Explorer Crashing (DEP)

[Michael]

Hello all,

 

Over the past few days a few users have been receiving a DEP (Data Execution Prevention) message with regards to Windows Explorer. I literally just received the message myself and I haven't a clue what's causing it.

 

This has happened at two sites running either XP SP2 or XP SP3. The only common factor so far is all these machines are used to run CMIS.

 

Checking the Application Log, I found the following:

 

Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x5a022e08.

 

Googling the error code: 0x5a022e08 comes up with nothing. I'm obviously the first in the world to have this problem Any ideas would be welcome.

[Guest Guest]

I go tone on a brand new server yesterday. I had installed server 2003 litterally 10mins before i got the error.

[Michael]

Interesting you have the problem on a server. I've only had it happen on XP. It must be a recent update, but Google and Microsoft have no information about the error given. Really strange to say the least.

[techyphil]

We also have this issue since we installed Sept SIMS update. Its happened on all machines with SIMS so far.

 

I've also googled it and nothing.

 

 

Sometimes it happens 4 times within 15mins.

[Michael]

Thanks for that techyphil. It appears both Sims and CMIS both include something to cause this error. I'm glad I'm not alone, but as yet no fix which is a bit frustrating!

[JOrdan01070]

I get a simalaar error in eventvwr but a different hex address below is the message i get

 

Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x63fc1480.

 

I don't have CMIS or SIMS in stalled on my laptop.

[DaveJ2717uk]

Had the same problem with server 2008 on a virtual machine at home, this was just after install and running windows update, and been ongoing for a while, put it down to being virtual, now beginning to think it's an update of some kind messing the system up. Gotta love microsoft:mad:

[ShorehamGeek]

I'm getting similar on 3 different XP clients so far. All SP2.

 

Deep joy.

[DavidSkeen]

I was thinking sophos and the "web-content scanning" since it seems to have started since the sept update.

 

I know it's not true web content but perhaps it and explorer are not getting along

 

hi by the way

[Michael]

Hi David and welcome to Edugeek.

 

You are right actually, Sophos 4.34E was recently released but the problem only seems to be happening on admin machines at the moment.

[ShorehamGeek]

We're a sophos site too. The thought had crossed my mind......

[ScottMason]

Are you running Sophos Anti Virus?

 

FYI any one running Sophos we have discovered an issue with 7.6 which causes DEP errors similar to those being described

 

We have today replicated and fixed the fault and an update 7.6.1 will be released tomorrow.

 

For more info see the following link:

 

http://www.sophos.com/support/knowledgebase/article/46484.html

[googlemad]

Ah!

 

I got this on my machine first login today, someone else got it after opening and closing a spreadsheet. Thought it was a bit of a fluke for 2 machines to do it at the same time.

 

On the subject of Sophos updates, the 'Restart Now / Restart Later' dialog that has been coming up with some recent updates is REALLY annoying when most of our classrooms are on Deep Freeze!!

[TechSupp]

I was beginning to think it was me! Glad (sorry guys) that other are getting this mesage, had it on XP SP2 PC's and the 2003 server! Got Sophos running on the network as well so hope when the update is downloaded it will sort this message out. So far its only me complaining about it at the schools.

[Michael]

We have today replicated and fixed the fault and an update 7.6.1 will be released tomorrow.

 

Looks promising as yes, I am running Sophos too. Will post again when the new update is received.

[mrtechsystems]

Excellent news congrats

[apeo]

Really odd, my bro was getting this earlier in the week. He was playing Spores and getting it started crashing then he found that he couldnt open up 'My Computer'. Not sure how this problem started but to fix it i had to turn it off for Windows Explorer. Dunno if it is at all related..

[Irazmus]

I've had this a few times at home, I've been putting it down to the evil that is SecuRom since it (and other instabilities) started the day I installed Spore.

[IQGroup]

Legends!

 

The only result on Google, and it's useful for once, none of that half answered, or abandoned thread stuff...

 

Another reason to move from Sophos too

[browolf]

according to sophos:

 

A fix for this issue will be released with Sophos Anti-Virus, version 7.6.1.

[sab_sophos]

Hi all,

 

Thought I'd give you an update on this.

 

PROBLEM:

 

As per:

Sophos Anti-Virus for Windows 2000+: Data Execution Prevention message displayed when closing Windows Explorer

 

WORKAROUNDS:

 

As well as the three solutions outlined in this article (1. disable the scanner locally, machine by machine, 2. disable the scanner globally using a domain group-policy, or 3. stop Explorer.exe from loading the Sophos Web Content Scanner),

 

- there's now a fourth option, a special 'RC2' build of Sophos Anti-Virus that comes with the web-scanner switched OFF by default. I'd recommend this one over the previous 3. You need to set EMLibrary to download it, as follows:

 

1) 'Select parent' in the EMLibrary Console needs to be set to 'es-central-3...' , not es-latest-3.... (choose it from the drop-down 'select parent' menu - your normal credentials should work).

 

2) Under the 'select packages' menu, select either :

(i) 'Windows Endpoint Security and Control 8.0 with SAV 7.6.0 RC2 VDL4.34E' , or

(ii) 'Sophos Anti-Virus for Windows 7.6.0 RC2 VDL4.34E'

 

- the 'RC2' in the name means it's the special build.

 

If you unsubscribe from your 'normal' SAV / Endpoint Security package BEFORE subscribing to the RC2 version, then you'll be able to download the RC2 into your usual Central Installation Directory, and your client PCs will update to it automatically.

 

Alternatively, specify a different CID, then change the client-PCs' updating policy accordingly.

 

Hope this helps.

 

Simon B.

Sophos Technical Support, Abingdon.

Contact Sophos technical support - Enterprise solutions

Edited October 3, 2008 by sab_sophos

[john]

When will the V7.6.1 be here thought, as I gues RC2 is just the release client for it, and your staff said that 7.6.1 would be with us Friday!!!

[markwilliamson2001]

I have had this as well...It caused my network to crawl as well, and YES we do run Sophos. I have gone off Sophos of late, and we also run XP SP2 and 3 clients.

 

Not sure what version we are on Sophos at the moment, (since we have been so busy doing other things) but will check on Monday. I have also posted a related issue in the Networks section of this site here:

 

http://www.edugeek.net/forums/networks/24783-network-crawl-then-sudden-speed-up.html

 

Didn't ever think that this (Sophos) was something to do with it, but will report back on Monday.

 

Regards

Mark

[sab_sophos]

Hi John,

 

I think Scott, in his earlier post, meant "7.6.0 RC2", which was indeed released on Friday the 3rd of October. (7.6.1 is not due until the end of October) - sorry for the mix-up.

 

Simon B., Sophos Support.

Edited October 6, 2008 by sab_sophos

[ShorehamGeek]

Thanks for the workaround. Is there an expectation of when the fix will be included in the main update? i.e. when should I change my settings back to update from the "latest" virus definition library?