XP: Windows Explorer generating Data Execution Prevention error when copying files
Recently, my XP SP3 began generating this error: Data Execution Prevention - Microsoft Windows To Help Protect your computer, windows has closed this program. Name: Windows Explorer Publisher : Microsoft Corporation EventType : BEX P1 : explorer.exe P2 : 6.0.2900.5512 P3 : 48025c30 P4 : unknown P5 : 0.0.0.0 P6 : 00000000 P7 : 04c49290 P8 : c0000005 P9 : 00000008 Explorer closes and is restarted. Sometimes, DrWatson itself will crash during the error reporting. This happens only intermittently, when I copy/move files. It may be limited to copying/moving multiple files; as few as 2 will set it off. It does not happen with every copy/move, however. I do not want to disable DEP protection. I want to correct the underlying problem.2 people need an answerI do too
May 20th, 2010 12:12am

Can you upload the dump file from Dr. Watson to your SkyDrive, and provide a link? (To find the location of the file, run drwtsn32.exe and check the Crash Dump field.)
Free Windows Admin Tool Kit Click here and download it now
May 20th, 2010 5:27am

Me too!!!I just upgraded to XP SP3. My box was virus free and running fine before the upgrade. Now after the upgrade many times after I boot up (or within 30 mins thereafter) I get a popup "Data Execution Prevention". It says Windows Explorer. Close the message then shortly after the desktop crashes. BTW, I have XP Home Edition.I have had people suggest to configure DEP to ignore the error (ie add an exception in DEP config box) but I am hesitant to start adding exceptions in DEP becase doesnt that leave those programs unprotected? I'd rather fix the ROOT CAUSE. Does anyone have any inisght into what would be causing this to suddenly happen on SP3 but not before when I was on SP2? I'd like to identify and fix root cause.Whats is causing this and what is the fix? Many thanks!!
September 5th, 2010 1:15am

Let me translate those kinds of suggestions for you:I have no idea what the problem is, I don't know how to figure it out and I don't know how to fix it.You are on the right track to find the root of the problem instead of just hiding it.Describe your current antivirus and anti malware situation: McAfee, Norton, Spybot, AVG, Avira!, MSE, Defender, ZoneAlarm, PC Tools, Comodo, etc.You should next run some good scans for malicious software and try to make sure that is not the problem:Download, install, update and do a full scan with these free malware detection programs:Malwarebytes (MBAM): http://malwarebytes.org/SUPERAntiSpyware: (SAS): http://www.superantispyware.com/They can be uninstalled later if desired.After running the scans, be sure to reboot and then test. Data Execution Prevention (DEP) messages mean that Windows feels threatened by some program running on your computer, so it shuts it down. This is actually a good thing since Windows recognizes the threat and is trying to prevent further damage.You could tell Windows that the program is okay by making an exception for the program, but this is generally not a good idea. You could also just disable the DEP protection entirely to suppress the error, but that is also not a good idea either - DEP is there for a purpose. You will not fixed the underlying problem and have made your computer vulnerable to attack by disabling the protection or choosing to ignore the threat. If it is Windows Explorer that is reporting the Data Execution Protection error, suspect a non Microsoft Explorer Shell Extension. Shell Extensions help make up the Right Click menu for files you see in Explorer. (Internet Explorer DEP errors are dealt with a little differently).You can download ShellExView from here to see which ones you have loaded:http://www.nirsoft.net/utils/shexview.htmlShellExView doesn't install anything on your computer, it just runs and displays.When you launch it, the non MS extensions will be in light pink, but on some systems that is a hard color to see, so click View, Choose Columns and move the Microsoft column closer to the top so you can see it on your screen without having to scroll left and right.Sort the display by clicking the Microsoft column so all the "No"s are at the top and easy to see.The "No"s in the list would be things you have added (non Microsoft).I am not a trial and error advocate, but I can't think of another way to do this unless I know all your extensions... Right click and disable the non Microsoft extensions one at a time keeping a list so you can enable them again later if desired. The result of the change is immediate and no reboot is required. Test your failure condition.If you recognize any extensions that may have been added or downloaded recently, start with those. The Extensions are not uninstalled, just disabled.You can also disable all the non Microsoft extensions, reboot and enable them one at a time until you find the one that generates the condition.Always put a reboot in yor test cycle to be sure you have isolated the suspicious Extension. You may have more than one.The hope is that you will find the one Extension that causes the error and then you can figure out what to do about it - usually get an update from the maker of the extension from their WWW page. Example: if it is an Adobe or PowerDesk extension, you probably need an update to their products.When you disable/enable the extensions, the Extension is immediately disabled/enabled, so disabling one does not actually require a reboot but if you think you have the right one, I would reboot anyway to really be sure your changes "stick".When you find the extension that is the problem, please let us know what it is so i can add it to my list. There may be some clues in the Event Log.Here is a method to post the specific information about individual events.To see the Event Viewer logs, click Start, Settings, Control Panel, Administrative Tools, Event Viewer.A shortcut to Event Viewer is to click Start, Run and in the box enter:%SystemRoot%\system32\eventvwr.msc /sClick OK to launch the Event Viewer.The most interesting logs are usually the Application and System. Some logs such as Security and Internet Explorer may be completely empty or have only a few items. The default settings for XP is not to log all that activity unless you need to troubleshoot some issue in those areas. If you enable the logging for them the logs fill up quickly and could negatively effect your system performance with all the extra (usually unnecessary) activity.If you have Microsoft Office installed, it has its own logs and they may be empty or occasional boring activity or very little activity if there is no problem with your Office applications. This is normal.Not every event is a problem, some are informational messages that things are working okay and some are warnings.No event should defy reasonable explanation.Each event is sorted by Date and Time. Errors will have red Xs, Warnings will have yellow !s. Information messages have white is. Not every Error or Warning event means there is a serious issue. Some are excusable at startup time when Windows is booting. Try to find just the events at the date and time around your problem.If you double click an event, it will open a Properties window with more information. On the right are black up and down arrow buttons to scroll through the open events. The third button that looks like two pages on top of each other is used to copy the event details to your Windows clipboard.When you find an interesting event that occurred around the time of your issue, click the third button under the up and down arrows to copy the details and then you can paste the details (right click, Paste or CTRL-V) the detail text back here for analysis. Remove any personal information from your information after pasting if you are compelled to do so.If you paste an Event, it will look something like this boring system startup event:Event Type: InformationEvent Source: Service Control ManagerEvent Category: NoneEvent ID: 7035Date: 7/14/2010Time: 5:54:18 PMUser: JoseComputer: ComputerDescription:The Remote Access Connection Manager service was successfully sent a start control.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.To get a fresh start on any Event Viewer log, you can choose to clear the log (backing up the log is offered), then reproduce your issue, then look at just the events around the time of your issue and troubleshoot the events that are happening when you have your issue. Do you really think suggestions that begin with the words try , might or maybe are going to be helpful?I need YOUR votes and points for helpful replies and Propose as Answers. I am saving up for a pony!
Free Windows Admin Tool Kit Click here and download it now
September 5th, 2010 2:54am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics