Ieuser.exe/Data Execution Prevention

[Syzich]

I'm not sure if this should go in this section of the forum or Vista, but here goes. Earlier I was at a website I frequent downloading a video when I get a notice that Internet Explorer stopped working. I open taskmanager and see that iexplore.exe is still running. I close the notice and then see in taskmanager that ieuser.exe was closed. Then I get a notice about Data Execution Prevention, saying that ieuser.exe was closed by DEP. From what I know ieuser.exe is related to IE's Protected Mode, but is it also related to DEP? This is why I think I got the message. From the error report in Event Viewer, it doesn't seem to be malicious:

Faulting application ieuser.exe, version 6.0.6001.18000, time stamp 0x47918f0e, faulting module thumbcache.dll_unloaded, version 0.0.0.0, time stamp 0x4791a787, exception code 0xc0000005, fault offset 0x6cfeda7b, process id 0xfb0, application start time 0x01c91427e19f21a6.

Right before I got the notice that Internet Explorer stopped responding, I was selecting a folder to save the video to, and you could see the video thumbnails in the folders. So I think that's why thumbnail.dll is reported in the error report. So, is this something I should be worried about or not?


Also, I remember seeing the video download continue to progress after the ieuser stop working notification and the DEP notification and I think I heard the download completion sound, but the download window seemed to have closed after that and I the file wasn't on my computer. Does anyone know why that is?

Vista Home Premium SP1
IE 7

Here's a HijackThis scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:42 PM, on 9/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clansilverfox.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: CCC.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor...fo/webscan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...nt/swflash.cab
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 3736 bytes

[Broni]

The log is clean

[jerryctx]

You are wise to be cautious but usually this is due to a programming error or a conflict between two applications. Unless it happens again I wouldn't worry about it.

[Syzich]

Thanks for the replies. I figured it probably wasn't anything to worry about but a while back I made a post about another ieuser.exe error I got while on the same site. It was a runtime error. It also said something about R6025 -pure vital function call. I don't know if these two occurences are even remotely related though. Broni said I was fine on that occasion too, though. I've also formatted since that, though that's probably not relevant.

So, just to clarify, a DEP notice isn't neccessarily indicative of anything bad? That just got me a bit worried sine I've never seen one before now.

[Train]

Not unusual for people to place error in site that cause all kinds of goofy messages to popup. If that is the only site where I get it, then more than likely they goofed up.