Two different computers; Forte-Agent 1.93 does nothing when I click on it,

[Micky]

Win10, fully updated, one Pro and one Homet

Agent worked fine until recently and two nights ago, but they stopped.


About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.

Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH

Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(

Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file

I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.

Has something happened to Windows that might have affected both
computers. Can I remedy it.

Right now I had to start using Xananews.

More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt

\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5

0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0

HELP!!!!

[Paul]

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

I would use this first one. It installed just fine in a Win10 VM.
These are from my collection (the collection gathered from questions).

Name: a32en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,405,565 bytes (2349 KiB)
SHA256: B7CFF20A784D61968C7B297CE64B14B4C702623CE7B9DAF307D335DB87EB5FDD

Name: a16en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,548,809 bytes (2489 KiB)
SHA256: 56EDBBD25B81F5A64C3A364F734AAE461E77EDA2136AD5E46F030BBB030EB34B

*******

"The StackHash error occurs when DEP is invoked and has an issue with
whatever application you’re trying to run (and there are several hundred
out there that seem to give it fits). The error is related to
Data Execution Prevention."

"Exception 0xC000041D means that an unhandled exception was encountered
during a user callback. It means that 0xC000041D is a second chance exception.
So we should capture the first chance exception, if we want to know the root cause" <Hah>

And I think that might happen, if memory that is mapped as being for data,
someone tries to execute it as program code.

I can't find a reasonable recipe right now, to fix that.

You can do an offline scan. The pictorial summary...

Loading Image...

Full recipe.

https://www.tenforums.com/tutorials/42305-how-run-microsoft-defender-offline-scan-windows-10-a.html

I don't know if that'll remove something, or you'll need sfc /scannow and friends.

I've seen DEP problems before. My old, defenseless WinXP had that once.

While DEP is opt-in or opt-out, I don't recommend removing it
just so you can "avoid" that error. That error is a *warning*.

Paul

[Ralph Fox]

Post by Paul

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

I would use this first one. It installed just fine in a Win10 VM.
These are from my collection (the collection gathered from questions).
Name: a32en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,405,565 bytes (2349 KiB)
SHA256: B7CFF20A784D61968C7B297CE64B14B4C702623CE7B9DAF307D335DB87EB5FDD
Name: a16en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,548,809 bytes (2489 KiB)
SHA256: 56EDBBD25B81F5A64C3A364F734AAE461E77EDA2136AD5E46F030BBB030EB34B
*******
"The StackHash error occurs when DEP is invoked and has an issue with
whatever application you’re trying to run (and there are several hundred
out there that seem to give it fits). The error is related to
Data Execution Prevention."
"Exception 0xC000041D means that an unhandled exception was encountered
during a user callback. It means that 0xC000041D is a second chance exception.
So we should capture the first chance exception, if we want to know the root cause" <Hah>
And I think that might happen, if memory that is mapped as being for data,
someone tries to execute it as program code.

According to the OP's other post <http://al.howardknight.net/?ID=169299317900>,
both Agent 1.93 and Agent 4 are affected.

Agent 1.93 is not compatible with DEP for applications.
But Agent 4 is compatible with DEP for applications.

If one tries to run Agent 1.93 when DEP is enabled for applications
including Agent 1.93, one will get an exception code 0xc000041d
and Agent 1.93 will not run. Agent 4 is not affected.

Agent 1.93 was built with Borland OWL which used thunk blocks
allocated on the heap and containing dynamically-created code
to be executed. Agent 4 was not built with Borland OWL.

Post by Paul
I can't find a reasonable recipe right now, to fix that.

If the problem were caused by DEP, then...

Either, turn on DEP for essential Windows progams and services only.
Or, add Agent 1.93 to the list of exclusions.
screen-shot: <Loading Image...>

OTOH the inclusion of Agent 4 in the OP's other post might
suggest this is not DEP.
REF: <http://al.howardknight.net/?ID=169299317900>

Post by Paul
You can do an offline scan. The pictorial summary...
https://www.tenforums.com/attachments/tutorials/284639d1592839239-how-run-microsoft-defender-offline-scan-windows-10-a-microsoft_defender_offline_scan-3.png
Full recipe.
https://www.tenforums.com/tutorials/42305-how-run-microsoft-defender-offline-scan-windows-10-a.html
I don't know if that'll remove something, or you'll need sfc /scannow and friends.
I've seen DEP problems before. My old, defenseless WinXP had that once.
While DEP is opt-in or opt-out, I don't recommend removing it
just so you can "avoid" that error.

One does not need to turn off DEP. There are other options

Either, turn on DEP for essential Windows progams and services only.
Or, add Agent 1.93 to the list of exclusions.
screen-shot: <http://img4.imagetitan.com/img.php?image=26_uc9k9m_1__data_execution_prevention_options.png>

To find these options in Windows 10
1. Go to Start >> Settings >> System >> About
2. At the right, click "Advanced system settings"
3. Select the "Advanced" tab and in the "Performance" box, click
"Settings"
4. Select the tab "Data Execution Prevention"

Post by Paul
That error is a *warning*.

For Agent 1.93 DEP is a hard error which totally stops Agent 1.93
from running.

[Paul]

Post by Ralph Fox

Post by Paul

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

I would use this first one. It installed just fine in a Win10 VM.
These are from my collection (the collection gathered from questions).
Name: a32en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,405,565 bytes (2349 KiB)
SHA256: B7CFF20A784D61968C7B297CE64B14B4C702623CE7B9DAF307D335DB87EB5FDD
Name: a16en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,548,809 bytes (2489 KiB)
SHA256: 56EDBBD25B81F5A64C3A364F734AAE461E77EDA2136AD5E46F030BBB030EB34B
*******
"The StackHash error occurs when DEP is invoked and has an issue with
whatever application you’re trying to run (and there are several hundred
out there that seem to give it fits). The error is related to
Data Execution Prevention."
"Exception 0xC000041D means that an unhandled exception was encountered
during a user callback. It means that 0xC000041D is a second chance exception.
So we should capture the first chance exception, if we want to know the root cause" <Hah>
And I think that might happen, if memory that is mapped as being for data,
someone tries to execute it as program code.

According to the OP's other post <http://al.howardknight.net/?ID=169299317900>,
both Agent 1.93 and Agent 4 are affected.
Agent 1.93 is not compatible with DEP for applications.
But Agent 4 is compatible with DEP for applications.
If one tries to run Agent 1.93 when DEP is enabled for applications
including Agent 1.93, one will get an exception code 0xc000041d
and Agent 1.93 will not run. Agent 4 is not affected.
Agent 1.93 was built with Borland OWL which used thunk blocks
allocated on the heap and containing dynamically-created code
to be executed. Agent 4 was not built with Borland OWL.

Post by Paul
I can't find a reasonable recipe right now, to fix that.

If the problem were caused by DEP, then...
Either, turn on DEP for essential Windows progams and services only.
Or, add Agent 1.93 to the list of exclusions.
screen-shot: <http://img4.imagetitan.com/img.php?image=26_uc9k9m_1__data_execution_prevention_options.png>
OTOH the inclusion of Agent 4 in the OP's other post might
suggest this is not DEP.
REF: <http://al.howardknight.net/?ID=169299317900>

Post by Paul
You can do an offline scan. The pictorial summary...
https://www.tenforums.com/attachments/tutorials/284639d1592839239-how-run-microsoft-defender-offline-scan-windows-10-a-microsoft_defender_offline_scan-3.png
Full recipe.
https://www.tenforums.com/tutorials/42305-how-run-microsoft-defender-offline-scan-windows-10-a.html
I don't know if that'll remove something, or you'll need sfc /scannow and friends.
I've seen DEP problems before. My old, defenseless WinXP had that once.
While DEP is opt-in or opt-out, I don't recommend removing it
just so you can "avoid" that error.

One does not need to turn off DEP. There are other options
Either, turn on DEP for essential Windows progams and services only.
Or, add Agent 1.93 to the list of exclusions.
screen-shot: <http://img4.imagetitan.com/img.php?image=26_uc9k9m_1__data_execution_prevention_options.png>
To find these options in Windows 10
1. Go to Start >> Settings >> System >> About
2. At the right, click "Advanced system settings"
3. Select the "Advanced" tab and in the "Performance" box, click
"Settings"
4. Select the tab "Data Execution Prevention"

Post by Paul
That error is a *warning*.

For Agent 1.93 DEP is a hard error which totally stops Agent 1.93
from running.

PS> wmic OS Get DataExecutionPrevention_SupportPolicy

DataExecutionPrevention_SupportPolicy
2

0 – DEP is disabled for all processes.
1 – DEP is enabled for all processes.
2 – DEP is enabled for only Windows system components and services. <===

That is apparently how it is set on my W10 Pro VM where Forte 1.93 was working.

Paul

[N***@fmguy.com]

Post by Ralph Fox

Post by Paul

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.

I really didn't like Xananews. There was probably a way to stop it
but every time I got headers it asked me questions, How many iirc &
did I want bodies too.

I've given up on version 1.93 and I'm migrating to version 4. I'll
have big questions about that in a new thread. That post is more
important to fixing things than this one. But I'm posting here to
apologize. See further down.

Post by Ralph Fox

Post by Paul

Post by Micky
.....
HELP!!!!

I would use this first one. It installed just fine in a Win10 VM.
These are from my collection (the collection gathered from questions).
Name: a32en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,405,565 bytes (2349 KiB)
SHA256: B7CFF20A784D61968C7B297CE64B14B4C702623CE7B9DAF307D335DB87EB5FDD
Name: a16en193__forte_free_agent_mirrors_easynews_com.exe
Size: 2,548,809 bytes (2489 KiB)
SHA256: 56EDBBD25B81F5A64C3A364F734AAE461E77EDA2136AD5E46F030BBB030EB34B
*******
"The StackHash error occurs when DEP is invoked and has an issue with
whatever application you’re trying to run (and there are several hundred
out there that seem to give it fits). The error is related to
Data Execution Prevention."
"Exception 0xC000041D means that an unhandled exception was encountered
during a user callback. It means that 0xC000041D is a second chance exception.
So we should capture the first chance exception, if we want to know the root cause" <Hah>
And I think that might happen, if memory that is mapped as being for data,
someone tries to execute it as program code.

According to the OP's other post <http://al.howardknight.net/?ID=169299317900>,
both Agent 1.93 and Agent 4 are affected.

I apologize Ralph and Paul and Paul for including version 4 in my
first post. It was a complicated mistake***. When I decided the
problem might be caused by windows and reposted to this group and the
win10 group, I changed things but I didn't explicitly retract
including version 4, and I should have.

I did learn a lot about DEP however, and I assume that applies in a
lot of places.

*** I used to have 3 versions available on the desktop, two of 1.9
and one of 4, but when I went looking, there were only two icons and I
assumed one was version 4 and when it wouldn't start, I thought
version 4 wouldn't start. Later I saw that it was version 1.9 but it
used a data directory, AgentFF , for Firefox I think.

What could Firefox possibly have to do with Agen?. It's been less
than 3 years but I can't remember.

In addition, I foound a version of 1.93 I had called
agent_original.exe . It's the same length, 2,917,408 as agent193's
exe file but I can't remember what the difference is. It was a
change made with a hex editor. Does anyone know what people changed
in those days.


BTW, I had major problems finding the install program for 1.93 was
a32en193.exe. All there is ais an a, no agent like later versions.
Beffore I saw this anser, on the web I found a post by Ralph from 13
years ago that gave its name. After that I reinstalled it but that
didn't help.

Post by Ralph Fox
Agent 1.93 is not compatible with DEP for applications.
But Agent 4 is compatible with DEP for applications.

....

[Ralph Fox]

Post by N***@fmguy.com
In addition, I foound a version of 1.93 I had called
agent_original.exe . It's the same length, 2,917,408 as agent193's
exe file but I can't remember what the difference is. It was a
change made . Does anyone know what people changed
in those days.

A couple of things people might have done to Agent 1.93 with a
hex editor:
1) Add custom headers;
2) Filter expiry date fix (although I don't recall a fix
for 1.93 being posted by anyone).

[Manfred Polak]

Post by Ralph Fox

Post by N***@fmguy.com
In addition, I foound a version of 1.93 I had called
agent_original.exe . It's the same length, 2,917,408 as agent193's
exe file but I can't remember what the difference is. It was a
change made . Does anyone know what people changed
in those days.

A couple of things people might have done to Agent 1.93 with a
1) Add custom headers;
2) Filter expiry date fix (although I don't recall a fix
for 1.93 being posted by anyone).

Using a resource editor instead of hex editor: Alternative icons.


Manfred

[micky]

In alt.usenet.offline-reader.forte-agent, on Wed, 30 Aug 2023 20:39:19

Post by Ralph Fox

Post by N***@fmguy.com
In addition, I foound a version of 1.93 I had called
agent_original.exe . It's the same length, 2,917,408 as agent193's
exe file but I can't remember what the difference is. It was a
change made . Does anyone know what people changed
in those days.

A couple of things people might have done to Agent 1.93 with a
1) Add custom headers;

I might have changed a hard-coded title. Glad you reminded me.

Post by Ralph Fox
2) Filter expiry date fix (although I don't recall a fix
for 1.93 being posted by anyone).

Don't remember that.

[Paul S Person]

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

The other post by Paul probably is more useful than this will be.

I use Windows Defender. Some time back, something happened to cause it
to flag 32-bit Windows exectables as viruses. This were files inside a
program development repository, ie, files that have been there for
decades and (as it kept picking on them) clearly get rebuilt as
needed. Windows Defender then branched out to claim files in my old
C++ exploratory directories -- files untouched for 15 years or so --
were affected.

My point is that, if you are using Windows Defender, you aren't just
getting major system updates. Windows Defender updates quite often.

Also, I take it you have tried right-clicking (or left-clicking if you
are left-handed) on the Agent icon and selecting "Open"? And, if the
desktop icon is a shortcut, that you have found the executable and
tried to run that directly?

Not that I expect either of these to help, but Win10 is getting
weirder and weirder so who can say?

[Paul]

Post by Paul S Person

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

The other post by Paul probably is more useful than this will be.
I use Windows Defender. Some time back, something happened to cause it
to flag 32-bit Windows exectables as viruses. This were files inside a
program development repository, ie, files that have been there for
decades and (as it kept picking on them) clearly get rebuilt as
needed. Windows Defender then branched out to claim files in my old
C++ exploratory directories -- files untouched for 15 years or so --
were affected.
My point is that, if you are using Windows Defender, you aren't just
getting major system updates. Windows Defender updates quite often.
Also, I take it you have tried right-clicking (or left-clicking if you
are left-handed) on the Agent icon and selecting "Open"? And, if the
desktop icon is a shortcut, that you have found the executable and
tried to run that directly?
Not that I expect either of these to help, but Win10 is getting
weirder and weirder so who can say?

DEP is like a "tripwire for stupid".

It's a hardware feature. Windows does not determine DEP issues
via scanning. This is the hardware saying, "hey, someone just
tried to break into the bank vault and I stopped 'em". A customer
(without a gun), jumps the counter at the bank, and spins the
combination lock on the bank vault door. No money is stolen
and the staff say "hey stupid, you can't break in that way".
It's a kind of mechanical detection.

Say I malloc a data segment. Maybe it's an Excel table in memory.

0x123456 data NX=yes NoExecute - you can't jump here via Program Counter

Now, later, someone tries an exploit.
In that data segment, they have loaded binary, which
just happens to be valid x86 code.

goto 0x123456 # Program counter, jumps to data segment as an exploit/elevation attempt
# Maybe this is a return from subroutine, where the return address is wrong

The hardware goes;

"hey, my hardware support for virtual to physical memory maps,
just detected an attempt to fetch code from a data segment.
The fetching code, is caused by the Program Counter register
jumping to 0x123456"

It's at this point, that the OS maps interrupts of that type,
to a service routine, so they can be logged. In this case, it's
an AppCrash, because the program cannot be allowed to continue when
this happens. It could be, for example, that RAM is bad and
the immediate data on the goto instruction, is actually a corrupted
address value. But we all know that this is bullshit, and that
never happens. The OP is seeing a *consistent* DEP problem. This
is not the roulette wheel at the casino. If Micky only saw one of
these in the last month, I would say "that's the casino for you".

It would still be an AppCrash, even if Windows Defender wasn't
on the computer, and Avast was on there instead.

An AV program may be informed, via some means, that this is
happening, and it could proactively scan the materials. But if
an exploit is using some other complicated means at runtime,
to jump to 0x123456, scanning the data at rest would be useless.
You do not typically expect your computer to help you when
DEP happens.

Paul

[Paul S Person]

Post by Paul S Person

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

The other post by Paul probably is more useful than this will be.
I use Windows Defender. Some time back, something happened to cause it
to flag 32-bit Windows exectables as viruses. This were files inside a
program development repository, ie, files that have been there for
decades and (as it kept picking on them) clearly get rebuilt as
needed. Windows Defender then branched out to claim files in my old
C++ exploratory directories -- files untouched for 15 years or so --
were affected.
My point is that, if you are using Windows Defender, you aren't just
getting major system updates. Windows Defender updates quite often.
Also, I take it you have tried right-clicking (or left-clicking if you
are left-handed) on the Agent icon and selecting "Open"? And, if the
desktop icon is a shortcut, that you have found the executable and
tried to run that directly?
Not that I expect either of these to help, but Win10 is getting
weirder and weirder so who can say?

<snippo explanation of DEP>

1. DEP can be restricted to sytem only. I checked mine and that is how
it is set here. Not that that is relevant to anything.

2. Even if it is allowed for everything, specific items can be
excepted.

3. So Win10 does actually have a great deal of control over DEP. Or,
at least, it claims have it. There's reality, and then there's Win10.

Just because I am only aware of Windows Defender updates doesn't mean
that those are the /only/ not-system-updates being received. Something
on the OPs computers appears to have changed, and it might be a
Windows subsystem whose updates aren't system updates.

Or it may just be that Win10 is now be pretending to itself that DEP
applies to all files, without regard to what the user wants.

Kind of like how it starting pretending to itself, some time back,
that I wanted it to require me to do Ctl-Alt-Del before being
graciously permitted to enter my password. I've tried the online help.
The best I managed is that now it reminds me of the requirement on the
screen before the log in screen.

But only on the mainframe with the AMD processor. The laptop with the
Intel processor doesn't care.

As I have said, Win10 is just getting weirder and weirder.

[Paul]

Post by Paul S Person

Post by Paul S Person

Post by Micky
Win10, fully updated, one Pro and one Homet
Agent worked fine until recently and two nights ago, but they stopped.
About 2 weeks ago, it wouldn't even start. I'd click and if I clicked
on the icon the desktop the little blue circle would be there for a few
seconds. If I clicked where it's pinned to the taskbar nothing at all
happened.
Event Viewer calls it an Event 1001, but it calls a lot of things that.
Level 4, APPCRASH
Continuing my story, that was 2 weeks ago. I tried to fix it but
didn't know how to read the error files listed below. (The only text
file is temp and it's gone now.) I also have other error files when I
run Everything and search for Agent, but I can't find them now. :-(
Then last night, after restarting windows, but NOT s eeing any system
updates, the version on my laptop, the version I use every day, stopped
working. It too does nothing when I click on the task bar, except
write an error file
I finally found on the web a post by Ralph that reminded me of the name
of the install file, so I reinstalled Agent 1.93 into the same
locations but no change. It's paid for and registered.
Has something happened to Windows that might have affected both
computers. Can I remedy it.
Right now I had to start using Xananews.
More of the error message
agent.exe
1.93.576.0
b2102d91
StackHash_5c80
0.0.0.0
00000000
c000041d
PCH_62_FROM_unknown+0x00000000
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CF.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4847.tmp.WERInternalMet
adata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4887.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4905.tmp.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_agent.ex
e_64e4de5a5aebae741324eb1e7f58d97035e11111_97409d5f_58a7e5ca-3bdb-463e-8
3c9-8fcc9c5d56e5
0
0a529edb-6436-4d5b-9130-32cd3ff072ec
268435456
86c5cde41c828b9a49b074df4b5fddbf
0
HELP!!!!

The other post by Paul probably is more useful than this will be.
I use Windows Defender. Some time back, something happened to cause it
to flag 32-bit Windows exectables as viruses. This were files inside a
program development repository, ie, files that have been there for
decades and (as it kept picking on them) clearly get rebuilt as
needed. Windows Defender then branched out to claim files in my old
C++ exploratory directories -- files untouched for 15 years or so --
were affected.
My point is that, if you are using Windows Defender, you aren't just
getting major system updates. Windows Defender updates quite often.
Also, I take it you have tried right-clicking (or left-clicking if you
are left-handed) on the Agent icon and selecting "Open"? And, if the
desktop icon is a shortcut, that you have found the executable and
tried to run that directly?
Not that I expect either of these to help, but Win10 is getting
weirder and weirder so who can say?

<snippo explanation of DEP>
1. DEP can be restricted to sytem only. I checked mine and that is how
it is set here. Not that that is relevant to anything.
2. Even if it is allowed for everything, specific items can be
excepted.
3. So Win10 does actually have a great deal of control over DEP. Or,
at least, it claims have it. There's reality, and then there's Win10.
Just because I am only aware of Windows Defender updates doesn't mean
that those are the /only/ not-system-updates being received. Something
on the OPs computers appears to have changed, and it might be a
Windows subsystem whose updates aren't system updates.
Or it may just be that Win10 is now be pretending to itself that DEP
applies to all files, without regard to what the user wants.
Kind of like how it starting pretending to itself, some time back,
that I wanted it to require me to do Ctl-Alt-Del before being
graciously permitted to enter my password. I've tried the online help.
The best I managed is that now it reminds me of the requirement on the
screen before the log in screen.
But only on the mainframe with the AMD processor. The laptop with the
Intel processor doesn't care.
As I have said, Win10 is just getting weirder and weirder.

In my reply to Ralph, I found this.

PS> wmic OS Get DataExecutionPrevention_SupportPolicy

DataExecutionPrevention_SupportPolicy
2

0 – DEP is disabled for all processes.
1 – DEP is enabled for all processes.
2 – DEP is enabled for only Windows system components and services. <===

And that's for the test VM where I tested Forte 1.93.

That seems to be the default chosen by Microsoft in my case.
I don't know if this policy varies at all or not.

I'm typing this on Windows 11 Home, and the value is "2" also.

Perhaps a third-party AV can change the value ?

Paul

[Char Jackson]

Post by Paul
In my reply to Ralph, I found this.
PS> wmic OS Get DataExecutionPrevention_SupportPolicy
DataExecutionPrevention_SupportPolicy
2
0 – DEP is disabled for all processes.
1 – DEP is enabled for all processes.
2 – DEP is enabled for only Windows system components and services. <===
And that's for the test VM where I tested Forte 1.93.
That seems to be the default chosen by Microsoft in my case.
I don't know if this policy varies at all or not.
I'm typing this on Windows 11 Home, and the value is "2" also.
Perhaps a third-party AV can change the value ?

I would expect the DEP control in the GUI to match what you see with powershell.
Is that not always the case?

[Paul]

Post by Char Jackson

Post by Paul
In my reply to Ralph, I found this.
PS> wmic OS Get DataExecutionPrevention_SupportPolicy
DataExecutionPrevention_SupportPolicy
2
0 – DEP is disabled for all processes.
1 – DEP is enabled for all processes.
2 – DEP is enabled for only Windows system components and services. <===
And that's for the test VM where I tested Forte 1.93.
That seems to be the default chosen by Microsoft in my case.
I don't know if this policy varies at all or not.
I'm typing this on Windows 11 Home, and the value is "2" also.
Perhaps a third-party AV can change the value ?

I would expect the DEP control in the GUI to match what you see with powershell.
Is that not always the case?

That's just the first Google hit I found, on how to check it.

On some older Windows OSes, DEP may have been a "boot line" option.

Paul

[Char Jackson]

Post by Paul

Post by Char Jackson

Post by Paul
In my reply to Ralph, I found this.
PS> wmic OS Get DataExecutionPrevention_SupportPolicy
DataExecutionPrevention_SupportPolicy
2
0 – DEP is disabled for all processes.
1 – DEP is enabled for all processes.
2 – DEP is enabled for only Windows system components and services. <===
And that's for the test VM where I tested Forte 1.93.
That seems to be the default chosen by Microsoft in my case.
I don't know if this policy varies at all or not.
I'm typing this on Windows 11 Home, and the value is "2" also.
Perhaps a third-party AV can change the value ?

I would expect the DEP control in the GUI to match what you see with powershell.
Is that not always the case?

That's just the first Google hit I found, on how to check it.
On some older Windows OSes, DEP may have been a "boot line" option.

Google says DEP started with XP and Server 2003. I don't have a Server 2003 VM
here, but I checked XP, Vista, 7, 8.1, and 10, and each of them have a DEP
control within the GUI. *shrug* It's good to have a couple of ways to do things.

[Ken Blake]

On Sat, 26 Aug 2023 09:04:16 -0700, Paul S Person

Post by Paul S Person
But only on the mainframe with the AMD processor. The laptop with the
Intel processor doesn't care.

A mainframe with an AMD processor? What mainframe is that?

[Paul S Person]

Post by Ken Blake
On Sat, 26 Aug 2023 09:04:16 -0700, Paul S Person

Post by Paul S Person
But only on the mainframe with the AMD processor. The laptop with the
Intel processor doesn't care.

A mainframe with an AMD processor? What mainframe is that?

An HP Envy. I'm using "mainframe" here as opposed to "laptop".

I suppose "desktop" would be a more conventional description.

But I think of it as /my/ mainframe. It is certainly my main computer.

[Ken Blake]

On Sun, 27 Aug 2023 08:47:23 -0700, Paul S Person

Post by Paul S Person

Post by Ken Blake
On Sat, 26 Aug 2023 09:04:16 -0700, Paul S Person

Post by Paul S Person
But only on the mainframe with the AMD processor. The laptop with the
Intel processor doesn't care.

A mainframe with an AMD processor? What mainframe is that?

An HP Envy. I'm using "mainframe" here as opposed to "laptop".

I suspected that that was what you were doing, but as far as I'm
concerned, you are greatly misusing the term "mainframe." Not a big
problem in this thread, since the context made if fairly clear that
you were talking about a desktop PC, but I caution you against
continuing to do that. Doing so can seriously confuse your audience.

Post by Paul S Person
I suppose "desktop" would be a more conventional description.

Yes, by **far**.

Post by Paul S Person
But I think of it as /my/ mainframe. It is certainly my main computer.

Understood, but "mainframe" has a very a very specific meaning,
completely different from your main personal computer.

[Ralph Fox]

Post by Paul S Person
1. DEP can be restricted to sytem only. I checked mine and that is how
it is set here. Not that that is relevant to anything.
2. Even if it is allowed for everything, specific items can be
excepted.
3. So Win10 does actually have a great deal of control over DEP. Or,
at least, it claims have it. There's reality, and then there's Win10.
Just because I am only aware of Windows Defender updates doesn't mean
that those are the /only/ not-system-updates being received. Something
on the OPs computers appears to have changed, and it might be a
Windows subsystem whose updates aren't system updates.

Or the problem may not be caused by DEP. The OP's other post [1] said
that both Agent 1.93 and Agent 4 were affected. Agent 4 is compatible
with DEP.

Post by Paul S Person
Or it may just be that Win10 is now be pretending to itself that DEP
applies to all files, without regard to what the user wants.

I am also running Win10, fully updated. My DEP settings are, turned
on for system only. DEP does not apply to all files; Agent 1.93 still
runs even though Agent 1.93 is not compatible with DEP.

____
REFERENCES

[1] "Subject: Agent 1.93 and Agent 4 won't run."
<http://al.howardknight.net/?ID=169299317900>
<https://groups.google.com/g/alt.usenet.offline-reader.forte-agent/c/K0Vl-cpM_0w>
<URL:news:f224f35b-8f98-4cee-8726-***@googlegroups.com>

[Paul S Person]

Post by Ralph Fox

Post by Paul S Person
1. DEP can be restricted to sytem only. I checked mine and that is how
it is set here. Not that that is relevant to anything.
2. Even if it is allowed for everything, specific items can be
excepted.
3. So Win10 does actually have a great deal of control over DEP. Or,
at least, it claims have it. There's reality, and then there's Win10.
Just because I am only aware of Windows Defender updates doesn't mean
that those are the /only/ not-system-updates being received. Something
on the OPs computers appears to have changed, and it might be a
Windows subsystem whose updates aren't system updates.

Or the problem may not be caused by DEP. The OP's other post [1] said
that both Agent 1.93 and Agent 4 were affected. Agent 4 is compatible
with DEP.

Post by Paul S Person
Or it may just be that Win10 is now be pretending to itself that DEP
applies to all files, without regard to what the user wants.

I am also running Win10, fully updated. My DEP settings are, turned
on for system only. DEP does not apply to all files; Agent 1.93 still
runs even though Agent 1.93 is not compatible with DEP.

I suppose, in theory, he could go spelunking in the Windows logs to
see if anything relevant appears. I found this most helpful (if rather
frustrating) when the SMB1 problem surfaced, as the log entry actually
contained the name of the offending device (my Logitech Squeezebox
Touch), something the error message, no doubt in an attempt to make it
as hard to fix the problem as possible, omitted.

Also, chkdsk might be helpful, although with two different computers
(and so two different hard drives) acting up it seems unlikely.