Buffer Overflow

[jking]

For the last week or so, we have been fighting what McAfee calls a "Buffer Overflow".

About a week and a half ago, I tried to go fill out an online reference survey for a former employee. He'd applied for a job & the employer has gone paperless. They have references fill out an online survey rather than send out a form. When I tried to access the link for the survey, McAfee popped up a message that it had blocked a buffer overflow. Internet Explorer then locks up & you have to close it through the task manager. IE is the only program affected by this.

My initial online searching seemed to indicate this was related to some kind of adware/malware. I've run several system scans & McAfee has cleaned a couple of things off, but, after getting Internet Explorer to run again for a few days, the buffer overflow message came back & I haven't been able to get whatever is going on fixed this time.

Any ideas?

[crokett]

Use something else besides MacAfee. Start with Spybot Search and Destroy. In my experience that has been the most reliable to detect and clean systems.

[pelligrini]

When's the last time you cleared out your cache for IE?

You might try downloading firefox to see if it will let you access the site.

[Rand]

I second the get rid of McAfee idea.

I highly recommend AVG Free. It works really well and you can't beat the price. FREE!

[herb fellows]

After 3 years with McAfee, i've had enough. It came with the comp, so I took it for convenience sake. Big mistake!

Over the last 3 days, I ditched mcAfee, added Spybot s&d, AVG Free and Zone Alarm. It's only been a few days, but so far I'm a happy camper with a faster running computer (things McAfee missed were found).

[BobSch]

Get a copy of malwarebytes from http://tinyurl.com/d5jtuz and run that to see what it shows. That and AVG have kept my machines bug-free for several years now.

PS If you Google for malwarebytes, don't get sucked in by:
____________________________________________
Malware Anti-Malware Free

Malwaree.org/Anti-Malware Top Rated 2009 Anti-Malware! 100% Free Download - Recommended
_____________________________________________

The url with the extra "e" at the end looks suspicious to me.

[crokett]

I didn't mean throw out McAfee entirely. I've never used it so don't have an opinion. I just meant get a few other antivirus/antispyware programs and run them to see what they see.

[LCHIEN]

change of tack. When was the last time you uppdated windows?
Many mal-ware programs exploit buffer overruns which are windows program errorrs that when a buffer is used ends up using mroe than alolocated and checked for and write data into memory which may later get executed and allow a worm to run.
By detecting buffer overruns it may indeed be stopping a virus or worm. It apparently is not recovering from the overrun. Overruns should not happen, when they are discovered and worms take advantage of them, usually MS issues patches and program updates to fix it.

So, when was the last time you updated Windows?

[jking]

change of tack. When was the last time you uppdated windows?
Many mal-ware programs exploit buffer overruns which are windows program errorrs that when a buffer is used ends up using mroe than alolocated and checked for and write data into memory which may later get executed and allow a worm to run.
By detecting buffer overruns it may indeed be stopping a virus or worm. It apparently is not recovering from the overrun. Overruns should not happen, when they are discovered and worms take advantage of them, usually MS issues patches and program updates to fix it.

So, when was the last time you updated Windows?

If you are referring to the automatic updates, they are turned on & I install those whenever there are updates that show up to install. If you're asking when the last time I upgraded the OS, I am running XP Pro. I have not & do not intend to upgrade to Vista.

On a side note, McAfee did clean something off the system tonight & IE is working. (for now)

[jking]

So, everytime I think this issue is solved, it rears it's ugly head again.

I downloaded & installed Spybot S&D and ran it on Friday, it found one item & removed it. Things seemed to be working fine until today. McAfee blocked another buffer overflow & IE locked up again.

I had my wife run Spybot again, and it found six cases of win32.killAV-KQ. It cleaned five of them, said restart the computer to get rid of the last one. We'll see if it works. This is starting to get kind of ridiculous. I now have McAfee running which apparently I need to catch the buffer oveflow and then run Spybot to find & clean the problem.

Am I likely to be perpetually dealing with these problems now that they've gotten on my computer?

[crokett]

Am I likely to be perpetually dealing with these problems now that they've gotten on my computer?

In my experience, yes. I've cleaned two infected systems for family but that took longer both times than simply reinstalling the OS and all the apps would have.

[Alex Franke]

Does the buffer overflow only happen on that survey site, or is it everywhere? If so, it could just be sloppy code. (e.g. something along the lines of an infinite loop in the javascript code that runs within the browser on your computer)

That said, it's a good thing that McAfee is catching it. IE should not allow it to happen, and McAfee should indeed be policing it. They can be used to do nasty stuff to your system. In case you're interested I wrote a bit about buffer overflows last year on page 4 of this article.

[sparkeyjames]

Stop using internet Explorer and switch to Firefox.. This alone should solve the buffer overrun problems. Oh yes and McAfee's suite of internet safety programs are a resource hog. I have never failed to find it taking 10% or more of system CPU and memory resources. The FREE triple threat of AVG, Spybot Search & Destroy and Zone Alarm is better than whatever McAfee produces. Add to that switching to Firefox for web surfing and Thunderbird for email and you have a system that can remain pretty clean for a good while.

Http://www.mozilla.com

[Alex Franke]

Stop using internet Explorer and switch to Firefox. . . .McAfee's suite of internet safety programs are a resource hog. I have never failed to find it taking 10% or more of system CPU and memory resources.

FF right now on my machine is consuming about 350MB -- about 8 times the next on the list -- and I restarted this morning. It's not perfect either out of the box, but I still prefer it.

[jking]

Does the buffer overflow only happen on that survey site, or is it everywhere? If so, it could just be sloppy code. (e.g. something along the lines of an infinite loop in the javascript code that runs within the browser on your computer)

It started when I tried to go to the survey site (never actually got it pulled up), but now, when it happens it is just when you open Internet Explorer. Hopefully, Spybot will do it's thing & keep stuff cleaned off.

Stop using internet Explorer and switch to Firefox.. This alone should solve the buffer overrun problems. Oh yes and McAfee's suite of internet safety programs are a resource hog. I have never failed to find it taking 10% or more of system CPU and memory resources. The FREE triple threat of AVG, Spybot Search & Destroy and Zone Alarm is better than whatever McAfee produces. Add to that switching to Firefox for web surfing and Thunderbird for email and you have a system that can remain pretty clean for a good while.

Http://www.mozilla.com

Hey sparkey, tone it down, ok? I may look into Firefox in the future, but, I doubt I'll switch my e-mail program. I currently use Outlook both at home & work. It's a pretty good program; I haven't used any else in about 10 years. I like to stick with what works.