DEP Error

[CityShrimp]

My supervisor at work's laptop, Dell Latitude D610, is getting an error at random intervals.
The box is titled Data Execution Prevention, and it closes the WMI service/application.
Under details, this is listed

EventType : BEX P1 : wmiprvse.exe P2 : 5.1.2600.2180 P3 : 41107bbd
P4 : unknown P5 : 0.0.0.0 P6 : 00000000 P7 : 00d0e970
P8 : c0000005 P9 : 00000008

Also, another error

Disk free space has dropped below the minimum threshold. Free up space on your hard disk drive by:
1. Backing up your data to a tape backup, ZIP or network drive.
2. Delete unused files.

If you are unsure which files are safe to move or delete, contact your Help Desk or consult your software manuals

appears when he turns on/off his external harddrive. Not sure if the two issues are related, but these are bugging him, and being the only person with nothing to do in the office, I have to figure out what's up. Searched yahoo and google and microsoft website with no success. Please help!

 

[Bob Anderson]

Originally posted by: CityShrimp
My supervisor at work's laptop, Dell Latitude D610, is getting an error at random intervals.
The box is titled Data Execution Prevention, and it closes the WMI service/application.
Under details, this is listed

EventType : BEX P1 : wmiprvse.exe P2 : 5.1.2600.2180 P3 : 41107bbd
P4 : unknown P5 : 0.0.0.0 P6 : 00000000 P7 : 00d0e970
P8 : c0000005 P9 : 00000008

Also, another error

Disk free space has dropped below the minimum threshold. Free up space on your hard disk drive by:
1. Backing up your data to a tape backup, ZIP or network drive.
2. Delete unused files.

If you are unsure which files are safe to move or delete, contact your Help Desk or consult your software manuals

appears when he turns on/off his external harddrive. Not sure if the two issues are related, but these are bugging him, and being the only person with nothing to do in the office, I have to figure out what's up. Searched yahoo and google and microsoft website with no success. Please help!

Assuming he's using XP, do the following

start/control panel / system /advanced /performance / settings / data execution prevention

If the bottom of the box says the processor does not support hardware based DEP then check the box 'turn on DEP for essential windows programs and services only'.

If you don't see that message, then check the box 'turn on DEP for all programs and services except those I select' and put the name of the offending program in the white box. It appears to be wmiprvse.exe

Now as far as the external hard drive is concerned, it should be a simple matter to see how full it is. In explorer, find its drive letter and right click on it then go to properties. You should see a picture of it. If it appears to be more than 80% in use, then get rid of the junk files. Or get a larger drive.

If he gets that error message and the drive has lots of unused space, then there is something wrong and it will need to be looked at by a repair shop.

-Bob

 

[Bozo Galora]

As Anderson mentioned, your boss may have installed a program that is incompatible with DEP
http://support.microsoft.com/default.aspx?scid=kb;en-us;875351&Product=winxp
FWIW: with a good AV you dont need DEP
You can turn it off completely by editing boot.ini by making the following change
/noexecute=AlwaysOff

explained-
/noexecute=policy_level

where policy_level is defined as AlwaysOn, AlwaysOff, OptIn, or OptOut.
(case sensitive, Capitol A capitol O)

or he has a virus that uses the name wmiprvse.exe
http://www.neuber.com/taskmanager/process/wmiprvse.exe.html
REMEMBER - DEP is SUPPOSED to protect from things like worms, it may just be doing its job


possibly separately, or connected, "turning on and off" an EXTERNAL HDD to a laptop may have screwed the file table or degraded it to FAT32/16. Need lots more info on external HDD
what file system it is formatted in, how many partitions, size. make, type (USB?)
you didnt mention if he can actually SEE the data on external despite error
and how is he "switching" on and off external?
You are going to have to go to disk manager and see what the external looks like as far as configure

 

[Nothinman]

FWIW: with a good AV you dont need DEP

Not true at all, it's very possible to have someone break into your system and not install a virus.

 

[Bozo Galora]

Dear Mr. Nothingman:

oh, now you are going to stalk me,heh?
didnt like the fact i corrected you on Win 98 ram leakage?
I have been noticing you treat the O/S forum here like its your own personal property - but it isnt

well, just stay out of my face, and FWIW, I could care less what you think about anything
I will just ignore your posts to me anyways.
And I will continue to post here, when it suits me.

 

[Nothinman]

oh, now you are going to stalk me,heh?
didnt like the fact i corrected you on Win 98 ram leakage?

Feeling a little self-important are we? I had totally forgotten about that thread, but from what I remember you stopped posting after I asked for a deeper analysis on your part, but I don't even remember which thread it was so I guess I could be wrong.

I will just ignore your posts to me anyways.
And I will continue to post here, when it suits me.

I never told you to stop posting anything and you ignoring my posts makes perfect sense since it's not like you ever include any real facts to backup your claims. And if you would like to post something other than an ad-hominem attack next time that would sure be a nice change of pace. You know? Attack the argument and not the person and all that.

 

[CTho9305]

CityShrimp, you may want to ignore anyone who thinks you don't need DEP if you have AV protection since that person clearly has no understanding of computer security.

 

[CityShrimp]

It's still early in the morning, and my boss isn't in yet, so I wasn't able to try any of the methods given but to reply a few things.

- My boss's external harddrive is not full, but it doesn't seem to be a hardware problem since the external does not give errors when loaded unto another PC / Laptop.
- I checked the possibility for virus earlier on, but only found 1 copy of wmiprvse.exe and it was in the right folder.

So just to make sure, would it be safe to turn off DEP if my boss has AV installed? Or should I find another solution besides turning it off?

Also, if it is a program that is incompatible, is there a way to find out which program?

Thanks for all your support.

 

[Bob Anderson]

Originally posted by: CityShrimp
It's still early in the morning, and my boss isn't in yet, so I wasn't able to try any of the methods given but to reply a few things.

- My boss's external harddrive is not full, but it doesn't seem to be a hardware problem since the external does not give errors when loaded unto another PC / Laptop.
- I checked the possibility for virus earlier on, but only found 1 copy of wmiprvse.exe and it was in the right folder.

So just to make sure, would it be safe to turn off DEP if my boss has AV installed? Or should I find another solution besides turning it off?

Also, if it is a program that is incompatible, is there a way to find out which program?

Thanks for all your support.

You do not want to turn off DEP if you can help it. When you get a DEP error message, the name of the problem program is mentioned. It is that problem program which you want to enter into the list of programs for DEP to ignore. Try entering wmiprvse.exe and wait a few days to see if the DEP error message reappears.

-Bob

 

[Nothinman]

So just to make sure, would it be safe to turn off DEP if my boss has AV installed? Or should I find another solution besides turning it off?

You don't want to turn off DEP, DEP stops programs from executing code from memory that's not supposed to be executable, 9 times out of 10 when that happens it means the app has done something really wrong and will likely crash anyway and DEP just makes it crash immediately and stops the crash from doing any extra damage by executing code it shouldn't. There are (were?) a few exceptions for things like a Java JVM that actually needs the ability to do that but those cases are extremely rare and I don't even know if it still applied to Sun's JVMs.

 

[mechBgon]

I munged around on Google and found a page in Japanese that seems to hint at the Dell OpenManage software possibly causing a DEP warning. Here's the page via Google's translation feature:

<a target=_blank class=ftalternatingbarlinklarge href="http://translate.google.com/translate?h...um=2&ct=result&prev=/search%3Fq%3Dsite]http://translate.google.com/translate?hl=en&sl=ja&u=http://support2.jp.dell.com/jp/jp/download/document.asp%3Fdn%3D303133&sa=X&oi=translate&resnum=2&ct=result&prev=/search%3Fq%3Dsite<img src=---i/expressions/face-icon-small-happy.gif--- border=---0--->ell.com%2BDell%2BLatitude%2BD610%2BData%2BExecution%2BPrevention
2BDEP%26hl%3Den%26lr%3D">big huge URL</a>

So go to http://support.dell.com and see if they have an updated OpenManage client for his particular lappie. Any good?

 

[Nothinman]

Or just remove the Dell crap...

 

[mechBgon]

Originally posted by: Nothinman
Or just remove the Dell crap...

:beer:

 

[CityShrimp]

I tried what Bob Anderson suggested and added WMI into the list of programs for DEP to ignore.
My boss hasn't said anything to me about the problem after, so I'm guessing it's good now

Thanks for all the help!

 

[Nothinman]

My boss hasn't said anything to me about the problem after, so I'm guessing it's good now

If the only criteria to 'good' is placating your boss, then yea you're probably fine.

 

[Bob Anderson]

Originally posted by: Nothinman

My boss hasn't said anything to me about the problem after, so I'm guessing it's good now

If the only criteria to 'good' is placating your boss, then yea you're probably fine.

Cheap shot.

Get a better attitude.

-Bob

 

[mechBgon]

Originally posted by: Bob Anderson

Originally posted by: Nothinman

My boss hasn't said anything to me about the problem after, so I'm guessing it's good now

If the only criteria to 'good' is placating your boss, then yea you're probably fine.

Cheap shot.

Get a better attitude.

-Bob

I think Nothinman has a point, whether you like his delivery style or not. Excluding a Windows service from DEP protection is less than ideal from a security standpoint. Internet Explorer 7 has triggered DEP several times for me... should I exempt IE7 from DEP's protection, too? Hey, it'll fix those annoying DEP dialogue boxes...

How about uninstalling the OpenManage software, if it's not in a managed environment, and see if that gets equally-good results without leaving a Windows service excluded from DEP protection.

 

[n0cmonkey]

If a program is throwing up DEP errors the program probably isn't good enough to be running.

Saying you don't need DEP if you run antivirus is a horribly irresponsible statement...

 

[Nothinman]

Cheap shot.

Get a better attitude.

-Bob

Not at all, if his goal was to actually fix the problem then he's failed but if the goal was just to get his boss to stop calling him then he's succeeded. The fact that the WMI stuff is causing DEP errors problably means it's not working right anyway so just putting it on the DEP whitelist only gets rid of the DEP messages but the root problem is still there.

 

[CityShrimp]

Originally posted by: mechBgon

Originally posted by: Bob Anderson

Originally posted by: Nothinman

My boss hasn't said anything to me about the problem after, so I'm guessing it's good now

If the only criteria to 'good' is placating your boss, then yea you're probably fine.

Cheap shot.

Get a better attitude.

-Bob

I think Nothinman has a point, whether you like his delivery style or not. Excluding a Windows service from DEP protection is less than ideal from a security standpoint. Internet Explorer 7 has triggered DEP several times for me... should I exempt IE7 from DEP's protection, too? Hey, it'll fix those annoying DEP dialogue boxes...

How about uninstalling the OpenManage software, if it's not in a managed environment, and see if that gets equally-good results without leaving a Windows service excluded from DEP protection.

Well.. I never said that I don't want to get the root cause of the problem out of the way, but if I had any idea how to do that in the first place, I would've said that in my original post. Anyways, my boss just called me right now and said the problem occurred again. So he's just gonna go and format the whole thing.

Oh, and for the record, it's not my job to fix these people's computers, so I dont' think I should be held liable for simply trying to get rid of the symptoms. Also, my boss is more experienced and knowledgable about troubleshooting, so asking me was like a last resort to see if I have any wild ideas as to fixing the problem.

 

[porcorosso]

I have seen applications which interact with various Windows components cause those Windows components to run afoul of DEP.

Eample: Interestingly enough an application called SnagIt (by TechSmith) causes a reproducible situation in which Windows Explorer (in Windows XP SP2 and Vista RTM) gets shut down by DEP when a flash memory drive is removed from the system. It took a while to pin this down to the Explorer extensions added by SnagIt.

It turned out that the SnagIt extension / add-on for Outlook 2007 also ran afoul of DEP.

Software, no matter how useful, that causes basic operating system components to get shut down by DEP needs to go away.

 

[Nothinman]

I have seen applications which interact with various Windows components cause those Windows components to run afoul of DEP.

An Explorer extension is more than interacting with Explorer, it's essentially becoming a part of the Explorer process so as you saw any time it does something stupid Explorer pays the price.

 

[porcorosso]

Thank you. Exactly the point I wanted to make -- and could have made more clearly. Any time a Windows component fails muster by DEP standards you have to at least suspect that the fault lies with something that has been added to the mix, not with the Windows component itself.

 

[Nothinman]

Yes, but I just wanted to be perfectly clear on how the interaction was being done. =) Because there are many ways to interact with Windows components, if the problem app was using something like DCOM it wouldn't affect Explorer at all because it's just a form of interprocess communication.