• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Data Exectution Prevention

J

JdoubleG

n00b
Joined
Sep 21, 2003
Messages
61
I had an intresting experience tonight. I was surfing the net and listening to music, when an error message comes up that say's something along the lines of "an error has occured and your system needs to shutdown in one minute" It then proceeded to countdown from the minute and shut down. I couldn't help but think that it was like something out of a movie. Anyways, i did some poking around in the help file and apperently this is caused by a feature called Data Execution prevention. Appernetly some program (Possibly a virus :( ) tried to access a system file it shouldnt' have, so windows shut it down. Maybe i'm retarded and everyone knows about this, but I thought it was intresting.

Any thoughts?
 
That sounds like the sasser or blaster worm.

What version of windows and which service pack do you have? The Data Execution Prevention code is only after SP2. I havn't seen any errors from the Data Execution Prevention yet so I'm not sure what it actually does when it's executed.

More than likly it's one of the worms.
 
It'll cause the application to A/V. I would imagine this came from a worm as well, unless you are running SP2, and then it is possible but unlikely, that the process that closed was accessing a program that violated DEP.
 
puck said:
That sounds like the sasser or blaster worm.

What version of windows and which service pack do you have? The Data Execution Prevention code is only after SP2. I havn't seen any errors from the Data Execution Prevention yet so I'm not sure what it actually does when it's executed.

More than likly it's one of the worms.
Click to expand...

Sounds that way to me too. Go hit the windows update site asap and do a virus scan while you are at it. If you do already have SP2 then I'm stumped. May want to check event log for info about this one.
 
DEP doesn't cause your pc to restart.

it seriously sounds like the blaster worm.

DEP would give an error message like this:

Data Execution Prevention
A Windows security feature has detected a problem and closed this program.
Name: Application name
Publisher: Application Publisher
Data Execution Prevention helps protect against damage from viruses or other security threats. How does it work?
Advanced OK buttons
Click to expand...
 
I looked at the screen shot that one of you sent me, it was definatley the worm. I do have SP2, on windows home edition. Thanks for everyones comments.
 
whichever one the dude with the screenshot showed.. at least i saw a screen very similar to it.
 
There is no worm hitting SP2 specifically, but there are plenty out there hitting Windows in general. This looks like a case where DEP is not allowing a program to run, unless the original post is actually saying that the whole machine is restarting, not just the program being shut down (it's difficult to tell).
 
Nope, the whole machine restarted. DEP did it's thing on restart, and i've been running Virus scans Adware and spybot since... and they all keep coming up with new stuff, I think my computer is being raped.
 
Have you checked your event logs for notices about dump files? It sounds more like you've got something causing a memory dump (BSOD) then restart, which would seem like instantaneous rebooting to the uninformed. To shut off this reboot at memory dump, go to the System menu (Start>>Control Panel>>System OR windows key + pause/break), go to the Advanced tab, click the Startup and Recovery button, then uncheck "Automatically restart" a little more than halfway down.
 
He says the entire system shuts down, and he says he gets whats in the screenshot.. That screenshot is the RPC shutdown warning/timer. It doesnt resemble the memory dump/BSOD screens at all. You can't mistake the two for eachother.
I wasn't aware of any variant of Blaster, or any other current worm, working against SP2 yet. I havent heard of anyone else getting anything like this.

For JdoubleG: Do you have Windows Firewall, or any other firewall, enabled?
If not, get it up now.
 
My guess is that he got the RPC worm before SP2. However, how, is kinda moot now, he's infected.

Did you go through the link I posted on removal?
 
You must log in or register to reply here.
Back
Top