I’ve had great response with the EMET post and had a couple of issues to follow up on.
How did you get SEHOPS to be Always on?
The system I was running when taking the screen shots was Vista 64-bit and apparently this is a Vista only option. On windows 7, by default, you have only “Application Opt in and Application Opt Out”. I did some testing on this and used process monitor to determine what registry key was being changed on the systems.
disabled is 1 and always on is 0
This is the same key on both Windows 7 and Vista, so this must be controlled at a deeper level then we can directly interact with.
Lsass and Spooler Crashing on Boot.
Rationallyparanoid has several great posts about EMET. They mentioned adding LSASS.exe and Spooler.exe to the protected applications. This worked on older versions of Emet, but I’m having crash issues on Vista 64-bit SP2 with 2.1. I have removed the BottomUPRand and EAF and it appears to fix the instability issues on these applications. Windows 7 64-bit does not seem to be experiencing this issue.