[Messerschmitt]

Greetings. I come back with another little problem. Not so often I get this Data Execution Prevention, caused by Explorer.exe. It always shows up after the computer finished booting up in windows, and I do something (Open Firefox, Explorer, etc). If it dosen't show up by then, the whole session it will not show up again. Once I press ok, the standard error that windows encountered a problem and need to close, shuts down explorer.exe (you lose the taskbar and all) for a few seconds then comes back up.
Is there a way to run a diagnostic for it and figure out what's up with it?
Thanks

This post has been edited by Messerschmitt: 12 May 2009 - 08:35 AM

[cluberti]

You have an explorer shell extension causing the error when it tries to load and hook explorer.exe if it only happens once for the life of the session. You can see your hooks with a combination of Sysinternals' Autoruns and Nirsoft's ShellExView.

[buckdog05]

It might be a virus, but I saw a computer that was having a problem like this because of a bug in HP Wireless Printer software. An update from the HP website fixed the problem. It was pretty obnoxious, considering I reformated the computer before realizing that the HP Printer Program was the culprit.

It was also giving me an error about "Dr. Watson," believe, are you also getting this?

[Messerschmitt]

buckdog05, on May 14 2009, 08:30 PM, said:

It might be a virus, but I saw a computer that was having a problem like this because of a bug in HP Wireless Printer software. An update from the HP website fixed the problem. It was pretty obnoxious, considering I reformated the computer before realizing that the HP Printer Program was the culprit.

It was also giving me an error about "Dr. Watson," believe, are you also getting this?

No, I dont get any error about Dr.Watson. I just get an error for windows explorer and windows encountered a problem and needs to close

[Messerschmitt]

Ok, I have finally installed both Autoruns and ShellExView... But I am not sure what am I looking for.

[Messerschmitt]

bump again?

[-X-]

In Autoruns, click Options > Hide Windows and Microsoft entries, look at the shell extensions loaded in the Explorer tab. You need to click refresh after hiding the MS entries,

[Messerschmitt]

Ok, hided those 2, clicked refresh, this is what I have. This is a few minutes after I got again the Data Execution Prevention very shortly after my PC booted up.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
0 <---Only says File Not Found: About:Home
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
Acronis True Image Shell Context Menu Extension
Adobe.Acrobat.ContextMenu
Kaspersky Anti-Virus
TuneUp Shredder Shell Extension
WinRAR
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
TuneUp Disk Space Explorer Shell Extension
TuneUp Shredder Shell Extension
WinRAR
HKLM\Software\Classes\Directory\Shellex\DragDropHandlers
WinRAR
HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers
FileZilla3CopyHook
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
PDF Shell Extension
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers
Acronis True Image Shell Context Menu Extension
Adobe.Acrobat.ContextMenu
Kaspersky Anti-Virus
WinRAR
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
ACE
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Acronis True Image Shell Context Menu Extension
Acronis True Image Shell Extension
Adobe.Acrobat.ContextMenu
Catalyst Context Menu extension
Display Panning CPL Extension <---Again says file not found: deskpan.dll
HyperTerminal Icon Ext
Logitech Setpoint Extension
Logitech Setpoint Extension
TuneUp Disk Space Explorer Shell Extension
TuneUp Shredder Shell Extension
TuneUp Theme Extension
Web traffic protection statistics
WinRAR shell extension

Anyway to figure out which of these shell's causes the error?

[-X-]

Try disabling a few and see if the problem goes away. Rinse, repeat.

[cluberti]

Agreed - the 50/50 rule to start, then start narrowing down from there.

[Messerschmitt]

Ok will start do that. So disable 1 by 1 until I get the error then go for the next yes? Also if disabling with Autorun, how do I go so that at the next boot-up the options will be remembered. On save, it just saves it as a file

[-X-]

I would disable more than one or you will be there all day.
The options are remembered. See below.
When you uncheck one, it deletes the original and writes a registry key named disabled... as a backup and so that autoruns can read that it's disabled.

[Messerschmitt]

Yep, just noticed what I un-checked was remembered. And well, my problem is that this DEP is quite randomly, so what I will do is just take my time. I will leave something un-checked until I will get it again, and then move to the next. It will take maybe up to a few weeks. I will just bump the thread then.
Anyway, cheers for all the help you 2 provided! Much appriciated.
Also if ShellExView can help into this somehow, let me know and how

[Messerschmitt]

Hi.
I'm bumping this up because I ended un-checking ALL the components under Explorer in Autoruns, and I still got the Data Execution Prevention.