[korhinta]

hello everyone, and i'm sorry to bother you (again). this is a sort-of continuation of this thread:
http://www.geekstogo...23#entry1840723

long story short, i got data execution prevention alerts, so i posted in the malware forum. turns out there was no malware involved.
RKinner (thanks again! :-) sugested my hard drive might be dying.

i managed to burn the bootable diagnostic cd, which corrected 3 errors, and then my hd passed the diagnostic test.

i used the acer erecovery hidden partition to return my laptop to its factory settings. i only installed avast!, firefox and adobe flash, and had no problems for a month.

then i installed some of the other programs i use frequently, and the same evening i got 2 data execution prevention alerts, windows needs to close this program: windows explorer, plus dr.watson's postmortem debugger.
these programs are:
skype
foobar (media player)
gomlab (------//----)
open office
winrar
divx
and any-video-converter.com

on a sidenote, most (but not all) the data execution prevention alerts pop up when i'm using windows movie maker, or shortly afterwards.

to be honest, i've gotten used to them. i "unfreeze" my compu with windows task manager, and go back to work. but i would appreaciate it if you could help me at least understand why i get them, if not get rid of them.

thanks.



ps.i'm not entirely sure i'm posting this in the right forum, if not please move it, or redirect me appropriately.

[Advertisements]

The fact the HDD passed the diagnostic test after repairing bad sectors, which it cannot actually do, it simply recovers the data from the bad sector and transfers it to a good sector. does NOT mean that the advice in the Malware forum was not 100% correct.
In conclusion the bad blocks can’t be fixed. The problem is a permanent one and we can only try to use the hard disk until it is broken down for good. This is a copy and paste from my database on hard drives.
Never mind the HDD diagnostic test for the immediate need.
Go start, run and type "cmd" without the quotes.
When the window opens type "cd\" without quotes - do not type the quotes in any cmd I give you
Then type "fsutil dirty query C:"

This is NOT the cause of the Data Execution Prevention. that may well be Winrar, it has aused this problem before, it may however be another program you have installed, but it is pointless exploring that until we know that the HDD does not have bad sectors.

Edited by Macboatmaster, 04 October 2010 - 07:38 PM.

[Macboatmaster]

The fact the HDD passed the diagnostic test after repairing bad sectors, which it cannot actually do, it simply recovers the data from the bad sector and transfers it to a good sector. does NOT mean that the advice in the Malware forum was not 100% correct.
In conclusion the bad blocks can’t be fixed. The problem is a permanent one and we can only try to use the hard disk until it is broken down for good. This is a copy and paste from my database on hard drives.
Never mind the HDD diagnostic test for the immediate need.
Go start, run and type "cmd" without the quotes.
When the window opens type "cd\" without quotes - do not type the quotes in any cmd I give you
Then type "fsutil dirty query C:"

This is NOT the cause of the Data Execution Prevention. that may well be Winrar, it has aused this problem before, it may however be another program you have installed, but it is pointless exploring that until we know that the HDD does not have bad sectors.

Edited by Macboatmaster, 04 October 2010 - 07:38 PM.

[korhinta]

just to make sure, because your (re)post is slightly defensive/aggresive, i was in no way suggesting that the advice i received was not correct, to whatever percentage.

back on topic, i did what you said, and got a "C: is NOT dirty" message. i attach a screenshot, just to make sure i typed everything correctly.

thanks for your assistance.

[Macboatmaster]

It was not in anyway meant to be aggressive. It was simply to point out to you that when I drive passes some diagnostic tests, that have been setup to repair bad sectors, it does not mean that the drive is not failing. It has passed the test because the data has been recovered from the bad sectors. The real question is "Were bad sectors found"

Turning to the Data Execution Prevention, there are a number of solutions. See this. One way is to turn off data execution prevention for all except Essential Windows programs. You can if you knowhow, turn it off COMPLETELY, but this is not recommended.
http://techblissonli...ndows-xp-vista/

http://pcsupport.abo...explorerexe.htm
ADVICE Use only the options on the Data Execution Window do not attempt any of the typed commands.

You can also allow certain programs.

Unfortunately a DEP message when running a program, does not always mean it is THAT program, itself that is causing the error.

Edited by Macboatmaster, 05 October 2010 - 10:27 AM.

[diabillic]

What tool did you use to diagnose the HDD?

[Macboatmaster]

I think you will find he used Seatools from Seagate. It is I think what was said on the link to his malware forum post.

[korhinta]

macboatmaster,

thanks again for your reply... since i'm 99% computer illiterate,
(1)is my hd in the clear? and
(2)the dep disabling you're suggesting will help me identify/isolate the program that causes the alerts, or it's just meant to help me get rid of the deps as a symptom (but not their cause)?


diabillic,

macboatmaster is correct. i'm not sure if your question pertains to my case, or you want to diagnose your own hdd, so if it's the latter, i followed rkinner's instructions here: http://www.geekstogo...ts/page__st__15 to identify my drive and find the right diagnostic.

[diabillic]

Post a screenshot of your DEP settings. It should be set to "Turn on DEP for essential Windows programs and services only"

[Macboatmaster]

On the evidence available from the dirty query YES.


If you do as I suggested in Post 4, - set for All Essential Windows programs .
OR open each program in turn, establishing beyond doubt that the cause is, as you suspect, Windows Movie Maker. It is quite safe to allow that program through the DEP - again see my post 4. for how to do this.
There are very limited settings in DEP, but if you open it and then click on How does it Work - you will see all the Microsoft Advice.
The danger of allowing a program through. which is executed on the other setting, ALL except as specified - such as Windows Movie Maker, come NOT from that but from what is then opened.
The link which explains it in an easier to follow format is this
http://pcsupport.abo...explorerexe.htm
from my post 4.

Edited by Macboatmaster, 05 October 2010 - 11:39 AM.

[The Skeptic]

Re. hard disk: to the best of my knowledge, when the disk utility report that problems were fixed, that means that the bad sectors were marked as such in the file table and are ignored by the computer. My opinion is that the disk is in working condition and you shouldn't worry about that. Only if errors that cannot be repaired are found that the disk is damaged beyond repair (even then, quite often, I manage to salvage such disks by running low level format which zeroes all the bits on the disk. High level format that follows recreates new sectors, file tables etc.)

I am quite convinced that one of your programs cause the problem. Please download WhoCrashed from the links below, run the program and attach the report to your next post.

[korhinta]

thanks to all 3 of you. especially for the peace of mind regarding my hd.

whocrashed report:

Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.


No valid crash dumps have been found on your computer


--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

Crash dumps are enabled and no valid crash dumps have been found on your computer. In case your computer does experience sudden reboots it is likely these are caused by malfunctioning hardware, power failure or a thermal issue. To troubleshoot a thermal issue, check the temperature using your BIOS setup program, check for dust in CPU and motherboard fans and if your computer is portable make sure it's located on a hard surface. Otherwise it's suggested you contact the support department of the manufacturer of your system or test your system with a memory test utility for further investigation.

i'm still trying to get my head around disabling the deps, etc. will report back.

Edited by korhinta, 05 October 2010 - 01:33 PM.

[The Skeptic]

WhoCrashed didn't find anything because what you have are alerts which do not create crash dumps. I should have thought about that beforehand.

Have a look in the Event Viewer (Control panel > administrative tools) and see if you can see any significant errors (red x). If nothing found then either take Macboatmaster line of thought and disable the alert or remove the suspicious programs, one at a time, and see if the problem disappear. If it does, consider using another program for the same job.

[korhinta]

Turning to the Data Execution Prevention, there are a number of solutions. See this. One way is to turn off data execution prevention for all except Essential Windows programs.

Post a screenshot of your DEP settings. It should be set to "Turn on DEP for essential Windows programs and services only"

that's how it is/was... see attached screenshot (i didn't change anything). so what do i do now?

[diabillic]

How about trying a sfc /scannow from the run box, lets make sure your Windows files are in tact.

[korhinta]

Have a look in the Event Viewer (Control panel > administrative tools) and see if you can see any significant errors (red x).

i have several red xs, in both system (sources: Dhcp, W32Time, Service Control Manager), and applications (sources: Application Error, Application Hang).