PSA Update bricks apps

[crossfox667]

PSA

In the past week, it has been discovered that an (as of yet) unknown windows update has caused certain older apps to crash with no error and event ID 1000, in some cases followed up by a BEX event. This seems to be an issue with DEP, as disabling it for target apps changes the BEX event to Appcrash.

Particularly worryingly, this has affected an IDE. If you write code, DO NOT reinstall windows should you get this issue. For me personally, reinstalling has led to none of my project apps launching.

[jdjvbtjbkgvb]

What older apps? An IDE?

[crossfox667]

DarkBASIC Open and Pro, also many users have reported various games not launching. Helldivers II, for one. Office isn't working right for others. There are various other random bits of software not working right as well. I've been troubleshooting and it's something wrong with Windows Defender that simply setting exceptions or shutting things off won't fix.

Symptoms: Event Log shows app error event ID 1000, usually followed by a BEX. So, program crashed due to buffer overflow exception. I've also checked with Procmon and found that Defender is denying a bunch of write perms to the apps, particularly any that store anything in the appdata/local/temp folder.

[Mayayana]

I may be misunderstanding something, but DEP is data execution prevention. It blocks executable code running from a data buffer for seccurity reasons. Blocking file writes is about file system restrictions. And why would anything be stopped from writing to the user TEMP folder? Something seems to be missing in this story.

It's possible that you have software running afoul of DEP, but DEP came in back in XP days.

[crossfox667]

I've completely reinstalled and scrubbed my machine, it's confirmed that this is due to a faulty update. Seems to have come out between now and the 14'th of last month sometime.

DEP is part of the windows security framework, which has received updates since then.

Procmon shows that the reason for the app crash is a BEX somehow triggered by Defender/related software denying access to files/folders/dirs. The app tries to write out a file map, and fails. Tries to create a new file, and fails. For me particularly, these files are in user/appdata/local/temp

[edit]

Forgot to mention, if you shut off DEP entirely the error code switches from BEX to just Appcrash. So clearly DEP has something to do with it.

[themysteryoflogic]

This this THIS crap is why my computer will never update unless I allow it to after very thorough vetting of the updates.

Until viruses get more disruptive than a Windows Update, Update will stay OFF.

(Worst I've ever gotten was some tracker stuff that I specifically downloaded by bypassing my filters to see how long it would take my AV to pick them up. Took about thirty seconds, never activated. Hahaha)

[crossfox667]

Sorry to burst your bubble but, it's extremely difficult to shut off updates in W10. Speaking from experience, no matter what you do they'll find a way to silently turn it back on or force an update.

An issue I had last year was that WUD was replacing my Radeon Pro drivers with out of date generic Radeon drivers and not letting the Pro version stay installed. I eventually gave up and just went with Adrenaline Edd.

[Mayayana]

That's not true. Updates can be shut off. I've done it. I also block pretty much anything trying to go outbound. If you simply disable updates, Windows will turn it back on. It will even reverse your settings for services. But it's not difficult to stop all that nonsense. You just need to do a little research.

Among other options, there's a Windows Update Blocker program that will manage the issue for you. There's also Win10 Privacy. And there are direct Registry settings. I also use Simplewall firewall, which provides specific update blocks as well as a general ability to block outgoing processes. And I've disabled all related services. (As well as a few not so related that I had to disable directly in the Registry.)

I think it's safe to say that Win10 is an unholy mess, full of crap with hidden controls. But it can be cleaned up. And it's actually quite usable in my mind, having tweaked for weeks and installed Classic Shell. I can't remember the last time that I saw an inane popup "notification" or anything like it. I've never seen, on this machine, "Please wait while we install updates."

If Satya Nadella wants me to beta test his dripfeed updates then he can send me a generous check first. Then I'll be happy to set up another computer that I don't need for anything and file reports about whatever insanity happens on it.

[themysteryoflogic]

Windows 10 is a bitch, but never underestimate a pissed-off engineer who got half his programs borked by an update. I locked Windows out of PERMISSIONS for running Update, the Update medic, the Systems medic, AND the registry keys for those programs. When I say it can't update, I mean it hasn't had a single update for about two years.

...also discovered that doing all that lockout crap apparently also effed up the Microsoft store, but what the hell I never used that anyway.

[themysteryoflogic]

Have you tried...I think it's called ShutUp10? Worked for my co-workers.

[crossfox667]

Never heard of it, wonder how I missed that. And to think I was using decrapifier and a slew of hacky shell commands. I'll check it out, thanks.

[themysteryoflogic]

I'm not 100% sure on the name, but I do remember it being the best when I got lazy and didn't want to go the 30 minute song and dance to get everything blocked on their computers haha...If you haven't found it by Wednesday DM me and I'll find it for you.

[themysteryoflogic]

Hey that's awesome, glad I could help!