1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: To help protect your computer?

Discussion in 'Windows XP' started by brillser, May 25, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. brillser

    brillser Thread Starter

    Joined:
    Mar 24, 2008
    Messages:
    2,423
    Hi all,
    I just logged in as admin, not ten mins ago, to find this waiting for me:

    To help protect your computer, windows has closed this program.

    Name : Generic Host Process For Win32 Services.

    Publisher : Microsoft Corporation.

    There is then an option to "close this message" which I did not choose.

    Beneath that option is a line and beneath that line it states:

    Data Execution Prevention Helps Protect Against damage from viruses and other security threats.
    Then this part is a link to the help and support console, it asks: What should I do?

    I clicked on the "What Should I Do" link and got this:



    Understanding Data Execution Prevention
    Data Execution Prevention (DEP) helps prevent damage from viruses and other security threats that attack by running (executing) malicious code from memory locations that only Windows and other programs should use. This type of threat causes damage by taking over one or more memory locations in use by a program. Then it spreads and harms other programs, files, and even your e-mail contacts.
    Unlike a firewall or antivirus program, DEP does not help prevent harmful programs from being installed on your computer. Instead, it monitors your programs to determine if they use system memory safely. To do this, DEP software works alone or with compatible microprocessors to mark some memory locations as "non-executable". If a program tries to run code—malicious or not—from a protected location, DEP closes the program and notifies you.
    DEP can take advantage of software and hardware support. To use DEP, your computer must be running Microsoft Windows XP Service Pack 2 (SP2) or later, or Windows Server 2003 Service Pack 1 or later. DEP software alone helps protect against certain types of malicious code attacks but to take full advantage of the protection that DEP can offer, your processor must support "execution protection". This is a hardware-based technology designed to mark memory locations as non-executable. If your processor does not support hardware-based DEP, it's a good idea to upgrade to a processor that offers execution protection features.
    Is it safe to run a program again if DEP has closed it?
    Yes, but only if you leave DEP turned on for that program. Windows can continue to detect attempts to execute code from protected memory locations and help prevent attacks. In cases where a program does not run correctly with DEP turned on, you can reduce security risks by getting a DEP-compatible version of the program from the software publisher. For more information about what to do after DEP closes a program, click Related Topics.
    How can I tell if DEP is available on my computer?
    1.To open System Properties, click Start, point to Settings, click Control Panel, and then double-click System.
    2.Click the Advanced tab and, under Performance, click Settings.
    3.Click the Data Execution Prevention tab.
    Note
    By default, DEP is only turned on for essential Windows operating system programs and services. To help protect more programs with DEP, select Turn on DEP for all programs and services except those I select.
    Related Topics


    Any input with regard to what's going on here?


    TIA.
     
  2. brillser

    brillser Thread Starter

    Joined:
    Mar 24, 2008
    Messages:
    2,423
    Oops, forgot to mention that I've recently installed SP3 on a Winxp MCE SP2 machine.


    logging off now to do some scans, back soon:D
     
  3. brillser

    brillser Thread Starter

    Joined:
    Mar 24, 2008
    Messages:
    2,423
    Hi all,
    I posted this because I had never seen such a message before, I'm still wondering what might have caused it?

    TIA.
     
  4. Jeruvy

    Jeruvy

    Joined:
    Sep 20, 2007
    Messages:
    568
    You ran a program which attempted to modify or replace a protected file. DEP prevented this action and shut down the offending program.

    Nothing to see here...move on ;)

    Now, if the app was legit (double, triple, quadruple check!!!!) then you can override with the details found at that link you graciously quoted above.

    If your not sure, delete the app, scan for malware and move on.

    Cheers.
     
  5. brillser

    brillser Thread Starter

    Joined:
    Mar 24, 2008
    Messages:
    2,423
    Hi Jeruvy,
    I was'nt running anything but firefox, on a limited user account.
    I have no truble moving on and have also done the scans, cleared the "temps" and internet files, etc. After five coldboots to admin, no such msg appears.
    I'll mark this post as sloved, but it's not really solved as I don't know what caused the msg to appear in the first place.
     
  6. Jeruvy

    Jeruvy

    Joined:
    Sep 20, 2007
    Messages:
    568
    Well it's possible ANYTHING could have caused this.

    Understand WHY the message appears is the first step. The next is to determine what.

    Unfortunately all your post indicates is svchost.exe tried to do something. Well svchost.exe does a great many things, however one of them shouldn't be to replace protected files.

    The event viewer should have logged the event and if you can gather more details relating to the event we can seek further to the source.

    But you're probably wise to forget about it and move on. In a typical day this can happen and is strictly notification of a potential problem avoided.
     
  7. brillser

    brillser Thread Starter

    Joined:
    Mar 24, 2008
    Messages:
    2,423
    hi all,
    Event viewer was the first place I checked and found nothing.

    "But you're probably wise to forget about it and move on. In a typical day this can happen and is strictly notification of a potential problem avoided."

    I was'nt aware of this, however, I am now, thanks to you.

    Although, I did say above that I had never seen the msg before, and so was, there for, concerned enough to post the thread.
     
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/715354

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice