DEP (data execution protection) with KIS6, Lot of DEP causing BSOD on Core 2 duo Options

[adb63]

I have a neuw computer working fine from week under XP SP2, with Norton Internet Security (preinstalled by Acer) on it.
I decided to switch to KIS.
I downloaded the last version of KIS (in French) 6.0.1.411, remove Norton using the remover and following instruction in Kaspersky Forum, rebooted, and installed KIS without any problem.
After installation, there is a request for reboot (normal) and after, KIS starts to update without any problem.
BUT, after 15 seconds, I get the DEP windows from XP teling that Microsoft update is stopped, plus a windows telling that Microsoft uptade stopped, plus DrWatson window, followed by DEP for DrWatson, and same thing for other Microsoft programs... 30s later, the PC is freezed, and requires a hard reboot to start.
I managed to desactive DrWatson, and closng the first windows quickly, I can have a boot of XP, but with many DEP errors.
I check with KIS, no virus found.
I run CCleaner, no change.
When I start Excel, i get a BSOD followed by a reboot within 2 seconds. (Not easy to read the blue screen...)
I unsinstalled KIS, and everything is OK.
I clean all with the Kaspersky remover, and reinstall KIS. Same behaviour...
I uninstall KIS, I installed F-Secure, it runs well.
So, for me, it's clearely a KIS problem.
What is the problem ?
The configuration is the following:
Acer 9524, Core 2 duo, 2GB RAM
XP Media Center (French version)
MSOffice, plus some working tools (no game)

Thank you in advance for your help.

[Lucian Bara]

Hello
Try enabling the compatibility mode under settings->service and do a reboot.

[Cray2Mpx]

I experienced the same problem with an ACER 5200 from my niece yesterday.
I installed KIS6 after removing all Symantec stuff and as described DEP was kicking in after the first reboot causing the machine eventually to freeze altogether. In my case I have identified a conflict caused by the Acer Empower suite of system utilities which is preinstalled on the Notebook.
After removing the Acer Empower application from the Windows XP's Startup folder and rebooting of the system KIS6 runs fine. If the Acer Empower GUI is then started manually at a later time KIS6 is still fine and no DEP events are seen.
Looks like KIS6 has got a problem with the Acer utilities when starting "simultaneously".

[adb63]

Hello Lucianbara,
You are again the first to answer! Thanks.
Your suggestion does not work, sorry.
I uninstalled F-Secure, install again KIS, same problem.
I put the compatibility option, restart, same problem.
Good idea, but we have to find something else.

[adb63]

I experienced the same problem with an ACER 5200 from my niece yesterday.
I installed KIS6 after removing all Symantec stuff and as described DEP was kicking in after the first reboot causing the machine eventually to freeze altogether. In my case I have identified a conflict caused by the Acer Empower suite of system utilities which is preinstalled on the Notebook.
After removing the Acer Empower application from the Windows XP's Startup folder and rebooting of the system KIS6 runs fine. If the Acer Empower GUI is then started manually at a later time KIS6 is still fine and no DEP events are seen.
Looks like KIS6 has got a problem with the Acer utilities when starting "simultaneously".

Thanks for you help Cray2Mpx
but Acer Empower was already removed from the startup folder.
There is also Acer software started from registers, I will try that after.

[adb63]

Good News!
After downloading the KIS updates, everything is OK.
I desactivate compatibility mode and restart, and it's OK too!
So what happened ?
I think the following:
- It's not due to compatibility mode option (tanks anyway lucianbara)
- There is a new KIS update to fix that ?
Could you confirm that lucianbara ?

[Don Pelotas]

Good News!
After downloading the KIS updates, everything is OK.
I desactivate compatibility mode and restart, and it's OK too!
So what happened ?
I think the following:
- It's not due to compatibility mode option (tanks anyway lucianbara)
- There is a new KIS update to fix that ?
Could you confirm that lucianbara ?

No bugfix has been released, so something else changed.

[adb63]

No bugfix has been released, so something else changed.

Thanks Don,
So I have to find what was changed...
I hate this type of unlogical behaviour, so I will investigate.

[Don Pelotas]

Open a supportticket, if this continue's:http://support.kaspersky.ru/helpdesk.html?LANG=en

[adb63]

OK. Some news...
I have negliged a KIS Proactive message at windows startup telling
"invader" for PID928 with
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
tries to integrate to another process
Yesterday, I looked on Google what is LVPrcSrv.exe and I was thinking that it's a legitimate Logitech file, and the message from KIS was a false positive (but why the Orbicam Camera needs to integrate on other process ????)
But, If I answer quickly the KIS proactive defense message using the "deny" option, (about 5 times at startup), all is OK.
If I add it to "trust zone" (I just done it ) the windows gets plenty of DEP messages and get bloqued within 30s. An hard reset is required to get out.
I restarted windows in safe mode (F8), started KIS manually, get out the LVPrcSrv.exe process from trusted zone, restarts, use the deny option quickly on KIS Proactive defense message, and I can work finally.
So I think the problem is linked to LVPrcSrv.exe.
What is that XXXXXXXX buggy piece of code ???????
The info comming from "properties" are:
Type: application
Description: Logitech LVPrcSrv Module
Size: 86016 bytes
Created: 2006 june 23, 10:40:58
Version: 9.4.4.1082
Enterprise: Logitech
Language: English(USA)
...
Don, what can I do to help Kaspersky ?

[Lucian Bara]

hello
This is actually a known issue.
you can do the following, open start->run and type services.msc there look for the logitech service, right click it and select properties. Set the startup tye to disabled, click ok and reboot. This service is normally not required for your cam to funtion.

[adb63]

Thanks Lucianbara, it works fine.
Disabling the Logitech Orbicam software LVPrcSrv.exe in services, there is no more problems neither Proactive Defense messages.
The Orbicam camera is still working, so it's fine.
Is it a bug in Logitech software or in KIS software ?
And why Norton and F-Secure are not worried by this software ?

[Don Pelotas]

Is it a bug in Logitech software or in KIS software ?
And why Norton and F-Secure are not worried by this software ?

A bit of both probably.

[Lucian Bara]

It's probably because of the way kaspersky hooks on the windows kernel that creates the conflict.

[adb63]

Probably something like that! and something that can be optimized in Kaspersky labs ...
Thanks you Lucianbara and Don Pelotas for your help.
Best regards.

[tildenm]

hello
This is actually a known issue.
you can do the following, open start->run and type services.msc there look for the logitech service, right click it and select properties. Set the startup tye to disabled, click ok and reboot. This service is normally not required for your cam to funtion.

I have the same problem, have done this and still not working. I get the message frequently when I run explorer, or word, or outlook when the camera is plugged in. When the system boots up it has only 1 or 2 of such errors too... Help?

[Lucian Bara]

hello
keep the service disabled and also enable the compatibility mode and do a reboot.

[squall_leonhart6...]

if your having issues with DEP, edit the boot.ini in the root of drive C and change /noexecute=optin to /execute=optin. then restart.
this effectively disables DEP but since your using Kaspersky, theres no need for DEP (i and many other users disable it for compatiblity purposes)

the DEP implementation in XP SP2 is pathetic at best. its basically grafted on.

This post has been edited by squall_leonhart69r: 17.01.2007 18:47

[tildenm]

if your having issues with DEP, edit the boot.ini in the root of drive C and change /noexecute=optin to /execute=optin. then restart.
this effectively disables DEP but since your using Kaspersky, theres no need for DEP (i and many other users disable it for compatiblity purposes)

the DEP implementation in XP SP2 is pathetic at best. its basically grafted on.

That worked great, thanks!

[vladi]

Thank all for your help. Same problem has been resolved on Acer 5623 notebook (also Core2 Duo T5500)!