locked
Screensaver executing causing DEP mitigation notifications across other Apps RRS feed

  • Question

  • Currently running EMET 5.2.5546.19547 an upgrade to 5.5 is in the pipeline.

    I have a screensaver provided by a vendor .scr - when i execute this screensaver i get DEP mitigations like below.
    <CANT INSERT IMAGE BECAUSE: Body text cannot contain images or links until we are able to verify your account.>

    The apps do not terminate but there is a cascade of notifications across the screen, this is a legit screensaver and I dont believe contains malicious code. I cant run any sysinternal tools as its a screensaver and I cant get focus on the Sysinternals windows etc when it is running.

    Sample from EventVwr

    EMET detected DEP mitigation and will close the application: WINWORD.EXE

    DEP check failed:
      Application     : C:\Program Files\Microsoft Office 15\Root\Office15\WINWORD.EXE
      User Name     : <redacted>\<redacted>
      Session ID     : 1
      PID         : 0x3B2C (15148)
      TID         : 0x19C0 (6592)
      Module     : saver1.dll
      Mod Base     : 0x04940000
      Mod Address     : 0x04953001
      Mem Address     : 0x04953001

    Wednesday, March 23, 2016 7:26 PM

All replies

  • How about Windows default screen servers?

    Are you facing the same problem with them too?

    Saturday, April 2, 2016 5:13 PM