are found, my prob was caused by Morgan Stream Swticher that came with Klite Mega Codec pack.

U can safely leave the Nero fast cd burning plugin if it there.

BaNzI ;D

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #6 on: March 26, 2005, 10:21:32 PM »
No Plug-in except the Nero plug-in.....What NOW?

BanziBaby

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #7 on: March 26, 2005, 10:53:20 PM »
What version of WMP 10 do U have?

Mine is version 10.00.00.3802, if Urs is lower then try updating it by runnin the file setup_wm.exe in the Windows Media Player directory.

I never used the Nimmo codec pack, but i get a feeling it might be the cause of Ur probs, when using any Codec pack it strongly advised to uninstall any other codecs or codec packs on Ur system before u install a new one, i always uninstall Klite mega pack before installing any newer versions.

Was there any other plugins in the other sections other than default ones?

BaNzI ;D

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #8 on: March 27, 2005, 10:33:01 AM »
I have the same version of WMP10 as you.. There are no plug-ins except Nero.

Can you tell me why is WMP crashing Explorer.exe too?

Will changing my default player to some other player be of any use?


« Last Edit: March 27, 2005, 10:41:29 AM by abhi_mittal »

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #9 on: March 27, 2005, 03:32:20 PM »
Well I uninstalled WMP10, repaired XP and reinstalled WMP.

The problem is that if I go to My Computer/D:/ MovieslList/ ....my explorer shuts down with an appcompat.txt file in the error report.

Why is explorer shutting down?
Pls help me!!!

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #10 on: March 27, 2005, 08:46:47 PM »
Changed the player, no use. Pls help!

whocares

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #11 on: March 27, 2005, 08:54:20 PM »
Changed the player,

to what ? what happens exactly then ?

did you try
www.irfanview.com (including the plugins)

or Realplayer, or even quicktime (not that I recommend the latter 2) ?


abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #12 on: March 27, 2005, 11:24:25 PM »
I tried Real, Winamp, Jeataudio, Power DVD, WMP9 etc.
Seems certain files in the movie directory simply CRASH explorer when I try to access them.

abhi_mittal

  • Guest
Re: Data Execution Prevention--Looks like an Infection
« Reply #13 on: March 28, 2005, 10:53:22 AM »
Can large media files contain malicious code?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Data Execution Prevention--Looks like an Infection
« Reply #14 on: March 29, 2005, 10:12:19 AM »
It's quite unlikely, I'd say.

Maybe Explorer is crashing because it's trying to show a preview (or just read some info) of the files, using the corresponding codec... it is necessary to find out where (i.e. in what module) it crashes.
Try to start DrWatson before browsing the directory and see if it's able to collect some more info about the crash.