Re: Data Execution Prevention: IIS Worker Process

Hello Les,

Thank you for post here.

I am not sure why the Data Execution Prevention acted on IIS Worker
Process. Maybe there are some configuration compatibility issues between
the DEP IIS Worker Process. However, I'm sure there is no error for IIS
Worker Process, and we do not need to fix it. Please don't worry.

Hope the info help.

Thanks and have a nice day.

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx>
| References: <7DAABF6D-B5C0-489B-A609-57502C7F6547@xxxxxxxxxxxxx>
<5vKCsznpHHA.564@xxxxxxxxxxxxxxxxxxxxxx>
| In-Reply-To: <5vKCsznpHHA.564@xxxxxxxxxxxxxxxxxxxxxx>
| Subject: Re: Data Execution Prevention: IIS Worker Process
| Date: Mon, 4 Jun 2007 10:53:02 -0500
| Lines: 212
| Message-ID: <78D2AD97-94CC-4209-A9FF-4D6C0B8B465A@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="iso-8859-1";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
| X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
| X-MS-CommunityGroup-PostID: {78D2AD97-94CC-4209-A9FF-4D6C0B8B465A}
| X-MS-CommunityGroup-ThreadID: 7DAABF6D-B5C0-489B-A609-57502C7F6547
| X-MS-CommunityGroup-ParentID: 39BA932B-B0A4-4AA8-A5D0-F86FA2BF646B
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:41535
| NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Terence,
|
| Why is DEP acting on this process? Is there an error in the application?
If
| there is an error, should it not be fixed?
|
| --
| Les Connor [SBS MVP]
|
|
| "Terence Liu [MSFT]" <v-terliu@xxxxxxxxxxxxxxxxxxxx> wrote in message
| news:5vKCsznpHHA.564@xxxxxxxxxxxxxxxxxxxxxxxxx
| > Hello Customer,
| >
| > Thanks for posting here.
| >
| > According to your description, I understand that you received this error
| > message "To help protect your computer, Windows has closed the program.
| > Name IIS Worker Process" on the SBS 2003 Server. If I have misunderstood
| > the problem, please don't hesitate to let me know.
| >
| > Based on my research, this issue is due to DEP ( Data execution
prevention
| > ) feature of Windows 2003 SP1. When you install the Windows 2003 SP1 on
| > server DEP is getting enabled by default.
| > This feature is also Available in windows XP SP2.
| >
| > How to identify the DEP is enabled in Windows 2003 and XP SP2 systems
| > =========================
| > Check the Boot.ini file in any of the OS listed above and check for
| > NoExecute Entry. This looks like follows
| >
| > multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows Server 2003,
| > Enterprise"
| > /fastdetect /noexecute=OptOut
| >
| > /noexecute Switch
| > ================
| > The /noexecute parameter enables Data Execution Prevention (DEP), a set
of
| > hardware and software technologies designed to prevent harmful code from
| > running in
| > protected memory locations
| > /noexecute={alwayson | optout | optin | alwaysoff}
| >
| > Switch noexecute=OptOut
| > Enables DEP for the operating system and all processes, including the
| > Windows
| > kernel and drivers.
| > Switch noexecute=alwayson
| > Enables DEP for the operating system and all processes, including the
| > Windows
| > kernel and drivers. All attempts to disable DEP are ignored.
| > Switch noexecute=optin
| > Enables DEP only for operating system components, including the Windows
| > kernel and
| > drivers.
| > Switch noexecute=alwaysoff
| > Disables DEP. Attempts to enable DEP selectively are ignored. This
| > parameter also
| > disables physical address extension (PAE). To re-enable (PAE), use the
| > /pae
| > parameter.
| >
| > More information on DEP and Noexecute
| > ================================
| >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base
| > /data_execution_prevention.asp
| >
| >
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx
| >
| >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/
| > ddtools/bootini_aff45176-bd02-43cf-9895-c212fa392de2.xml.asp
| >
| >
| > Solution
| > ======================
| > Workaround 1
| > -------------------
| > Use the noexecute=optin parameter in Boot.ini file. This is how we can
| > set
| > it bootcfg /raw "/fastdetect /NoExecute=optin" /ID 1 (reboot of
system
| > is
| > needed
| > after this)
| >
| > Note: To find the boot.ini, please perform the following steps:
| >
| > 1. Open Control Panel, double-click Folder Options.
| > 2. Click the View tab, UNCHECK 'Hide protected operating system files
| > (Recommended)' check box.
| > 3. Find the boot.ini under C:\.
| >
| > Workaround 2
| > ----------------------
| > let the noexecute=OptOut remain like that only in Boot.ini file and
follow
| > below listed steps to allow W3WP.exe process to be run properly on
server.
| >
| > My Computer -- > Advanced --> Performance -- >Settings -- > Data
| > Execution Prevention --> 2nd radio button ( Turn on DEP for all programs
| > and services except
| > those I select) -- > Add W3WP.EXE process in exception list (no need
for
| > reboot).
| >
| > By doing this what we are doing is setting W3WP.exe in exception list of
| > DEP
| >
| > Workaround 3
| > -----------------------
| > set noexecute=Alwaysoff in boot.ini file and that will turn off the
DEP.
| > This is how we will set it up
| >
| > bootcfg /raw "/fastdetect /NoExecute=AlwaysOff" /ID 1 (reboot of
system
| > is needed
| > after this)
| > <<<< This is not recommended as this will turn of DEP Totally and there
is
| > no fun of having Windows 2003 SP1 on your BOX
| >
| > I appreciate your time and cooperation. If anything is unclear, please
| > feel
| > free to let me know. I am looking forward to hearing from you.
| >
| > Have a nice day!
| >
| > Best regards,
| >
| > Terence Liu(MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
| > the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
| > issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
| > doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
| > rights.
| >
| > --------------------
| > | Thread-Topic: Data Execution Prevention: IIS Worker Process
| > | thread-index: AcemPqZYVeuIVegxRfeBqPTYFhqQAw==
| > | X-WBNR-Posting-Host: 207.46.192.207
| > | From: =?Utf-8?B?d3J5dGF0?= <wrytat@xxxxxxxxxxxxxxxxxxxxxxxxx>
| > | Subject: Data Execution Prevention: IIS Worker Process
| > | Date: Sun, 3 Jun 2007 17:24:01 -0700
| > | Lines: 24
| > | Message-ID: <7DAABF6D-B5C0-489B-A609-57502C7F6547@xxxxxxxxxxxxx>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | charset="Utf-8"
| > | Content-Transfer-Encoding: 7bit
| > | X-Newsreader: Microsoft CDO for Windows 2000
| > | Content-Class: urn:content-classes:message
| > | Importance: normal
| > | Priority: normal
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | Path: TK2MSFTNGHUB02.phx.gbl
| > | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:41376
| > | NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | My server is running on MS Windows Server 2003 for Small Business
Server
| > | Service Pack 2. I found that every morning when I log in to the server
| > using
| > | the administrator account, I will be prompted with this "Data
Execution
| > | Prevention - Microsoft Windows" message. It reads,
| > |
| > | "To help protect your computer, Windows has closed this program.
| > | Name: IIS Worker Process
| > | Publisher: Microsoft Corporation
| > | [Change Settings] [Close Message]"
| > |
| > | Usually I hit the Close Message button, as I don't know which
settings
| > to
| > | change. Then I will be prompted with this "IIS Worker Process"
message,
| > which
| > | reads,
| > |
| > | "IIS Worker Process encountered a problem and needed to close.
| > | This error occurred on xx/xx/2007 at 2:29:44 AM.
| > | Please tell Microsoft about this problem.
| > | We have created an error report that you can send to help us improve
IIS
| > | Worker Process. We will treat this report as confidential and
anonymous.
| > | To see what data this error report contains, click here.
| > | [Send Error Report] [Don't Send]"
| > |
| > | Sometimes I'll get these messages twice when I log in. Anyone has
| > | encountered this before? Which settings should I change?
| > |
| >
|
|

.

Loading