1 2 Previous Next 10 Replies Latest reply on Dec 3, 2008 4:00 PM by Grif

    Blocked by Buffer Overflow Protection

      I have one computer that started getting on-Access Scan Message alerts 2 days ago. It is always the same message and occurs anytime he attempts to open Internet Explorer or any of our IE-based apps. The message is as follows:

      Name: C:\Program Files\Internet Explorer\iexplore.exe:KERNEL32.GetProcAddress

      Detected As: BO:Writable BO:Heap

      State: Blocked by Buffer Overflow Protection

      I have uninstalled Java and re-installed with the latest version; Update IE from ver 6 to 7.

      If I disable Buffler Overflow Protection from the workstation all is well, however, the program is controlled by our EPO server so it always reverts back to enabled, which is what I want anyways.

      Any thoughts on how to solve this would be much appreciated. We are running VirusScan Enterprise Edition 8.5.0i
        • 1. RE: Blocked by Buffer Overflow Protection
          Peter M
          What VirusScan version is this as you've posted under an obsolete version of the home products?
          • 2. RE: Blocked by Buffer Overflow Protection
            It sounds like you're using a corporate version of VirusScan.. There are a couple of ways to fix that issue.. The quickest is to open the VirusScan Console and disable the Buffer Overflow Protection. The second way is to use the "On Access Scanner" settings in the VirusScan Console and exclude the file from scanning or from the Buffer Overflow Protection.

            Hope this helps.

            Grif
            • 3. RE: Blocked by Buffer Overflow Protection
              Peter M
              In that case I moved it to Desktop & Server,
              • 4. buffer overflow protection
                Sorry, I meant to publish this under the desktop and servers group. I have ePolicy Orchestrator 4.0.0 Console installed on the server. VirusScan Enterprise Edition 8.5.0i

                Other than disabling the Buffer Overflow Protection at the server level for all users, how can I get around this issue which only affects one computer?
                • 5. RE: buffer overflow protection
                  You don't mention which Patch version for VS 8.5i you have installed. We are currently at Patch #6.. Patch #5 or later should take care of that problem. Download the patch from the link below using your corporate grant number to setup an account there.

                  https://mysupport.mcafee.com/eservice_enu

                  And because the error is generally caused by malware, try downloading, installing, updating, then running a full system scan with the free SuperAntispyware tool from the link below:

                  SUPERAntispyware Removal Tool

                  Hope this helps.

                  Grif
                  • 6. RE: buffer overflow protection
                    SuperDAT
                    do a full system scan if you haven't

                    check program files\common\

                    if you have a helper.dll and helper.sig those are the culprit

                    submit to webimmune.net if the scan did not pick them up and then delete.
                    • 7. RE: buffer overflow protection
                      I had a similar problem with Internet Explorer. It would try to open, but McAfee would block it with the Buffer Oveflow error. When I rebooted, things would start up normally, but there would be a Windows Explorer window opened to the Program Files\Common folder. The two files listed above were the only two files in the folder. I deleted them and IE worked after that.
                      • 8. RE: buffer overflow protection
                        some one help i tries evrything in this thread and still have this error

                        11/28/2008 8:36:15 PM Blocked by Buffer Overflow Protection PROCUTLLC\cenlow C:\Program Files\Internet Explorer\iexplore.exe::VirtualProtectEx bo:heap
                        11/28/2008 9:58:03 PM Blocked by Buffer Overflow Protection PROCUTLLC\cenlow C:\WINDOWS\explorer.exe::VirtualProtectEx bo:heap
                        11/28/2008 11:39:30 PM Blocked by Buffer Overflow Protection PROCUTLLC\cenlow C:\Program Files\Internet Explorer\iexplore.exe::InternetOpenA bo:heap
                        11/28/2008 11:49:11 PM Blocked by Buffer Overflow Protection PROCUTLLC\cenlow C:\Program Files\Internet Explorer\iexplore.exe::RegOpenKeyA bo:heap
                        11/29/2008 8:19:58 PM Blocked by Buffer Overflow Protection PROCUTLLC\cenlow

                        im running windows xp pro w vs enterprise 8.0 patch 13 done all updates and still have this what else can i do?
                        • 9. RE: buffer overflow protection
                          griff please help!!!!!!!!!
                          1 2 Previous Next