Buffer Overflow

Question

Thanks in advance to anyone who can help.   My XPS420 has been acting slow lately, I have gotten the 'blue screen of death' although I hate to say I forgot the error message, and most often I have been getting an error from McAfee every time I start my PC.  This is a copy of McAfee's Error: 'A buffer overflow was detected and blocked on your computer.  Process: C:\Windows\system32\Dllhost.exe  Process Description: COM Surrogate'  I ran a HJT on my machine and these are the results.  Please review them and let me know what you think.  McAfee and Spybot both detect no viruses, etc.  The PC is behind a firewall router.  All computers on the network are secured, three are laptops that connect to workplace and school networks.   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:53:38 PM, on 2/25/2008Platform: Windows Vista  (WinNT 6.00.1904)MSIE: Internet Explorer v7.00 (7.00.6000.16609)Boot mode: Normal Running processes:C:\Windows\system32	askeng.exeC:\PROGRA~1\McAfee.com\Agent\mcagent.exeC:\Windows\system32\Dwm.exeC:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exeC:\Program Files\Windows Media Player\WMPSideShowGadget.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Windows\system32\DllHost.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\WindowsMobile\wmdc.exeC:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exeC:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exeC:\Program Files\Logitech\SetPoint\LBTWiz.exeC:\Program Files\Zune\ZuneLauncher.exeC:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Dell Support Center\bin\sprtcmd.exeC:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exeC:\Windows\System32\spool\drivers\w32x86\3\E_FATICFA.EXEC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\AIM6\aim6.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXEC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Logitech\SetPoint\SetPoint.exeC:\Users\Brent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinMailTray.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineTrayIcon.exeC:\Program Files\Dell\Xcelerator\bin\ehLumaQuarkD.exeC:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXEC:\Program Files\Windows Media Player\WMPNSCFG.exeC:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Windows Mail\WinMail.exeC:\Program Files\AIM6\aolsoftware.exeC:\Program Files\Windows Media Player\WMPEnc.exeC:\Windows\explorer.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Internet Explorer\ieuser.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\Macromed\Flash\FlashUtil9e.exeC:\Program Files\McAfee\MSC\mcshell.exeC:\PROGRA~1\McAfee\MSC\McLgView.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =O1 - Hosts: ::1 localhostO2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dllO3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exeO4 - HKLM\..\Run: [StartCCC] 'C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe'O4 - HKLM\..\Run: [NMSSupport] 'C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe' /startupO4 - HKLM\..\Run: [CCUTRAYICON] 'C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe'O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkeyO4 - HKLM\..\Run: [dscactivate] 'C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe'O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXEO4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silentO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [Zune Launcher] 'c:\Program Files\Zune\ZuneLauncher.exe'O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\QTTask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [DellSupportCenter] 'C:\Program Files\Dell Support Center\bin\sprtcmd.exe' /P DellSupportCenterO4 - HKCU\..\Run: [Dell DataSafe Scheduler] 'C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exe'O4 - HKCU\..\Run: [EPSON Stylus CX9400Fax Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE /F*U 'C:\Windows\TEMP\E_S8323.tmp' /EF 'HKCU'O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunO4 - HKCU\..\Run: [Aim6] 'C:\Program Files\AIM6\aim6.exe' /d locale=en-US ee://aol/imApp /HIDEBLO4 - HKCU\..\Run: [SageTV] 'C:\Program Files\SageTV\SageTV\SageTV.exe' -startupO4 - HKCU\..\Run: [Original CD Emulator] C:\Program Files\ZTekWare\Original CD Emulator\Loader.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-21-3445887573-2371820665-54899020-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')O4 - Startup: WinMailTray.exeO4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dllO9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dllO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dllO9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO13 - Gopher Prefix:O15 - Trusted Zone: http://*.mcafee.comO16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CABO16 - DPF: {4E77DBA6-3506-46EC-93C0-AB1E0DBD7E4A} (ZtServiceManager Class) - http://mvod.web.aol.com/mce/new/ServiceMgr.CABO20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll (file missing)O23 - Service: McAfee Application Installer Cleanup (0129791203926566) (0129791203926566mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\012979~1.EXEO23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exeO23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: Autodesk Data Management Job Dispatch - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exeO23 - Service: Autodesk EDM Server - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Webserver\Connectivity.EDMWS.Server.exeO23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exeO23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exeO23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exeO23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXEO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exeO23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exeO23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exeO23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satelliteaysat_3dsMax2008_32server.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exeO23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exeO23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exeO23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exeO23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe --End of file - 14637 bytes Thanks Again!

bsmmoney · Answer

Has anyone else had McAfee say 'buffer overflow' when first looging in?

babkesm · Answer

YES. Repeatedly. And whenever it happens, I can't run my explorer internt bowser. All other software works fine.

Yesteday, McAfee tech support had me delete all temp files everywhere, then completely removed every trace of Mcafee, Finally, the complete software was reloaded from scratch. That fixed the problem until this morning, when I got the pop-up "Buffer Overflow" message again, and iexplorer again froze. So, I called Dell tech support. They had me enter a couple of reset commands via the command prompt. After a restart, that worked OK, until I closed and re-opened the browser.

The only way I am able to get thiongs to function normally is to use "System Restore", choosing an earlier restore date/point, thus resetting the registry and who knows what else. But every morning the problem returns. Mcafee could not help. Dell could not help. Not sure what to do next.

Bugbatter · Answer

Have you tried uninstalling McAfee via Add/Remove Programs, running the Removal Tool, and installing another anti-virus?

* If you are running Spybot's TeaTimer, disable that while you do this, or it may interfere with the removal.

First, go to the McAfee Security Center (via the icon in your system tray) to DISABLE each of the individual McAfee components that you plan on removing.

Next, go to Add/Remove Programs and remove components of McAfee Security Center.

   1. Download the removal tool from:
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

   2. Click Save and save the file to any folder on your computer.

   3. Navigate to the folder where the file is saved.

   4. Make sure all McAfee windows are closed.

   5. Double-click MCPR.EXE to run the removal tool.

       Note: Windows Vista users must right-click MCPR.EXE and select Run as Administrator.

   6. Restart your computer after receiving the message CleanUp Successful.

       Your McAfee product will not be fully removed until the system is restarted.

Please see this page for FREE SECURITY SOFTWARE

** bsmmoney, your Java is outdated.

Download -- to your Desktop -- JavaRa.Zip from either of these two sites:
http://prm753.bchea.org/click/click.php?id=9
http://www.majorgeeks.com/JavaRa_d5967.html

Unzip the download. This will create a new Folder, JavaRa on your Desktop.
Double click this new Folder to open it, and double click the file within: JavaRa to execute the program.
Click the button: Remove Older Versions.
Agree to the cleanup operation by clicking Yes. After a moment, a notice will appear that a log file has been produced. Click OK. Close the Notepad view that opens.
Click the button: Other Tasks.
Choose these options:
Remove Useless JRE Files
Remove Startup Entry
Remove JavaRa Logfile
Click Go. When it finishes, click OK to close the panel, and then Exit the program.
Delete the download, and the unzipped folder and all contents.
Go to http://java.sun.com/javase/downloads/index.jsp
Download Java Runtime Environment (JRE) 6 Update 12.
Select Windows Offline Installation > SAVE it to your desktop, do not RUN it yet.
When the download is complete, close all browser windows and double-click on the saved file to install the update. Be patient: It may take five (5) minutes or more for the installation to complete.
If the installation gives you the option to install a toolbar UNCHECK the option if you don't want it .
Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Virus & Spyware

Buffer Overflow

Was this post helpful?