dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1596
share rss forum feed


joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

1 edit

[IE] DEP Errors

Although DEP is turned off IE 11 crashes due to:

Windows Data Execution Prevention detected an add-on trying to use system memory incorrectly. This can be caused by a malfunction or a malicious add-on.

This does not occur on every site just 2 or 3. The last two errors from Event Viewer are as follows:

Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17126, time stamp: 0x53882e30
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x1e261c10
Faulting process id: 0x508
Faulting application start time: 0x01cf8629ba971b65
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: unknown
Report Id: 142bdbe1-f21d-11e3-8c5e-446d57f87030

Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17126, time stamp: 0x53882e30
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x3002b358
Faulting process id: 0x1920
Faulting application start time: 0x01cf86272ff526f3
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: unknown
Report Id: f098a9f5-f21c-11e3-8c5e-446d57f87030

All updates are current and the system has been thoroughly scanned for all types of malware.

I would appreciate a review of this error.

Thanks

Joe P

Windows 7 Pro SP1 64-bit


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS

I don't think you can 'turn off DEP' in toto -- at least by the control panel, it's always on for 'essential services'. And given the number of attacks that arrive via IE, it would be prudent for Microsoft to have it permanently opt-in.

But anyway: if you can believe the error message, you've got a buggy plug-in. Firstly, try those sites with all plug-ins disabled; I thought there was an easy way to start IE that way, but right now I can't find it. Maybe you will get a popup saying 'site X wants to run Y'.

If not, you'll have to start re-enabling them one-by-one until you reintroduce the error, and then you'll know.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Thanks Dave...

I did not state that I turned off DEP in Control Panel...I did it with a .reg file and I unchecked "Enhanced Protection Mode" in IE11.

I tried starting IE "without add-ons" but it did not resolve the issue.

Joe P


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8

I could be wrong, but I don't think Enhanced Protection Mode changes DEP operation.

Since you're running 64-bit Windows, does 64-bit IE work better?



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Internet Explorer Enhanced Protected Mode - Turn On or Off

»www.eightforums.com/tutorials/31···off.html


psloss
Premium
join:2002-02-24
Lebanon, KS
reply to dave

said by dave:

I could be wrong, but I don't think Enhanced Protection Mode changes DEP operation.

Yes, it (EPM) does much less on Windows 7:
»blogs.msdn.com/b/ieinternals/arc···top.aspx

quote:
...on Windows 7 and Windows Server 2008R2, the only thing that enabling Enhanced Protected Mode does is turn on 64bit Content Processes...


joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

You're correct, EPM does not change DEP but it is one of the elements to turn off in an effort to resolve this issue.

Joe P



auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18
reply to joepwpb

The "faulting module" is "unknown":

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

You could consider obtaining a user mode dump of the IE crash to see if the "unknown" module is identified.

If you copy and paste the following in Notepad and save as a .reg file, then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time iexplore.exe crashes should be created in the C:\CrashDumps folder:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\iexplore.exe]
"DumpFolder"=hex(2):43,00,3a,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,\
00,6d,00,70,00,73,00,00,00


After IE crashes, can you then upload the .dmp file to a post in this thread.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

auggy to the rescue!!!

I was hoping you would glide by this thread and as always, add your expertise.

I will install that reg file and upload the next error. I haven't had a IE crash in a couple of days.

Thanks,

Joe P



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to joepwpb

It looks like I spoke too soon...I just had an IE crash. The dmp file is attached.

Thanks

Joe P


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

The Flash32_14_0_0_125.ocx got blamed for the crash:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for iertutil.dll -
*** WARNING: Unable to verify timestamp for iexplore.exe
*** ERROR: Module load completed but symbols could not be loaded for iexplore.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for IEShims.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for wininet.dll -
*** WARNING: Unable to verify timestamp for GoogleToolbarDynamic_32_8E471B27054D20F5.dll
*** ERROR: Module load completed but symbols could not be loaded for GoogleToolbarDynamic_32_8E471B27054D20F5.dll
*** WARNING: Unable to verify timestamp for atiumdag.dll
*** ERROR: Module load completed but symbols could not be loaded for atiumdag.dll
Probably caused by : Flash32_14_0_0_125.ocx ( flash32_14_0_0_125+5db58c )


However the atiumdag.dll and GoogleToolbarDynamic_32_8E471B27054D20F5.dll appeared also to be involved in the crash.

The atiumdag.dll, a component of the AMD graphic driver appears to be dated Mar 19, 2013.

What I might suggest to try is to update the AMD graphic driver.

If the error persists uninstall Google Toolbar or rename the GoogleToolbarDynamic_32_8E471B27054D20F5.dll in the C:\Program Files (x86)\Google\Google Toolbar\Component folder to GoogleToolbarDynamic_32_8E471B27054D20F5.old and then log out and log back in again.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Thanks auggy,

First, I'll do the easier task and completely remove the Google toolbar for a while and see what happens. In the interim I will go looking for a driver update for the AMD chip.

Joe P



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to auggy

I uninstalled the Google Toolbar and just got another IE crash. Let me know if the AMD driver is still the culprit.

The dmp file is attached.

Joe P


joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to auggy

Here is another crash from this morning which hopefully will confirm the cause of the error.

Joe P


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

The atiumdag.dll appears to be the issue in both of the last crashes.

You could try the following and see if it makes a difference:

Internet Explorer > Tools > Internet Options > Advanced > then put a checkmark in front of "Use software rendering instead of GPU rendering" > OK

If that helps it would be further evidence the issue is with the display driver.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

OK...I made that setting, now we wait and see.

Thanks

Joe P



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to auggy

That didn't take long!!! Here is the latest dmp file.

Thanks,

Joe P

Should I remove that last setting I made?


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

I would suggest to leave the last setting as is until you can resolve the error.

The latest error points to again the atiumdag.dll and Flash32_14_0_0_125.ocx:

*** WARNING: Unable to verify timestamp for atiumdag.dll
*** ERROR: Module load completed but symbols could not be loaded for atiumdag.dll
Probably caused by : Flash32_14_0_0_125.ocx ( flash32_14_0_0_125+648354 )


I might suggest to uninstall and reinstall Flash and uninstall and reinstall the graphics driver using the latest version.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Thanks...

First I'll try removing and reinstalling flash player. If that fails I found an update to the graphics driver but I'm not so sure about doing an uninstall first. I'm guessing that after the uninstall it will call for a reboot to complete the uninstall and then it would find it again on restart and I'll be back to a much earlier version.

Joe P



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to auggy

It took a while but it IE crashed again. The dmp file is attached.

Thanks

Joe P


Freddy
Premium
join:2005-05-17
Arlington, VA
kudos:2

1 edit
reply to joepwpb

joepwpb,

You can uninstall the graphics driver, but don't reboot even if Windows calls for it. Then install updated driver.

Freddy

Edit: Or you can reboot in safe mode after removing the driver and then install the new driver in safe mode.



auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18
reply to joepwpb

The latest crash references the Flash32_14_0_0_125.ocx so go ahead and update the graphics driver.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Thanks...

I did not find just the "driver" at AMD rather I found the "A Series APU" and the "Catalyst Control Center" software.

Googling for a AMD Radeon 7560HD driver comes up with sites that want you to use their driver update" software. I do have Slim Drivers installed and it did find a driver which I tried to install but it failed due to incompatibility.

Can you help me sort this out?

Joe P



cmcasey79

join:2000-12-10
Allen Park, MI
kudos:1

The Catalyst Software Suite is what will contain the drivers. I believe the latest drivers can be downloaded directly from AMD at »support.amd.com/en-us/download/d···packages
--
- cmcasey79, Allen Park, MI



Freddy
Premium
join:2005-05-17
Arlington, VA
kudos:2

1 edit
reply to joepwpb

joepwpb,

You can download and install the Catalyst package (which contains the drivers) from the AMD site. If you don't want the Catalyst Control Center software, you can remove it later in Control Panel which lists it separately for removal.

Freddy

Later: On the other hand, the Catalyst Control Center causes no harm. You don't have to use it. Just leave it be.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

thanks for the info. I'll get that done later today and post the results.



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL
reply to auggy

I installed the latest CCC from AMD: 14-4-win7-win8-64-dd-ccc-whql and IE still crashes. Here's the last dmp file.

Joe P


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

The error still references the Flash32_14_0_0_125.ocx and that may indicate the issue is solely with Flash.

Can you temporarily disable Flash and see if the errors stop:

IE > Tools > Manage add-ons > click on "Shockwave Flash Object" > Disable > Close

Restart IE



joepwpb
Premium
join:2000-12-15
West Palm Beach, FL

Thanks auggy,

I have made that adjustment as suggested. I experienced another IE crash 7 hours after the last one and I have attached the dump.

Joe P


auggy
Premium,Mod
join:2001-12-24
Brockville, ON
kudos:18

The error points back to the GoogleToolbarDynamic_32_8E471B27054D20F5.dll and AMD modules.

However the Flash32_14_0_0_125.ocx is still a loaded module:

*** WARNING: Unable to verify timestamp for GoogleToolbarDynamic_32_8E471B27054D20F5.dll
*** ERROR: Module load completed but symbols could not be loaded for GoogleToolbarDynamic_32_8E471B27054D20F5.dll
*** WARNING: Unable to verify timestamp for atiumdag.dll
*** ERROR: Module load completed but symbols could not be loaded for atiumdag.dll
*** WARNING: Unable to verify timestamp for atiumdva.dll
*** ERROR: Module load completed but symbols could not be loaded for atiumdva.dll

FAULTING_IP:
unknown!noop+0
2b951490 3014952b000000 xor byte ptr [edx*4+2Bh],dl

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
03872f14 6442b58c 00000000 32c9bd78 0082cc00 0x2b951490
00000000 00000000 00000000 00000000 00000000 Flash32_14_0_0_125+0x5db58c


Can you temporarily uninstall Flash and see what happens.