[0x7FFFBB83E044] ANOMALY: use of REX.w is meaningless (default operand size is 64) #8876

@DHowett commented on GitHub (Jun 7, 2020):

My team does not own any code that would print this message. Do you have a hook library on your system that is injecting into these processes?

@DHowett commented on GitHub (Jun 7, 2020): My team does not own any code that would print this message. Do you have a hook library on your system that is injecting into these processes?

claunia commented

@lovanya commented on GitHub (Sep 21, 2020):

I have this problem on Windows 10 Professional 19041.508 too.
Before I updated to 19041.508, I didn't have this problem.

@lovanya commented on GitHub (Sep 21, 2020): I have this problem on Windows 10 Professional 19041.508 too. Before I updated to 19041.508, I didn't have this problem. ![image](https://user-images.githubusercontent.com/16385444/93727815-84ae6a80-fbef-11ea-87a3-f06c445dbbdd.png)

claunia commented

@DHowett commented on GitHub (Sep 21, 2020):

My team does not own any code that would print this message. Do you have a hook library on your system that is injecting into these processes?

I used an internet search engine to look this up and found that it's coming from TrendMicro OfficeScan.

@DHowett commented on GitHub (Sep 21, 2020): > My team does not own any code that would print this message. Do you have a hook library on your system that is injecting into these processes? I used an internet search engine to look this up and found that it's coming from TrendMicro OfficeScan.

claunia commented

https://blog.davidz.cn/inspur-ip-guard-uninstallation/

@Cppowboy commented on GitHub (Sep 21, 2020):

I have this problem on Windows 10 Professional 19041.508 too.
Before I updated to 19041.508, I didn't have this problem.

I hope this can help.

@Cppowboy commented on GitHub (Sep 21, 2020): > I have this problem on Windows 10 Professional 19041.508 too. > Before I updated to 19041.508, I didn't have this problem. > ![image](https://user-images.githubusercontent.com/16385444/93727815-84ae6a80-fbef-11ea-87a3-f06c445dbbdd.png) https://blog.davidz.cn/inspur-ip-guard-uninstallation/ I hope this can help.

claunia commented

@lovanya commented on GitHub (Sep 22, 2020):

I have this problem on Windows 10 Professional 19041.508 too.
Before I updated to 19041.508, I didn't have this problem.

https://blog.davidz.cn/inspur-ip-guard-uninstallation/

I hope this can help.

I read the blog too, but don't have the permission to uninstall TrendMicro. I tried to turn off it, but this doesn't help.
Before I updated windows, I didn't have this problem.
BTW, this problem will bring problems to git x64. so I switched git to x86, it works normally now.

@lovanya commented on GitHub (Sep 22, 2020): > > I have this problem on Windows 10 Professional 19041.508 too. > > Before I updated to 19041.508, I didn't have this problem. > > ![image](https://user-images.githubusercontent.com/16385444/93727815-84ae6a80-fbef-11ea-87a3-f06c445dbbdd.png) > > https://blog.davidz.cn/inspur-ip-guard-uninstallation/ > > I hope this can help. I read the blog too, but don't have the permission to uninstall TrendMicro. I tried to turn off it, but this doesn't help. Before I updated windows, I didn't have this problem. BTW, this problem will bring problems to git x64. so I switched git to x86, it works normally now.

claunia commented

@Cppowboy commented on GitHub (Sep 24, 2020):

I have this problem on Windows 10 Professional 19041.508 too.
Before I updated to 19041.508, I didn't have this problem.

https://blog.davidz.cn/inspur-ip-guard-uninstallation/
I hope this can help.

I read the blog too, but don't have the permission to uninstall TrendMicro. I tried to turn off it, but this doesn't help.
Before I updated windows, I didn't have this problem.
BTW, this problem will bring problems to git x64. so I switched git to x86, it works normally now.

I deleted all the *.dll files in the system related to the company T.E.C, and the annoying log is gone.

@Cppowboy commented on GitHub (Sep 24, 2020): > > > I have this problem on Windows 10 Professional 19041.508 too. > > > Before I updated to 19041.508, I didn't have this problem. > > > ![image](https://user-images.githubusercontent.com/16385444/93727815-84ae6a80-fbef-11ea-87a3-f06c445dbbdd.png) > > > > > > https://blog.davidz.cn/inspur-ip-guard-uninstallation/ > > I hope this can help. > > I read the blog too, but don't have the permission to uninstall TrendMicro. I tried to turn off it, but this doesn't help. > Before I updated windows, I didn't have this problem. > BTW, this problem will bring problems to git x64. so I switched git to x86, it works normally now. I deleted all the *.dll files in the system related to the company T.E.C, and the annoying log is gone.

claunia commented

@520jefferson commented on GitHub (Oct 11, 2020):

i have the same problem when i update to 2004

[0x7FF9F0CAE044] ANOMALY: use of REX.w is meaningless (default operand size is 64)
2020/10/11 17:32:18 failed to install wsl2host: service wsl2host already exists

@520jefferson commented on GitHub (Oct 11, 2020): i have the same problem when i update to 2004 [0x7FF9F0CAE044] ANOMALY: use of REX.w is meaningless (default operand size is 64) 2020/10/11 17:32:18 failed to install wsl2host: service wsl2host already exists

claunia commented

@bluehymn commented on GitHub (Feb 23, 2021):

if your problem coursed by T.E.C ip-guard but you have not permission to remove it, we can modify Regedit to exclude some application monitored by ip-guard.
First, create a key 'hookapi_filterproc_external' in 'HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config' if does not exist, then add 'cmd.exe; wsl.exe, etc.' or '*.exe' to the value;

@bluehymn commented on GitHub (Feb 23, 2021): if your problem coursed by T.E.C ip-guard but you have not permission to remove it, we can modify Regedit to exclude some application monitored by ip-guard. First, create a key 'hookapi_filterproc_external' in 'HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config' if does not exist, then add 'cmd.exe; wsl.exe, etc.' or **'*.exe'** to the value; ![image](https://user-images.githubusercontent.com/15361704/108812287-d2d5f880-75e9-11eb-86f7-49cd5459d619.png)

claunia commented

@frankfancode commented on GitHub (Mar 4, 2021):

https://github.com/microsoft/terminal/issues/6391#issuecomment-783969254
I solve this puzzle use this way

@frankfancode commented on GitHub (Mar 4, 2021): https://github.com/microsoft/terminal/issues/6391#issuecomment-783969254 I solve this puzzle use this way

claunia commented

@KalleOlaviNiemitalo commented on GitHub (Mar 4, 2021):

I wonder if the REX prefix in question is part of the "rex.w jmp reg" required for a tail call via a function pointer, as documented in RtlVirtualUnwind function (winnt.h) and Quick note about x64 Tail call.

@KalleOlaviNiemitalo commented on GitHub (Mar 4, 2021): I wonder if the REX prefix in question is part of the "rex.w jmp reg" required for a tail call via a function pointer, as documented in [RtlVirtualUnwind function (winnt.h)](https://docs.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-rtlvirtualunwind) and [Quick note about x64 Tail call](https://docs.microsoft.com/en-us/archive/blogs/freik/quick-note-about-x64-tail-call).

claunia commented

@azhi09 commented on GitHub (Mar 26, 2021):

if your problem coursed by T.E.C ip-guard but you have not permission to remove it, we can modify Regedit to exclude some application monitored by ip-guard.
First, create a key 'hookapi_filterproc_external' in 'HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config' if does not exist, then add 'cmd.exe; wsl.exe, etc.' or '*.exe' to the value;

I create this new key but auto remove after reboot. @bluehymn

@azhi09 commented on GitHub (Mar 26, 2021): > if your problem coursed by T.E.C ip-guard but you have not permission to remove it, we can modify Regedit to exclude some application monitored by ip-guard. > First, create a key 'hookapi_filterproc_external' in 'HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config' if does not exist, then add 'cmd.exe; wsl.exe, etc.' or **'*.exe'** to the value; > > ![image](https://user-images.githubusercontent.com/15361704/108812287-d2d5f880-75e9-11eb-86f7-49cd5459d619.png) I create this new key but auto remove after reboot. @bluehymn

claunia commented

@bluehymn commented on GitHub (Mar 26, 2021):

重启以后 ip-guard 应该会恢复注册表，需要再改回来 @azhi09

@bluehymn commented on GitHub (Mar 26, 2021): 重启以后 ip-guard 应该会恢复注册表，需要再改回来 @azhi09

claunia commented

@azhi09 commented on GitHub (Mar 26, 2021):

重启以后 ip-guard 应该会恢复注册表，需要再改回来 @azhi09

这么说来，如果我改了注册表这个地方后没解决问题，就可能不是 ip-guard 导致的了？

@azhi09 commented on GitHub (Mar 26, 2021): > 重启以后 ip-guard 应该会恢复注册表，需要再改回来 @azhi09 这么说来，如果我改了注册表这个地方后没解决问题，就可能不是 ip-guard 导致的了？

claunia commented