Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Notification from DEP?

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 03-31-2008
Ray
 

Posts: n/a
Notification from DEP?
Is data execution protection supposed to notify me when it stops a
program from running? The only "notice" I get is that nothing happens
when I click a program's shortcut. Now that I've learned the signs (or
lack thereof) of DEP in action I know when to tell it to allow a
certain program, but it seems like it should let me know about the
problem.

--
Ray
(remove the Xs to reply)
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 04-01-2008
MowGreen [MVP]
 

Posts: n/a
Re: Notification from DEP?
Why is Windows closing my program?
http://windowshelp.microsoft.com/Win...e63cf1033.mspx

> Windows might close a program and then notify you if it determines that the program is either a
> security risk or incompatible with this version of Windows.
> When Windows closes a program because of a security risk, it is because some programs might use
> your computer's random access memory (RAM) in a way that could be exploited by a virus and harm
> your computer. Data Execution Prevention (DEP), a security feature of Windows, tracks how
> programs use memory. If DEP finds memory being used incorrectly, DEP will close the program and
> let you know. If you trust the program, you can add it to an exceptions list so that DEP won't
> close it, but you should first check with the manufacturer of the program to see if there is an
> updated, DEP-compatible version available.

<snip>

Have the programs been added to the DEP exception list ? According to
the above one *should* be
notified if one hasn't added them to the exception list.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Ray wrote:

> Is data execution protection supposed to notify me when it stops a
> program from running? The only "notice" I get is that nothing happens
> when I click a program's shortcut. Now that I've learned the signs (or
> lack thereof) of DEP in action I know when to tell it to allow a
> certain program, but it seems like it should let me know about the
> problem.
>

Reply With Quote
  #3 (permalink)  
Old 04-02-2008
JohnDavid
 

Posts: n/a
RE: Notification from DEP?
For what it's worth, I've experienced inconsistent responses from DEP.
Sometimes a msg box states that DEP has prevented a program from running, yet
other times it happens as you described -- the exe doesn't run and nothing
displays to alert me to that fact. I've also learned to add them to the
exception list. The obvious danger with the latter is that we are
cicrcumventing the protection that DEP is supposed to be providing.

"Ray" wrote:

> Is data execution protection supposed to notify me when it stops a
> program from running? The only "notice" I get is that nothing happens
> when I click a program's shortcut. Now that I've learned the signs (or
> lack thereof) of DEP in action I know when to tell it to allow a
> certain program, but it seems like it should let me know about the
> problem.
>
> --
> Ray
> (remove the Xs to reply)
>

Reply With Quote
  #4 (permalink)  
Old 04-02-2008
DevilsPGD
 

Posts: n/a
Re: Notification from DEP?
In message <2EF9F2FB-EA19-4514-A301-EEE62BB85F27@microsoft.com>
JohnDavid <JohnDavid@discussions.microsoft.com> wrote:

>For what it's worth, I've experienced inconsistent responses from DEP.
>Sometimes a msg box states that DEP has prevented a program from running, yet
>other times it happens as you described -- the exe doesn't run and nothing
>displays to alert me to that fact. I've also learned to add them to the
>exception list. The obvious danger with the latter is that we are
>cicrcumventing the protection that DEP is supposed to be providing.


The other interesting thing about DEP is that the exception list isn't
fully effective, one of the software components I support fails to run
under DEP. In the majority of cases, adding the executable to the DEP
exclusion list does the trick, but in a non-trivial number of cases, the
software still crashes randomly, without notice. Setting DEP to
AlwaysOff in boot.ini resolves the issue.

The problem only occurs on hardware which supports NX, the pure-software
DEP appears to exclude properly in all cases.
Reply With Quote
  #5 (permalink)  
Old 04-03-2008
JohnDavid
 

Posts: n/a
Re: Notification from DEP?
Yes, I've also experienced the (sometimes) ineffectiveness of the exclusion
list. I've wondered (but not researched) how DEP is trying to perform its
function: does it simply exclude the entered EXE; does it try to relate the
entered EXE to other components of the application; is the exclude feature
failing or is DEP invoked for a related EXE in the app or even for code
executed out of a DLL run by some other process.

Since my encounters with DEP are only in the home environment, my approach
has been that if I can't get the app past DEP after a few tweaks (of what to
exclude), then I just don't run the app -- luckily, no software I've paid
for so far.

"DevilsPGD" wrote:

> In message <2EF9F2FB-EA19-4514-A301-EEE62BB85F27@microsoft.com>
> JohnDavid <JohnDavid@discussions.microsoft.com> wrote:
>
> >For what it's worth, I've experienced inconsistent responses from DEP.
> >Sometimes a msg box states that DEP has prevented a program from running, yet
> >other times it happens as you described -- the exe doesn't run and nothing
> >displays to alert me to that fact. I've also learned to add them to the
> >exception list. The obvious danger with the latter is that we are
> >cicrcumventing the protection that DEP is supposed to be providing.

>
> The other interesting thing about DEP is that the exception list isn't
> fully effective, one of the software components I support fails to run
> under DEP. In the majority of cases, adding the executable to the DEP
> exclusion list does the trick, but in a non-trivial number of cases, the
> software still crashes randomly, without notice. Setting DEP to
> AlwaysOff in boot.ini resolves the issue.
>
> The problem only occurs on hardware which supports NX, the pure-software
> DEP appears to exclude properly in all cases.
>

Reply With Quote
  #6 (permalink)  
Old 04-04-2008
Ray
 

Posts: n/a
Re: Notification from DEP?
"MowGreen [MVP]" <mowgreen@nowandzen.com> wrote:

> Why is Windows closing my program?
> http://windowshelp.microsoft.com/Win...93886b9-292f-4
> 2e2-8702-512e67ae63cf1033.mspx
>
>> Windows might close a program and then notify you if it
>> determines that the program is either a security risk or
>> incompatible with this version of Windows. When Windows closes a
>> program because of a security risk, it is because some programs
>> might use your computer's random access memory (RAM) in a way
>> that could be exploited by a virus and harm your computer. Data
>> Execution Prevention (DEP), a security feature of Windows, tracks
>> how programs use memory. If DEP finds memory being used
>> incorrectly, DEP will close the program and let you know. If you
>> trust the program, you can add it to an exceptions list so that
>> DEP won't close it, but you should first check with the
>> manufacturer of the program to see if there is an updated,
>> DEP-compatible version available.

> <snip>
>
> Have the programs been added to the DEP exception list ? According
> to the above one *should* be
> notified if one hasn't added them to the exception list.


No, they haven't been added to the list, which is why they don't run.
But DEP has never notified me when it has stopped a program.
Fortunately I learned early on that if a program doesn't do anything
when I click its icon, then DEP is stopping it. Once the program is
added to the exception list, it works fine.

--
Ray
(remove the Xs to reply)
Reply With Quote
  #7 (permalink)  
Old 04-04-2008
Ray
 

Posts: n/a
RE: Notification from DEP?
<JohnDavid@discussions.microsoft.com> wrote:

> For what it's worth, I've experienced inconsistent responses from
> DEP. Sometimes a msg box states that DEP has prevented a program
> from running, yet other times it happens as you described -- the
> exe doesn't run and nothing displays to alert me to that fact.
> I've also learned to add them to the exception list. The obvious
> danger with the latter is that we are cicrcumventing the
> protection that DEP is supposed to be providing.


True, but in my case the programs I've had problems with are ones I've
used for years in earlier versions of Windows, so security isn't an
issue.

--
Ray
(remove the Xs to reply)
Reply With Quote
  #8 (permalink)  
Old 04-04-2008
DevilsPGD
 

Posts: n/a
Re: Notification from DEP?
In message <C0BC5232-15B6-48D0-84EF-56D036D54B48@microsoft.com>
JohnDavid <JohnDavid@discussions.microsoft.com> wrote:

>Yes, I've also experienced the (sometimes) ineffectiveness of the exclusion
>list. I've wondered (but not researched) how DEP is trying to perform its
>function: does it simply exclude the entered EXE; does it try to relate the
>entered EXE to other components of the application; is the exclude feature
>failing or is DEP invoked for a related EXE in the app or even for code
>executed out of a DLL run by some other process.


I've tried adding DLLs to the exclusion list too, without any success.
However, that may or may not be supported, or even possible.

>Since my encounters with DEP are only in the home environment, my approach
>has been that if I can't get the app past DEP after a few tweaks (of what to
>exclude), then I just don't run the app -- luckily, no software I've paid
>for so far.


On my desktop, I tend to agree. However, we've got some fairly large
server packages where this isn't an option.

The software is mainly written in C++, but has a built-in AV feature (AV
definitions can actually contain scriptlets or even executable code in
some cases), plus some third party components in compiled PERL, none of
which is especially DEP friendly right now.

However, the vendor has a pretty strong security track record, both in
terms of overall vulnerabilities discovered, and rate of patching, so
the lack of DEP doesn't stress me much.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
notification strider microsoft.public.windows.vista.mail 2 01-28-2008 00:35
Email notification Richard microsoft.public.windows.vista.mail 1 01-12-2008 19:31
WGA Notification (KB905474) eli microsoft.public.windowsupdate 4 11-28-2007 05:02
notification add on ReadAd microsoft.public.windows.vista.mail 1 05-24-2007 18:08
New mail notification =?Utf-8?B?U25vdyBIYXRlcg==?= microsoft.public.windows.vista.mail 2 04-12-2007 15:54




All times are GMT +1. The time now is 07:10.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120