Topic: Windows Data Execution Prevention (DEP) and My VPN

[Dracho]

Just thought I'd share something I learned the hard way over the weekend. 

I ordered our company's VPN software for my personal laptop, since I'm currently still a contractor but am starting to travel quite a bit.  It crashed my laptop bigtime, so bad it would cause a crash during boot.. I had to use safe mode to get it off.  The error persisted after I had removed the VPN software... ruh roh relroy..

The error message was that an application was attempting to write to "protected" memory and the machine was shutting down. 

Now, being a bit rusty, but no idiot when it comes to divining the intentions of a Microsoft product, I eventually deduced the following:

My VPN software comes with a runtime version of BlackIce firewall, a mini-app specific to our company to download dial-in locations, and Cisco VPN client.  Apparently, this product does not uninstall when you click uninstall for the VPN software (my IT dept gets the credit for that one).  You have to click a "remove agent" batch file in the RSDP directory. 

The Black-ICE product was writing to memory that Windows had reserved for storage, causing the crashes.  After some research I learned that after you install SP2 (which installs Data Execution Prevention) you can edit the boot.ini to disable this feature. After editing the switch, DEP is grayed out in the Systems tab, and the crashes not only stopped, but the VPN package installed and functioned perfectly.

Considering that I'm using BlackIce, Windows Firewall, Mcafee Firewall, and Mcafee's full suite, I don't consider it a big risk.  Here is the syntax, should anyone else encounter this "feature":


multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=AlwaysOff

[Javora]

Is BlackIce required for access to the VPN?  It seems to me that the VPN software at either side wouldn't care if BlackIce was installed on your system or not.  You should be able to enter the dial-in numbers yourself.  The reason why I ask is because running two firewalls is usually not a good idea as the two can cause conflicts.  I used to run BlackIce a long time ago and it wasn't a very good firewall back then.  The fact that BlackIce firewall is writing data to memory that Windows has closed off tells me that it hasn't gotten better over the years.  Actually I'm surprised that BlackIce is still in operation.

[Dracho]

yeah, actually the VPN software checks and will not connect if the firewall it installed isn't running and if yoru virus program isn't turned on.