BEX event ID 1001 - Acrobat crashing

Acrobat DC Pro is installed on Windows Server 2012 R2 in a RDS environment. Acrobat is randomly crashing and it looks to be related to Data Execution Prevention. Below id the BEX event error message. The faulting module is MSVCR120.dll which is part of the Visual C++ 2013 Redistributable. Would this morelikely be an Acrobat issue or a Visual C++ 2013 Redistributable issue? Beside disabling DEP altogether are there any other troubleshooting suggestions? Note that I tried disabling DEP just for Acrobat.exe but it's not allowed and the following message is displayed "This program must run with data execution protection (DEP) enabled. You cannot turn off DEP for this program."

Event ID 1001
Fault bucket , type 0
Event Name: BEX
Response: Not available
Cab Id: 0
Problem signature:
P1: Acrobat.exe
P2: 15.8.20082.15957
P3: 55960c1a
P4: MSVCR120.dll
P5: 12.0.21005.1
P6: 524f7ce6
P7: 000a7666
P8: c0000409
P9: 00000007
P10:

Attached files:
C:\Users\user1\Desktop\Invoice 21960.pdf
These files may be available here:
C:\Users\user1\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_Acrobat.exe_dd3f 64b5713822381087b1533a46c31dcf05d3c_aab9ae81_0d180f61
Analysis symbol:
Rechecking for solution: 0
Report Id: 21c0e4ee-4bf5-11e5-80c6-000d3a907940
Report Status: 2048
Hashed bucket:

August 31st, 2015 2:55pm

Since posting I have since disabled DEP at the system level using

bcdedit.exe /set {current} nx AlwaysOff

In Task Manager I turned on the Data Execution Prevention column to show the DEP status for all processes. Even though DEP is disabled, all Windows system process still show that DEP is enabled. Only non-system process have DEP disabled apparently.

With DEP disabled, Acrobat stopped crashing with the BEX error for a couple of days however it still crashed with a different error:

Event ID 1000

Faulting application name: Acrobat.exe, version: 15.8.20082.15957, time stamp: 0x55960c1a
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0xe06d7363
Fault offset: 0x00014598
Faulting process id: 0x3284
Faulting application start time: 0x01d0e74b745a6c1b
Faulting application path: C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Faulting module path: C:\Windows\SYSTEM32\KERNELBASE.dll
Report Id: b464835b-533e-11e5-80ca-000d3a907940
Faulting package full name:
Faulting package-relative application ID:

 

Event ID 1001

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: Acrobat.exe
P2: 15.8.20082.15957
P3: 55960c1a
P4: KERNELBASE.dll
P5: 6.3.9600.17415
P6: 54504ade
P7: e06d7363
P8: 00014598
P9:
P10:
Attached files:
C:\Users\user1\AppData\Local\Temp\WERCAC4.tmp.appcompat.txt
C:\Users\user1\AppData\Local\Temp\WERCC0D.tmp.WERInternalMetadata.xml
C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_Acrobat.exe_a5b0db4 7cb38998dd8e0c5d5c81b85e7b3d7c8b_aab9ae81_cab_3e38cc1b\memory.hdmp
C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_Acrobat.exe_a5b0db4 7cb38998dd8e0c5d5c81b85e7b3d7c8b_aab9ae81_cab_3e38cc1b\triagedump.dmp

These files may be available here:
C:\Users\user1\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_Acrobat.exe_a5b0db 47cb38998dd8e0c5d5c81b85e7b3d7c8b_aab9ae81_cab_3e38cc1b

Analysis symbol:
Rechecking for solution: 0
Report Id: b464835b-533e-11e5-80ca-000d3a907940
Report Status: 4
Hashed bucket:

And on top of that, the BEX errors have now retuned as well. It's the same error as in the original post. Keep in mind DEP is disabled now for Acrobat. For the BEX error, the faulting module is MSVCR120.dll. Since that is a system file, is Windows still using DEP for any code contained in that DLL? In other words, even though DEP is disabled at the system level, and therefore Acrobat is not being monitored by the DEP subsystem, could DEP still be crashing Acrobat if Acrobat is accessing MSVCR120.dll in a way that DEP deems problematic?

Free Windows Admin Tool Kit Click here and download it now
September 8th, 2015 9:49pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics