buffer overflow detected by McAfee

[wengang]

Hi all.
I have McAfee VirusScan installed, Windows XP SP2

The past few days the VirusScan Alert window has been popping up every few seconds, logging this error:

Pathname: C:\Program Files\Internet Explorer\iexplore.exe::GetProcAddress
or
Pathname: C:\Windows\explorer.exe::GetProcAddress


Detected as: bo:stack
Detection Type: buffer overflow

Status: Blocked by buffer overflow protection
_______________

I get one at least once a minute while actively using windows or the internet.
The problem is that (besides it's really annoying) I can't figure out how to stop the problem. I googled this and found several articles about vulnerabilities in windows and IE, but did not give any course of action. It does not appear to be a virus, but an application that exploits IE and Windows :GetProcAddress. McAfee's website offers no further help on the matter. Symantec (Norton) mentioned a trojan named CodeRed I and II and had a download to detect and clean, but I ran it and it said I was virus-free. McAfee finds no virus either.

Apparently buffer overflow protection prevents the overflow but basically, I just want it to stop popping up. I've looked at all the processes running but nothing looks out of the ordinary.

Anybody else have similar experience? Is there a non-reformat my hard drive solution?

Thanks
Wengang

[Porsche944]

Here at our network as a System Admin I had a machine that receiveing this same type of expliot. I ended up tracking it to a website (popup add) that was attempting to expliot IE. Next time you receive this error note what website you are on and any popups that are up. You can use your internet explorer cache and history for this.


Then add that website to your untrusted sites list.

It stopped the problem I was having here. Your situation might be diffrent, none the less it's a good place to start.

[wengang]

hi
thanks

But i'm getting this on every website, whenever IE is open, getting it on explorer too, whenever I am using the PC, any program (though the problem is traced to explorer.exe::GetProcAddress)

When I stop using the PC, the message doesn't pop up anymore, so it must be running in the background, activated by clicks somehow

[dglienna]

www.trendmicro.com has an Online Virus Checker (Housecall) that you can run from your browser (IE only) which is pretty good. M$ reccommended it to me when SP2 came out, and they suspected that i had a virus (instead of a unique soundcard that had drivers that were out of date)

[BodwadUK]

I would run spybot and an antivirus. A virus could be trying to run and crashing out

Have you installed anything new recently?

[WilliamRobinson]

Hmm iv had problems in the past with McAfee there a viruses specialy designed for it and i make it so you cant open any programs, so therefor you aint virus scanning that why that online virus check is good but im just saying that i dont like McAfee, Maybe the updated version are better and dont allow viruses to stop the progam but i wouldnt know iv not used it for about a year

[minetraw]

Hi. Was anyone able to solve this problem. When I boot up my pc, McAfee and other antiviruses that i use is showing this message "Blocked by Buffer Overflow Protection". If anyone has a solution, please help

[Lord Orwell]

go into you internet explorer settings to "addons" and disable everything, especially anything with a random name. If you ever visited a website and it wanted to run xml scripting addon, that is their foothold. Now they can install whatever the heck they want in IE then try this exploit to install any trojans/spyware they wish in your regular system. My wife was victimized by IE addons that spybot didn't delete even with teatimer running and a full scan. Manually disabling them did the trick.

Also try running a different browser such as firefox to see if that stops the errors.

[plasticfloor]

Hey!
I'm having the exact same problem
This is very annoying and I'm nearing the inevetable reinstallation of my computer.
I Hate McAfee but I have a laptop from work and I'm not allowed to remove it.

please tell me you've found the solution?