Jump to content
mfn

Data Execution Prevention (DEP) & Outlook Express

Recommended Posts

Hello all. I have recently purchased 2 licenses for KIS 6.0 and will activate them as soon as my trial periods expire. I think KIS is terrific – very light on resources and highly configurable. My two PCs are running so much faster, I feel like I bought hardware upgrades.

 

I do have a few questions though, none of them earth shaking. I have searched this great and informative forum, but I have not found answers to these questions. I will post each of my unrelated questions in separate posts.

 

One of my PCs, which I built myself, uses hardware enabled data execution prevention (DEP). The OS is Windows XP SP2, all critical updates installed. The Windows firewall is disabled. Its hardware includes:

CPU: AMD Athlon 64 3500+ (Clawhammer core)

Motherboard: MSI K8N Neo4 Platinum (nForce4 Ultra chipset) (socket 939)

RAM: Corsair TwinX XMS CMX512-3200C2PT (2x512MB) 1GB Dual Channel DDR400

Graphics: MSI PCX5750 128MB PCI-Express (I am not a gamer :) )

 

After I installed KIS v6.0.0.303, Outlook Express had to be excluded from DEP monitoring for it to open properly. Closing KIS completely and excluding KIS from DEP monitoring did not solve this issue, indicating that KIS is not causing the problem. However, this issue did not exist prior to KIS installation.

 

My previous anti-virus software, PC-cillin Internet Security 2005, was thoroughly removed prior to KIS installation. No other anti-virus, firewall or other real-time monitoring software has ever been installed on this machine, except Sunbelt CounterSpy v1.5.8.2, which I use for periodic, manual on demand scanning only (auto startup and real-time monitoring are disabled). All KIS settings are set to "Recommended" except I disabled Mail Anti-Virus and Anti-Spam, and checked "Scan new and changed files only" for all scanning tasks.

 

I have no OS or KIS crashes when this happens, so there are no dumps created. (In fact, this PC has never blue screened after one and a half years of service – wonder of wonders :) ). An Event Viewer Application error is generated, which reports, "Event Source: Application Error, Event Category: (100), Event ID: 1000, Description: Faulting application msimn.exe, version 6.0.2900.2180, faulting module oeas.dll, version 6.0.0.299, fault address 0x0001bb20."

 

Does anyone have any ideas why Outlook Express would no longer work with hardware enforced DEP after KIS installation? Is the KIS klif.sys driver causing a conflict with one of my other drivers, and for now it’s only showing up in this issue?

 

Thank you very much for a great product.

Share this post


Link to post

You said you're trialing KIS 6.0.0.303.

Did you install this version over the 6.0.0.299 ?

I'm asking you, because the error you posted is related with build 299 (faulting module oeas.dll, version 6.0.0.299, fault address 0x0001bb20).

 

Have you tried to uninstall KIS completely, and reinstall it ?

Edited by DonKid

Share this post


Link to post

DonKid, KIS v6.0.0.303 is the only version I have installed. I downloaded and installed the trial version from usa.kaspersky-labs.com two weeks ago. The downloaded file was called kis6.0.0.303enTRIAL.exe. Also, the KIS service screen confirms v6.0.0.303 is installed.

 

The oeas.dll v6.0.0.299 referenced in my application error report was installed by kis6.0.0.303enTRIAL.exe. The oeas.dll file is located in the C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0 folder, and is dated March 24, 2006. It is 124,456 bytes in size.

 

Oeas.dll is referred to as an Outlook Express (OE) Anti-Spam plug-in, but even with Anti-Spam disabled, or KIS disabled and closed completely, I still get the DEP error when opening OE. The problem is only resolved when I exclude OE from DEP monitoring. Then KIS and OE get along just fine with all modules enabled if I choose.

 

I have not tried to uninstall and reinstall KIS yet, because KIS is otherwise working perfectly as far as I can tell.

 

With this information in mind, if you think I should still uninstall and reinstall, I’ll give it a shot.

 

Thank you very much for your previous, speedy reply.

Share this post


Link to post

Try to uninstall KIS and before reinstall it, see if the problem still exists.Then reinstall KIS and let's see how you go.

Share this post


Link to post

Will do, but I can’t do it right now. I will report my results tomorrow. Thanks again.

Share this post


Link to post

Okay, here are my results. After uninstalling KIS v6.0.0.303 (as a reminder, this is the only version ever installed on this PC), removing Outlook Express (OE) from the DEP exclusion list, and rebooting, OE was able to open and run with no problems while being monitored by hardware enforced DEP.

 

Immediately after reinstalling KIS and rebooting, OE was blocked from opening by DEP. I also got the same application error report that I noted in my original post (#1 above, paragraph 6). When I excluded OE from DEP monitoring, OE opened and ran fine.

 

So it seems that the KIS oeas.dll file is interfering with something on my PC by preventing OE from being monitored by DEP.

 

Ultimately, this is not a big deal for me, but it may be for others who might experience this issue. Except for this OE/DEP issue, KIS is running great on this PC. Like I said in my original post, I have already purchased two licenses and will activate them as soon as my trial periods expire.

 

Any other thoughts or suggestions about this?

 

Thanks again.

Share this post


Link to post

I had this problem with released versions of KAV on XP Pro. I had to exclude OE from hardware and software DEP. I am now using a beta version (old beta) .344 and OE is now protected by DEP. I had the same problem with PrintScreen and now it too is protected. You might want to try a beta version of KIS.

Share this post


Link to post

Mele20, thanks for the info and suggestion. Unfortunately, my hardware based DEP PC is a production machine, and I can’t afford to put betas on it. But I do use imaging software in case something goes wrong. I have another PC which I can use for beta testing, but it does not support hardware DEP.

 

Since you said the .344 beta fixed the problem on your machine, hopefully MP1, due to be released soon from what I read on this forum, will fix it on mine.

 

Thanks again.

Share this post


Link to post

Just following up to report that a clean install of MP1 did not fix my DEP/Outlook Express issue described in my original post above. The behavior is the same with KIS 6.0.1.411 (MP1) installed as it was with KIS 6.0.0.303.

 

With KIS 6.0.0.303 completely uninstalled including using the KisKav6Remove tool, OE launched and worked fine with hardware DEP enabled. With KIS 6.0.1.411 (MP1) installed clean, OE does not open with DEP enabled. Disabling DEP for OE allows OE to open and work fine.

 

I’m glad the .344 beta fixed the problem on Mele20’s PC, but MP1 did not fix it on my machine. Hopefully, the good folks at KL will be able to correct this in a future update.

Share this post


Link to post

I too am having problems with DEP (both hardware and software) turned on when Kaspersky anti-virus 6.0 is running. Under hardware DEP, Opera wouldn't open at all and IE 7 had intermittent problems. With hardware DEP turned off and software DEP on, the machine became unusable; practically all programs would trigger problems, starting with Windows Update.

 

This is a new Dell Precision workstation and showed no problems until Kaspersky was installed. The problems went away when Kaspersky was disabled. They also went away when Kaspersky was enabled and DEP disabled in boot.ini

Share this post


Link to post
I too am having problems with DEP (both hardware and software) turned on when Kaspersky anti-virus 6.0 is running.  Under hardware DEP, Opera wouldn't open at all and  IE 7 had intermittent problems.  With hardware DEP turned off and software DEP on, the machine became unusable; practically all programs would trigger problems, starting with Windows Update.

 

 

Opera opens fine for me using KAV .411 version but Opera is not protected by hardware or software DEP. It is the only program I have that is not protected and I think I read that is normal but I don't recall why.

Share this post


Link to post

Heck. I have the problem with KAV and OE again now. I was in the middle of reading an email in OE when DEP popped up and said it had to close OE to protect my computer. Sigh.

 

I also have the problem with the GUI aspect of ProcessGuard no longer being protected by DEP and that in the past was caused by KAV also. What other programs are going to start giving me a problem?

 

I am not happy with MP1. I wish I could go back to .344. That was the best KAV for me. DEP worked for all programs and I had the one and only thing I like in MP1 in .344 and that is the "scan on execution" which was added.

 

I restarted OE and for the moment it is protected by DEP but who know when it will get shut down again.

 

I don't want to and won't exclude programs from DEP. If KAV cannot get along with DEP then I am afraid that KAV will have to go not DEP.

Share this post


Link to post
To all: are you using Logitech webcam drivers?

 

Yes, they're for the webcam that's built into the top of the laptop screen.

 

I am setting up a new machine (Dell XPS M1210 laptop), installing all the software I had on my previous machine (Dell Precision M70 laptop), including KIS 6.0. The problem is that on the new machine, whenever KIS or KAV 6.0 are installed, nearly all software fails on startup with either Data Execution Prevention (DEP) or “Program has encountered an error and was shut down” errors. The machine is essentially unusable if KIS or KAV are installed. Things I’ve tried that didn't work:

- uninstalling KAV/KIS, including running the KisKav6Remove utility in Safe Mode, and then reinstalling

- disabling Proactive Defense

- Different builds of KAV, dating back to October.

Share this post


Link to post

Hello all. I am the original poster of this thread.

 

I want to report good news. The good folks at Kaspersky Lab seem to have fixed the Outlook Express/hardware DEP issue in their latest release of KIS (v6.0.2.614 – MP2). With KIS full on, including Application Integrity Control, and Outlook Express removed from my DEP's exclusion list, Outlook Express now opens normally on my PC (hardware described in my original post above).

 

Thank you Kaspersky. :)

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.