Understanding Data Execution Prevention

Data Execution Prevention (DEP) helps prevent damage from viruses and other security threats that attack by running (executing) malicious code from memory locations that only Windows and other programs should use. This type of threat causes damage by taking over one or more memory locations in use by a program. Then it spreads and harms other programs, files, and even your e-mail contacts.

Unlike a firewall or antivirus program, DEP does not help prevent harmful programs from being installed on your computer. Instead, it monitors your programs to determine if they use system memory safely. To do this, DEP software works alone or with compatible microprocessors to mark some memory locations as "non-executable". If a program tries to run code—malicious or not—from a protected location, DEP closes the program and notifies you.

DEP can take advantage of software and hardware support. To use DEP, your computer must be running Microsoft Windows XP Service Pack 2 (SP2) or later, or Windows Server 2003 Service Pack 1 or later. DEP software alone helps protect against certain types of malicious code attacks but to take full advantage of the protection that DEP can offer, your processor must support "execution protection". This is a hardware-based technology designed to mark memory locations as non-executable. If your processor does not support hardware-based DEP, it's a good idea to upgrade to a processor that offers execution protection features.

Is it safe to run a program again if DEP has closed it?
Yes, but only if you leave DEP turned on for that program. Windows can continue to detect attempts to execute code from protected memory locations and help prevent attacks. In cases where a program does not run correctly with DEP turned on, you can reduce security risks by getting a DEP-compatible version of the program from the software publisher. For more information about what to do after DEP closes a program, click Related Topics.

How can I tell if DEP is available on my computer?
To open System Properties, click Start, click Control Panel, and then double-click System.
Click the Advanced tab and, under Performance, click Settings.
Click the Data Execution Prevention tab.

Note:
By default, DEP is only turned on for essential Windows operating system programs and services. To help protect more programs with DEP, select Turn on DEP for all programs and services except those I select.

What should I do when Data Execution Prevention closes a program?

Use the first five steps below to try and find out if your computer is under attack. If it is not under attack, the remaining sections below show you how to continue using the program.

You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.

Check your security essentials
The three best ways to help protect your computer are to run antivirus software, turn on a firewall, and get the latest updates for Windows (for more information, see Related Topics). In Microsoft Windows XP Service Pack 2 (SP2), the Security Center provides a one-stop place to check these essentials. You might need to log on as a computer administrator to complete some of these steps.

To open the Security Center, click Start, click Control Panel, and then double-click Security Center.
Make sure you have a firewall and that it is turned on. (Windows Firewall is turned on by default when you install Windows XP SP2 but you can install and run any firewall that you choose.)
If you have not already done so, turn on Automatic Updates. You can also get the latest updates for your computer by going to the Windows Update Web site(http://www.microsoft.com/).
Make sure your antivirus software is up to date. (Most publishers provide updates automatically or remind you to check for updates when you start the program.)
Scan for viruses and other security threats and do one of the following:
If your antivirus software detects a threat, follow the instructions provided for removing it safely. Do not change your DEP settings.
If no threats are detected, and if you are using the recommended security settings, your computer is probably secured. In this case, the program might not run correctly with DEP turned on and you should see if a DEP-compatible version of the program is available.

What if I can't see the Security Center settings?

If your computer is part of a domain (a group of computers in a network) and a network administrator manages security essentials for you, these settings are hidden. To view or change security settings, you must contact your network administrator.

However, if the network administrator did not set a policy for using the Security Center, and if you are logged on as a computer administrator, you can use the Group Policy Wizard to turn on the Security Center. This procedure requires you to restart your computer, so save your work before you begin.

To turn on Security Center
Click Start and click Run. In the Open box, type gpedit.msc.
In the Group Policy dialog box, under Computer Configuration, double-click Administrative Templates.
Double-click Windows Components and then click Security Center.
In the Security Center pane, double-click Turn on Security Center (Domain PCs only).
On the Turn on Security Center (Domain PCs only) Properties dialog, on the Setting tab, select Enabled and click OK.
Restart your computer.
To open System Properties, click Start, click Control Panel, and then double-click System.

Check for an updated version of the program
If you are using the recommended security settings and your antivirus software did not detect a threat, your computer is probably not under attack. In this case, the program that DEP closed might not run correctly when DEP is turned on. To see if a DEP-compatible version of the program is available, visit the software publisher's Web site.

Decide if it's safe to change your DEP settings
If you are using the recommended security settings and if the publisher has not released an updated version of the program, you can turn off DEP for the program that was closed. You will be able to use the program but it might be vulnerable to an attack that could spread to your other programs and files. If you choose to turn off DEP for a program, it's a good idea to check frequently for an updated version of the program and, after you update it, to turn on DEP again. For more information about changing DEP settings, click Related Topics.