WehnTrust

Source code checked in, #80132

Project Collection Service Accounts — Mon, 01 Oct 2012 21:49:39 GMT

Upgrade: New Version of LabDefaultTemplate.xaml. To upgrade your build definitions, please visit the following link: http://go.microsoft.com/fwlink/?LinkId=254563

Source code checked in, #80131

Project Collection Service Accounts — Mon, 01 Oct 2012 21:43:10 GMT

Checked in by server upgrade

Created Issue: Uninstalling, Randcache folder [10504]

merliner — Mon, 24 Sep 2012 08:17:38 GMT

After uninstalling WehnTrust I found Randcache folder in windows base folder.

Source code checked in, #55373

_TFSSERVICE — Mon, 02 Aug 2010 22:49:34 GMT

Checked in by server upgrade

Commented Issue: WehnTrust causes a BSOD on Windows XP Home SP3 [2161]

scott_hardy — Wed, 24 Feb 2010 05:40:54 GMT

After installing WehnTrust 1.2 and rebooting I get a BSOD (Page Fault in NonPaged Area). Tried rebooting and still got the same BSOD.

Rebooted using Last Known Good and got a message from WehnTrust about system files being changed and that it had resynchronized them and needed a reboot. I did and this time the system booted. But when I tried to access the WehnTrust controls through the tray icon got a message that the driver wasn't properly installed.

So I decided to uninstall WehnTrust and got a message that the driver failed to uninstall, code 1060.

I'd like to use this program so what can I do to get it to install properly?

Thanks!
Comments: ** Comment from web user: scott_hardy **

I had a somewhat uglier version of this.

Last week I installed wehntrust on a dual-boot XPSP3/Linux system, running on an AMD-based Acer Aspire 5516 laptop. On rebooting XP, got a BSOD for maybe an 8th of a second, followed by another reboot. Retries produced identical results. I had to go into safe mode and restore in order to be able to use the XP side of the system again.

Created Issue: WehnTrust.exe crashed

stephendhill — Sun, 19 Apr 2009 17:52:33 GMT

v1.2 crashed
crashdump attached

Created Issue: SearchProtocolHost.exe crashes

stephendhill — Sun, 19 Apr 2009 16:36:16 GMT

SearchProtocolHost.exe crashes with v1.2:

Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.

Application exception occurred:
App: C:\WINDOWS\system32\SearchProtocolHost.exe (pid=1728)
When: 19/04/2009 @ 17:33:43.864
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: HILLLAP1
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 15 Model 2 Stepping 9
Windows Version: 5.1
Current Build: 2600
Service Pack: 3
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: Stephen Hill

*----> Task List <----*
0 System Process
4 System
552 smss.exe
1148 csrss.exe
1176 winlogon.exe
1228 services.exe
1240 lsass.exe
1396 Ati2evxx.exe
1412 svchost.exe
1488 svchost.exe
1544 svchost.exe
1624 svchost.exe
1884 svchost.exe
292 spoolsv.exe
424 sched.exe
540 svchost.exe
992 GoogleUpdate.exe
796 avguard.exe
820 btwdins.exe
896 fsssvc.exe
1524 jqs.exe
2056 SeaPort.exe
2296 SMAgent.exe
2364 svchost.exe
2448 WehnServ.exe
2668 SearchIndexer.exe
2740 CALMAIN.exe
2768 fxssvc.exe
1408 alg.exe
2168 Ati2evxx.exe
2856 Explorer.EXE
1688 SOUNDMAN.EXE
1932 SMax4PNP.exe
812 AGRSMMSG.exe
3572 avgnt.exe
1064 VCDDaemon.exe
1300 fsui.exe
4080 jusched.exe
1004 ctfmon.exe
1016 BTTray.exe
2936 WindowsSearch.exe
656 BTSTAC~1.EXE
3716 iexplore.exe
2932 iexplore.exe
868 taskmgr.exe
4060 Explorer.EXE
3796 udefrag-gui.exe
3384 cmd.exe
400 ultradefrag.exe
1732 firefox.exe
1728 SearchProtocolHost.exe
3748 drwtsn32.exe

*----> Module List <----*
(000000006ce90000 - 000000006cf42000: C:\WINDOWS\system32\ntdll.dll
(000000006d2c0000 - 000000006d309000: C:\WINDOWS\system32\GDI32.dll
(000000006d310000 - 000000006d406000: C:\WINDOWS\system32\kernel32.dll
(000000006d410000 - 000000006d4a1000: C:\WINDOWS\system32\USER32.dll
(000000006d4b0000 - 000000006d54b000: C:\WINDOWS\system32\ADVAPI32.dll
(000000006d550000 - 000000006d5e2000: C:\WINDOWS\system32\RPCRT4.dll
(000000006d5f0000 - 000000006d601000: C:\WINDOWS\system32\Secur32.dll
(000000006d630000 - 000000006d688000: C:\WINDOWS\system32\msvcrt.dll
(000000006d690000 - 000000006d725000: C:\WINDOWS\system32\CRYPT32.dll
(000000006d730000 - 000000006d742000: C:\WINDOWS\system32\MSASN1.dll
(000000006d770000 - 000000006d7c5000: C:\WINDOWS\system32\NETAPI32.dll
(000000006d9b0000 - 000000006d9b8000: C:\WINDOWS\system32\VERSION.dll
(000000006dac0000 - 000000006daee000: C:\WINDOWS\system32\WINTRUST.dll
(000000006daf0000 - 000000006db18000: C:\WINDOWS\system32\IMAGEHLP.dll
(000000006db50000 - 000000006db6d000: C:\WINDOWS\system32\IMM32.DLL
(000000006dc80000 - 000000006dd1a000: C:\WINDOWS\system32\comctl32.dll
(000000006ddb0000 - 000000006e5c7000: C:\WINDOWS\system32\SHELL32.dll
(000000006e5d0000 - 000000006e646000: C:\WINDOWS\system32\SHLWAPI.dll
(000000006e780000 - 000000006e883000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
(000000006e900000 - 000000006ea3d000: C:\WINDOWS\system32\ole32.dll
(000000006ea40000 - 000000006ea62000: C:\WINDOWS\system32\Apphelp.dll
(000000006efc0000 - 000000006f04b000: C:\WINDOWS\system32\OLEAUT32.dll
(0000000072960000 - 0000000072966000: C:\WINDOWS\system32\MSSHooks.dll
(0000000074930000 - 0000000074ab5000: C:\WINDOWS\system32\TQUERY.DLL
(0000000074d30000 - 0000000074deb000: C:\WINDOWS\system32\PROPSYS.dll
(0000000078060000 - 0000000078090000: C:\WINDOWS\system32\SearchProtocolHost.exe

*----> State Dump for Thread Id 0x8d8 <----*

eax=00000000 ebx=7ffdd000 ecx=47a0ffb0 edx=6ce9e514 esi=4d5ab89c edi=2a38e228
eip=77c7c919 esp=47a0ffc4 ebp=47a0fff0 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

function: <nosymbols>
No prior disassembly possible
77c7c919 ?? ???
77c7c91b ?? ???
77c7c91d ?? ???
77c7c91f ?? ???
77c7c921 ?? ???
77c7c923 ?? ???
77c7c925 ?? ???
77c7c927 ?? ???
77c7c929 ?? ???
FAULT ->77c7c919 ?? ???
Error 0x00000001
77c7c91b ?? ???
77c7c91d ?? ???
77c7c91f ?? ???
77c7c921 ?? ???
77c7c923 ?? ???
77c7c925 ?? ???
77c7c927 ?? ???
77c7c929 ?? ???
77c7c92b ?? ???
77c7c92d ?? ???

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
47a0ffc0 6d327077 2a38e228 4d5ab89c 7ffdd000 0x77c7c919
47a0fff0 00000000 77c7c919 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

*----> Raw Stack Dump <----*
0000000047a0ffc4 77 70 32 6d 28 e2 38 2a - 9c b8 5a 4d 00 d0 fd 7f wp2m(.8*..ZM....
0000000047a0ffd4 05 00 00 c0 c8 ff a0 47 - e8 fb a0 47 1c c0 f6 6c .......G...G...l
0000000047a0ffe4 d8 9a 34 6d 80 70 32 6d - 00 00 00 00 00 00 00 00 ..4m.p2m........
0000000047a0fff4 00 00 00 00 19 c9 c7 77 - 00 00 00 00 41 63 74 78 .......w....Actx
0000000047a10004 20 00 00 00 01 00 00 00 - 98 24 00 00 c4 00 00 00 ........$......
0000000047a10014 00 00 00 00 20 00 00 00 - 00 00 00 00 14 00 00 00 .... ...........
0000000047a10024 01 00 00 00 06 00 00 00 - 34 00 00 00 14 01 00 00 ........4.......
0000000047a10034 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000047a10044 00 00 00 00 00 00 00 00 - 02 00 00 00 00 00 00 00 ................
0000000047a10054 00 00 00 00 00 00 00 00 - 14 02 00 00 9c 01 00 00 ................
0000000047a10064 00 00 00 00 5b 49 59 2d - b0 03 00 00 32 00 00 00 ....[IY-....2...
0000000047a10074 e4 03 00 00 d2 02 00 00 - 00 00 00 00 e4 02 02 83 ................
0000000047a10084 b8 06 00 00 46 00 00 00 - 00 07 00 00 ea 02 00 00 ....F...........
0000000047a10094 00 00 00 00 d2 d5 8c d1 - ec 09 00 00 46 00 00 00 ............F...
0000000047a100a4 34 0a 00 00 ea 02 00 00 - 00 00 00 00 2e ad 6a d8 4.............j.
0000000047a100b4 20 0d 00 00 46 00 00 00 - 68 0d 00 00 04 03 00 00 ...F...h.......
0000000047a100c4 10 00 00 00 04 00 00 00 - d4 00 00 00 02 00 00 00 ................
0000000047a100d4 01 00 00 00 14 01 00 00 - 8c 0f 00 00 01 00 00 00 ................
0000000047a100e4 02 00 00 00 a0 10 00 00 - 2c 03 00 00 01 00 00 00 ........,.......
0000000047a100f4 04 00 00 00 cc 13 00 00 - 50 10 00 00 02 00 00 00 ........P.......

*----> State Dump for Thread Id 0x470 <----*

eax=00000000 ebx=4838fed0 ecx=4838ff7c edx=00000000 esi=00000000 edi=7ffdd000
eip=6ce9e514 esp=4838fea8 ebp=4838ff44 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
function: ntdll!KiFastSystemCallRet
6ce9e4fa e829000000 call ntdll!RtlRaiseException (6ce9e528)
6ce9e4ff 8b0424 mov eax,[esp]
6ce9e502 8be5 mov esp,ebp
6ce9e504 5d pop ebp
6ce9e505 c3 ret
6ce9e506 8da42400000000 lea esp,[esp]
6ce9e50d 8d4900 lea ecx,[ecx]
ntdll!KiFastSystemCall:
6ce9e510 8bd4 mov edx,esp
6ce9e512 0f34 sysenter
ntdll!KiFastSystemCallRet:
6ce9e514 c3 ret
6ce9e515 8da42400000000 lea esp,[esp]
6ce9e51c 8d642400 lea esp,[esp]
ntdll!KiIntSystemCall:
6ce9e520 8d542408 lea edx,[esp+0x8]
6ce9e524 cd2e int 2e
6ce9e526 c3 ret
6ce9e527 90 nop
ntdll!RtlRaiseException:
6ce9e528 55 push ebp
6ce9e529 8bec mov ebp,esp

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
4838ff44 6d4d8631 00000002 4838ff6c 00000000 ntdll!KiFastSystemCallRet
4838ffb4 6d31b729 00000000 6cea3bbf 00000000 ADVAPI32!WmiFreeBuffer+0x24e
4838ffec 00000000 6d4d848a 00000000 00000000 kernel32!GetModuleFileNameA+0x1ba

*----> Raw Stack Dump <----*
000000004838fea8 4a df e9 6c 90 95 31 6d - 02 00 00 00 d0 fe 38 48 J..l..1m......8H
000000004838feb8 01 00 00 00 01 00 00 00 - 04 ff 38 48 e0 2e 22 48 ..........8H.."H
000000004838fec8 60 66 52 6d 00 10 00 00 - 50 00 00 00 5c 00 00 00 `fRm....P...\...
000000004838fed8 c0 fe 38 48 d0 39 50 c0 - dc ff 38 48 d8 9a 34 6d ..8H.9P...8H..4m
000000004838fee8 50 0b 32 6d 00 10 00 00 - 14 00 00 00 01 00 00 00 P.2m............
000000004838fef8 00 00 00 00 00 00 00 00 - 10 00 00 00 00 a2 2f 4d ............../M
000000004838ff08 ff ff ff ff 00 10 00 00 - 00 d0 fd 7f 00 e0 fd 7f ................
000000004838ff18 dc ff 38 48 04 ff 38 48 - d0 fe 38 48 06 00 00 00 ..8H..8H..8H....
000000004838ff28 02 00 00 00 c4 fe 38 48 - 06 00 00 00 dc ff 38 48 ......8H......8H
000000004838ff38 d8 9a 34 6d 80 96 31 6d - 00 00 00 00 b4 ff 38 48 ..4m..1m......8H
000000004838ff48 31 86 4d 6d 02 00 00 00 - 6c ff 38 48 00 00 00 00 1.Mm....l.8H....
000000004838ff58 e0 93 04 00 01 00 00 00 - bf 3b ea 6c 00 00 00 00 .........;.l....
000000004838ff68 00 00 00 00 50 00 00 00 - 5c 00 00 00 00 10 00 00 ....P...\.......
000000004838ff78 e0 2e 22 48 00 00 00 00 - 00 10 00 00 e8 3e 22 48 .."H.........>"H
000000004838ff88 00 67 52 6d 28 00 00 00 - e0 66 52 6d 00 10 00 00 .gRm(....fRm....
000000004838ff98 00 00 00 00 00 67 52 6d - e0 2e 22 48 e0 66 52 6d .....gRm.."H.fRm
000000004838ffa8 e5 03 00 00 00 10 00 00 - e8 3e 22 48 ec ff 38 48 .........>"H..8H
000000004838ffb8 29 b7 31 6d 00 00 00 00 - bf 3b ea 6c 00 00 00 00 ).1m.....;.l....
000000004838ffc8 00 00 00 00 00 e0 fd 7f - 14 6d 2b c0 c0 ff 38 48 .........m+...8H
000000004838ffd8 28 c3 0a 87 1c c0 f6 6c - d8 9a 34 6d 30 b7 31 6d (......l..4m0.1m

Created Issue: msfeedssync.exe crashes

stephendhill — Sun, 19 Apr 2009 09:37:58 GMT

msfeedssync.exe crashes with wehntrust v1.2.
user.dmp file attached

Dr Watson log:

Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.

Application exception occurred:
App: C:\WINDOWS\system32\msfeedssync.exe (pid=2536)
When: 19/04/2009 @ 10:35:19.336
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: HILLLAP1
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 15 Model 2 Stepping 9
Windows Version: 5.1
Current Build: 2600
Service Pack: 3
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: Stephen Hill

*----> Task List <----*
0 System Process
4 System
552 smss.exe
604 csrss.exe
1180 winlogon.exe
1228 services.exe
1240 lsass.exe
1412 Ati2evxx.exe
1428 svchost.exe
1524 svchost.exe
1580 svchost.exe
1848 svchost.exe
1900 svchost.exe
488 spoolsv.exe
580 sched.exe
736 svchost.exe
948 Ati2evxx.exe
1004 GoogleUpdate.exe
1084 Explorer.EXE
1808 SOUNDMAN.EXE
1704 SMax4PNP.exe
1920 AGRSMMSG.exe
1936 avgnt.exe
1968 VCDDaemon.exe
1988 fsui.exe
1996 jusched.exe
2020 ctfmon.exe
208 BTTray.exe
220 WindowsSearch.exe
276 Explorer.EXE
632 avguard.exe
660 btwdins.exe
740 fsssvc.exe
832 BTSTAC~1.EXE
1672 jqs.exe
2088 firefox.exe
2176 SeaPort.exe
2428 SMAgent.exe
2516 svchost.exe
2620 WehnServ.exe
2792 SearchIndexer.exe
2920 CALMAIN.exe
2968 fxssvc.exe
800 alg.exe
920 SearchProtocolHost.exe
1352 taskmgr.exe
1492 wuauclt.exe
3300 udefrag-gui.exe
3276 SearchFilterHost.exe
1560 cmd.exe
3608 ultradefrag.exe
1000 msiexec.exe
2536 msfeedssync.exe
628 dwwin.exe
3264 drwtsn32.exe

*----> Module List <----*
(0000000067c30000 - 0000000067c36000: C:\WINDOWS\system32\msfeedssync.exe
(0000000079c90000 - 0000000079d42000: C:\WINDOWS\system32\ntdll.dll
(000000007a060000 - 000000007a0a9000: C:\WINDOWS\system32\GDI32.dll
(000000007a0b0000 - 000000007a1a6000: C:\WINDOWS\system32\kernel32.dll
(000000007a1b0000 - 000000007a241000: C:\WINDOWS\system32\USER32.dll
(000000007a250000 - 000000007a2eb000: C:\WINDOWS\system32\ADVAPI32.dll
(000000007a2f0000 - 000000007a382000: C:\WINDOWS\system32\RPCRT4.dll
(000000007a390000 - 000000007a3a1000: C:\WINDOWS\system32\Secur32.dll
(000000007a3d0000 - 000000007a428000: C:\WINDOWS\system32\msvcrt.dll
(000000007a750000 - 000000007a758000: C:\WINDOWS\system32\VERSION.dll
(000000007a870000 - 000000007a88d000: C:\WINDOWS\system32\IMM32.DLL
(000000007a9a0000 - 000000007aa3a000: C:\WINDOWS\system32\comctl32.dll
(000000007b2f0000 - 000000007b366000: C:\WINDOWS\system32\SHLWAPI.dll
(000000007b460000 - 000000007b563000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
(000000007b5e0000 - 000000007b71d000: C:\WINDOWS\system32\ole32.dll
(000000007b720000 - 000000007b742000: C:\WINDOWS\system32\Apphelp.dll

*----> State Dump for Thread Id 0x284 <----*

eax=00000000 ebx=7ffd7000 ecx=2a81ffb0 edx=79c9e514 esi=47cef0dc edi=4407f3b0
eip=78b91c85 esp=2a81ffc4 ebp=2a81fff0 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

function: <nosymbols>
No prior disassembly possible
78b91c85 ?? ???
78b91c87 ?? ???
78b91c89 ?? ???
78b91c8b ?? ???
78b91c8d ?? ???
78b91c8f ?? ???
78b91c91 ?? ???
78b91c93 ?? ???
78b91c95 ?? ???
FAULT ->78b91c85 ?? ???
Error 0x00000001
78b91c87 ?? ???
78b91c89 ?? ???
78b91c8b ?? ???
78b91c8d ?? ???
78b91c8f ?? ???
78b91c91 ?? ???
78b91c93 ?? ???
78b91c95 ?? ???
78b91c97 ?? ???
78b91c99 ?? ???

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
2a81ffc0 7a0c7077 4407f3b0 47cef0dc 7ffd7000 0x78b91c85
2a81fff0 00000000 78b91c85 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

*----> Raw Stack Dump <----*
000000002a81ffc4 77 70 0c 7a b0 f3 07 44 - dc f0 ce 47 00 70 fd 7f wp.z...D...G.p..
000000002a81ffd4 05 00 00 c0 c8 ff 81 2a - e8 fb 81 2a 1c c0 d6 79 .......*...*...y
000000002a81ffe4 d8 9a 0e 7a 80 70 0c 7a - 00 00 00 00 00 00 00 00 ...z.p.z........
000000002a81fff4 00 00 00 00 85 1c b9 78 - 00 00 00 00 41 63 74 78 .......x....Actx
000000002a820004 20 00 00 00 01 00 00 00 - 98 24 00 00 c4 00 00 00 ........$......
000000002a820014 00 00 00 00 20 00 00 00 - 00 00 00 00 14 00 00 00 .... ...........
000000002a820024 01 00 00 00 06 00 00 00 - 34 00 00 00 14 01 00 00 ........4.......
000000002a820034 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000002a820044 00 00 00 00 00 00 00 00 - 02 00 00 00 00 00 00 00 ................
000000002a820054 00 00 00 00 00 00 00 00 - 14 02 00 00 9c 01 00 00 ................
000000002a820064 00 00 00 00 5b 49 59 2d - b0 03 00 00 32 00 00 00 ....[IY-....2...
000000002a820074 e4 03 00 00 d2 02 00 00 - 00 00 00 00 e4 02 02 83 ................
000000002a820084 b8 06 00 00 46 00 00 00 - 00 07 00 00 ea 02 00 00 ....F...........
000000002a820094 00 00 00 00 d2 d5 8c d1 - ec 09 00 00 46 00 00 00 ............F...
000000002a8200a4 34 0a 00 00 ea 02 00 00 - 00 00 00 00 2e ad 6a d8 4.............j.
000000002a8200b4 20 0d 00 00 46 00 00 00 - 68 0d 00 00 04 03 00 00 ...F...h.......
000000002a8200c4 10 00 00 00 04 00 00 00 - d4 00 00 00 02 00 00 00 ................
000000002a8200d4 01 00 00 00 14 01 00 00 - 8c 0f 00 00 01 00 00 00 ................
000000002a8200e4 02 00 00 00 a0 10 00 00 - 2c 03 00 00 01 00 00 00 ........,.......
000000002a8200f4 04 00 00 00 cc 13 00 00 - 50 10 00 00 02 00 00 00 ........P.......

Commented Issue: wuauclt.exe crashes

slow — Tue, 02 Sep 2008 15:43:40 GMT

OS: Windows XP SP2/SP3
Version: WehnTrust 1.2

wuauclt.exe crashes 3 times in a row about every 10-20 minutes unless exempted from ASLR. I can "reproduce" this about 50% of the time on my home and work machines.

I will reply with a screenshot the next time it happens.
Comments: ** Comment from web user: slow **

Can you throw us specific instructions or give everybody a link with direction on how to configure your environment to get these please.

Created Issue: WehnTrust causes a BSOD on Windows XP Home SP3

Tipperton — Sat, 23 Aug 2008 15:02:08 GMT

Commented Issue: Crashdump

skape — Sat, 16 Aug 2008 16:21:33 GMT

Can you upload a crashdump?
Comments: ** Comment from web user: skape **

Look who can't use codeplex properly :)

Commented Issue: wuauclt.exe crashes

skape — Sat, 16 Aug 2008 16:20:10 GMT

Can you upload a crashdump?

Closed Issue: Crashdump

skape — Sat, 16 Aug 2008 16:19:50 GMT

Can you upload a crashdump?

Created Issue: Crashdump

skape — Sat, 16 Aug 2008 16:19:31 GMT

Can you upload a crashdump?

Commented Issue: wuauclt.exe crashes

slow — Thu, 14 Aug 2008 15:36:01 GMT

I can reproduce this as well, but only in weird cases. I usually run windows as a standard user account wuauclt never crashes when I login as standard user, but if I log off and log in again as local admin wuauclt crashes almost every time (95% of the time). For me it gets into an inf loop of "click here to close"->crashes again instantly->"click here to close"->etc.

Commented Issue: wuauclt.exe crashes

dguido — Thu, 14 Aug 2008 15:33:15 GMT

Second screenshot

Commented Issue: wuauclt.exe crashes

dguido — Thu, 14 Aug 2008 15:32:54 GMT

First screenshot

Created Issue: wuauclt.exe crashes

dguido — Thu, 14 Aug 2008 15:18:56 GMT

Updated Wiki: Home

skape — Mon, 11 Aug 2008 08:42:33 GMT

Overview
WehnTrust is a Host-based Intrusion Prevention System (HIPS) for Windows 2000, XP, and Server 2003. It includes support for exploit mitigations that are designed to make exploitation more difficult by preventing the use of specific exploitation techniques and by making exploitation unreliable.

Download
WehnTrust 1.2

How it works
WehnTrust randomizes the base addresses of memory allocations to make it more difficult to exploit software vulnerabilities such as buffer overflows. This technique is commonly known as Address Space Layout Randomization (ASLR) and was originally conceived by the PaX team. Microsoft has recently incorporated support for ASLR into Windows Vista and Windows Server 2008. In addition to ASLR, WehnTrust generically mitigates SEH overwrites by dynamically validating a thread's exception handler chain prior to allowing exceptions to be dispatched.

Recommendations
Using WehnTrust in combination with hardware-enforced DEP (non-executable pages) as included with Windows XP SP2 and Windows Server 2003 provides the greatest level of security. Non-executable pages help to counter some of the inherent weaknesses of ASLR.

Features
The following features are included:

Address Space Layout Randomization (ASLR)

Randomized image file mappings (relocations required)
Randomized memory allocations (e.g. VirtualAlloc)
Randomized PEB/TEB
Basic brute force detection and prevention

SEH Overwrite Prevention
Format string vulnerability prevention
Logging and notification of exploitation attempts

Balloon tip nofication
Native windows event logging

Application and image file exemptions

License
WehnTrust is licensed under the WehnTrust Software License 1.0.

Thanks
We would like to thank the following people for sharing their knowledge, help, and support during the development of WehnTrust: the PaX team, Erik Cabetas, Richard Johnson, HD Moore, Patrick Stach, Jarkko Turkulainen , Martin Zeiser.

Updated Release: WehnTrust 1.2 (Aug 10, 2008)

Mon, 11 Aug 2008 08:41:25 GMT

WehnTrust 1.2