How do I turn off Data Execution Prevention errors?

Home » Windows » Windows Configuration

Summary: Data Execution Prevention, or DEP, can prevent certain types of malware exploits. Unfortunately not all programs are compatible with DEP.

•

First let's be clear: Data Execution Prevention, or DEP, isn't something you "remove" or "get off your machine". It's simply a feature that can be turned on or off, or be configured.

I'll show you how to turn it off, but then I'll tell you why you shouldn't and what you should do instead to solve your problem.

•

What is DEP?

Start by realizing that as far as your computer is concerned, everything is just numbers. The text you're seeing? That's all stored as numbers with each number representing a different letter or character. Programs that you run? Numbers too: the instructions that tell the computer what to do are simply numbers.

From that example we can draw an important distinction: there's "code", or the instructions that tell a computer what to do, and there's "data", the information that the computer works on. But both code and data are stored as numbers.

Now, what hackers and virus writers have been able to do is exploit unpatched vulnerabilities that allow them to a) put what they want into data, and then b) trick the computer into executing that data as if it were code. That's one way they gain control of a machine and infect or otherwise compromise the machine.

Data Execution Prevention is exactly what it sounds like: the operating system, using either hardware, software or both, depending on the processor's capabilities, traps the attempt to execute data as if it were code. It's a very effective technique at blocking malware even if the vulnerability being exploited hasn't even been publicly exposed yet.

So what's the problem?

Some legitimate programs execute data as if it were code on purpose. Without getting into a lot of geeky details, it's sometimes an effective way to write very efficient code. If I'm not mistaken, older versions of Windows did something very similar to speed up graphics operations, for example. Since you mention viewing pictures, I'm guessing you were using an older version of IrfanView which was also known to do this.

•

Turning Off DEP

You can, if you like, turn off DEP completely.

• Right click on My Computer

• Click on Properties

• Click on the Advanced tab

• Click on the Settings button in the Performance section

• Click on the Data Execution Prevention tab

At this point you should be looking at a dialog much like this one:

Select the item labeled "Turn on DEP for essential Windows programs and services only". This, effectively turns off DEP for everything else. Your image viewer should now work.

But as I said at the beginning, in my opinion, this isn't what you should do.

•

Configure Exceptions to DEP

If you have a program you know is legitimate that happens to cause DEP errors, you can add it to the list of exceptions.

As you can see in the image above, the default DEP setting is to "Turn on DEP for all programs and services except those I select:". So, a much better way to get any legitimate program causing DEP errors to work again is to add that program to the exception list.

Click on the Add... button. Now, locate the program's ".exe" file. I don't happen to have IrfanView, but I'll use Foxit Software's PDF reader as a random example:

In this example the program was located in " C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe". The program you're looking for will, of course, be elsewhere, but most likely somewhere within "C:\Program Files".

The result should look something like this:

You can see that the program I specified has been added to the list of exceptions. It will not be protected by DEP, but everything else in your system will be.

That's a much safer way to run.

Related:

• Internet Safety: How do I keep my computer safe on the internet? Internet Safety is difficult and yet critical. Here are the seven key steps to internet safety - steps to keep your computer safe on the internet.

Article C3053 - June 11, 2007