"Buffer overrun detected" when opening Internet Explorer

[novice]

Hi

When I try to run Internet Explorer, I get the following message:

"Buffer overrun detected!
Program C:\Program Files\Internet Explorer\Iexplore.exe
A bufer overrun has been detected which has corrupted the program's internal state. The program cannot safely continue execution and must now be terminated".

Some of the steps I have taken to resolve the error without any success include:

- reinstalling Windows 98
- running Spybot, AdAware and SpySweeper

I have attached the log file from HiJack This. Any advice would be much appreciated.

Thanks.

 

[crazylady]

buffer overruns are rampant

After installing XP SP2, which I uninstalled because I hated it, I started to get the buffer overrun message only mine was: Program:C:\ProgramFiles\MS_Update\MS_Services.exe and then the same message as yours regarding termination. I called Gateway and they told me it was a virus and to talk to Norton. Norton said they had no knowledge of it and couldn't help me. I went on line to a sight and they told me to download a variety of Spycatching websites which I did. running them all but none of them got rid of this dumb popup. Now it appears at least once a day, usually after I log on to pc. Doesn't appear after any particular time, but usually within 10 minutes of logon. Can't connect it to any particular site and nothing on my pc doesn't work because of it. I just click on it, it goes away and doesn't appear until the next day. I really feel it has something to do with SP2, but have no way to prove it and NOBODY can tell me how to get rid of it. I am resigned to just clicking on it each day but would really like to know what it is and how to get rid of it. I just now went looking again for info and was amazed at how many people are bothered by the same type of popup. Thanks for listening and if you get iny info on it, give a holler and I will do the same!!

 

[RealBlackStuff]

novice

I would strongly advise you to UNinstall the Netscape browser and install Firefox instead. from www.getfirefox.com
Also, do NOT use IE anymore, except for Windows-updates.

Boot in Safe Mode.
UNinstall anything to do with this rubbish:
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-AU\MSNAPPAU.EXE
C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL
C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
C:\PROGRA~1\DAP\dapextie.htm
C:\PROGRA~1\DAP\dapextie2.htm

Next, run HJT on its own and let it 'fix' (if still there):
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-AU\MSNAPPAU.EXE

ONLY 'fix' these N1 and N2 entries if you have UNinstalled Netscape!
N1 - Netscape 4: user_pref("browser.startup.homepage", "tjar.com"); (C:\Program Files\Netscape\Users\default\prefs.js)
N2 - Netscape 6: user_pref("browser.startup.homepage", "theage.com.au"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\4rpeapsw.slt\prefs.js)
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%206%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\4rpeapsw.slt\prefs.js)

'Fix' the rest of this lot:
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {D6016EE7-A8FF-11D1-B37E-A4759ECD7909} (AxPulse Class) - http://www.pulse3d.com/players/english/PulsePlayerAxWin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://www.proformacorp.com/downloads/files/ishield/iftwclix.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab
O16 - DPF: {5A3C6507-730A-43B2-8EAC-4C430F2EF35E} (PortfolioManager Class) - https://portfoliomanager.westpac.com.au/portfoliomanager/portfoliomanager.cab
O16 - DPF: {FE8400F2-C848-4379-989F-DF2ED39040BE} (Eyeball Instant Messaging Control) - http://www.rsvp.com.au/chat/RSVPChat.cab

When done, delete the highlighted bold files. When a directory-name is bold, delete everything in it, including that directory itself.
Boot normal.

Surf to www.stardownloader.com and install their (free and ad-free) Stardownloader. Faster and better than DAP.

 

[crazylady]

buffer overrun detected

Hi realblackstuff. Thanks for your input except that I did not say I got buffer overrun message when opening IE. I get msg after logging on to my ISP. I get msg after logging on to Yahoo. I get msg after going to Hotmail. I get msg after logging on to google and I get msg after logging on to IE. I get msg between 30 seconds to 5 minutes after loggin on to windows, no matter at what sight I am in.Also, I do not have Netscape browser installed at all. The only time I click on to the IE icon is when I want to get my email at ATT WorldNet, which is my ISP. Maybe I am not understanding you, but I don't know how what you have emailed will help me. Could you define it more, please? thanks.

 

[RealBlackStuff]

crazylady

no offense meant, but if you look at the beginning of my above post, you would see it was meant for novice, not for you.

Your PC IS infected by:
Adware.EBoard is an adware application that downloads and displays advertisements.

Go to this post here first, and follow the instructions EXACTLY.
How to remove Begin2Search/Coolwebsearch and Other Nasties
Then see How to post your Hijackthis log-files.

 

[crazylady]

buffer overrun detected

Hi realblackstuff. No offense taken. I replied back as email was sent to me stating that you had sent me a thread "when opening IE" which I knew wasn't mine and I did see "novice" but decided to write you anyway.
In regard to your instructions, let me say this; back in January I found a forum and wrote to them re this problem. I followed basically the same instructions you gave me. Disabling System Restore, downloading Spybot S&D, Lavasoft Adaware, CWShredder,(Ialready had SpySweeper and Window Washer) and running them all. I then installed SpywareBlaster and SpywareGuard. After all that, I still kept getting buffer overrun msg. I just ignored it until this week when I contacted TechSpot in the hopes of something new. I do a complete maintenance on my pc every week, including windows update and I run thru the spyware etc every couple of weeks. The msg keeps marching on!!! I guess I will just grin and bear it. It doesn't seem to affect anything I look at on the web, it just pops up once a day. Thanks for your time and effort, I remain the "crazylady".

 

[RealBlackStuff]

You need to kill: C:\ProgramFiles\MS_Update\MS_Services.exe
Boot in safe mode. Sys-restore off.
ctrl/alt/del and in Taskmanager try to stop it.
Then uninstall anything to do with it.
Then delete the MS_Update directory.
Reboot normal. If OK, turn Sys-restore back on.
Clean all Temp directories, temp internet files, anti-virus-vaults, recycle-bin etc.
Post a HJT-log if you like, then I might be able to help further.

 

[novice]

Dear realblackstuff

Thank you for taking the time and effort to help me out. You are brilliant! I followed the instructions outlined and the "buffer overrun" problem has disappeared and I can now can open IE. I heed your advice about not using it anymore but out of curiosity sake after fixing the problem visited some web sites. On several occasions, the display eventually changed to either an array of thick, vertical coloured lines or a single-coloured background with flickering edges and I had to reboot. Anyway, I've installed Firefox as you suggested. Can I ask in layman's term the reason you suggested the uninstallation of Netscape? I noticed that the Netscape directory and sub-drectories are still there. Should I also delete them?

Thanks again for your help.

 

[RealBlackStuff]

From your HJT-log it looks like you have a mixture of Netscape 4 and Netscape 6 on your PC. V4 is really obsolete now.
By uninstalling Netscape, no longer using IE and instead using Firefox, you free up a load of unnecessary wasted resources (and harddisk real-estate).

Post your latest HJT log, you may have some other unpleasant 'visitors'.
see How to post your Hijackthis log-files.

 

[novice]

Dear realblackstuff

Thanks for your reply. As requested, attached is my latest HJT log. I noticed that the Netscape entries kept resurfacing despite having deleted them.

Incidentally, each time I reboot my machine, it displays the Microsoft Regustry Checker...Restoring System Files screen:

"you have restored a good registry. Windows found an error in your system files and restored a recent backup of the files to fix the problem. Press Enter to restart your computer". Not sure if it's related to the series of problems I've been experiencing.

Cheers

 

[RealBlackStuff]

novice

Boot in Safe Mode
Now UNinstall, as mentioned before, this rubbish and anything to do with it:
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-AU\MSNAPPAU.EXE

This file COULD be infected.
C:\WINDOWS\RunDLL.exe
In Explorer, rename it to: RunDLL.xxx

Now reboot the PC again in Safe Mode.
Run HJT on its own and 'fix' if still there:
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-AU\MSNAPPAU.EXE
C:\WINDOWS\RunDLL.exe
N1 - Netscape 4: user_pref("browser.startup.homepage", "tjar.com"); (C:\Program Files\Netscape\Users\default\prefs.js)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL (file missing)
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {D6016EE7-A8FF-11D1-B37E-A4759ECD7909} (AxPulse Class) - http://www.pulse3d.com/players/english/PulsePlayerAxWin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://www.proformacorp.com/downloads/files/ishield/iftwclix.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab
O16 - DPF: {5A3C6507-730A-43B2-8EAC-4C430F2EF35E} (PortfolioManager Class) - https://portfoliomanager.westpac.com.au/portfoliomanager/portfoliomanager.cab
O16 - DPF: {FE8400F2-C848-4379-989F-DF2ED39040BE} (Eyeball Instant Messaging Control) - http://www.rsvp.com.au/chat/RSVPChat.cab

Delete, as mentioned before, the MSN APPS directory: C:\PROGRAM FILES\MSN APPS with everything in it.
Delete the Netscape directory: C:\Program Files\Netscape with everything in it.

Boot normal and see how it goes.

 

[Mictlantecuhtli]

From your HJT-log it looks like you have a mixture of Netscape 4 and Netscape 6 on your PC. V4 is really obsolete now.

Delete the Netscape directory: C:\Program Files\Netscape with everything in it.

That will remove Netscape 6 as well, won't it? This kind of application removal methods leave a lot of stuff in the registry, stuff that can cause problems in the future, stuff that HJT doesn't detect, like dlls that don't exist anymore etc.

If someone wants to have more than one browser, let them.

 

[RealBlackStuff]

Mict
Based on previous and current logs, 'novice' has uninstalled Netscape. Anything left in that directory would only be a personalised ini-file or prefs-file or something like that. Hence it would be safe to delete.

 

[novice]

realblackstuff

Thanks for your post.

When you said to Uninstalled MSNAPPAU.EXE, I take it you mean to go to the directory C:\PROGRAM FILES\MSN APPS and remove everything in it, since I couldn't find a specific reference to the MSNAPPAU application in Control Panel\Add Remove Programs? Anyway, I deleted everything is that directory as well as following the other instructions outlined.

Having completed the above, I opened IE and noticed that it goes to www.msn.com, though it wasn't the start page defined in my IE preferences. The display then eventually changed to either an array of thick, vertical coloured lines or a single-coloured background with flickering edges and I had to reboot as mentioned in my previous post. During the reboot, the following message appeared:

"Microsoft Registry Checker...Restoring System Files screen

you have restored a good registry. Windows found an error in your system files and restored a recent backup of the files to fix the problem. Press Enter to restart your computer".

I then ran HJT immediately after the reboot has been completed, and noticed the following entries in the HJT log:

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL (file missing)
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-AU\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O16 - DPF: {D6016EE7-A8FF-11D1-B37E-A4759ECD7909} (AxPulse Class) - http://www.pulse3d.com/players/english/PulsePlayerAxWin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab

I proceeded to delete those entries again, reboot my machine straight away and the 'Microsoft registry checker screen' did NOT appear this time.
Running HJT again, the entries above were also not found.

Based on my simple reasoning then, the above vicious circle of events resurfaces each time I open IE. I wouldn't even hasten to reason WHY.

Using Firefox for my surfing needs did not appear to be non-problematic either. The Firefox browser crashes with a "Firefox caused an invalid page fault in module kernel32.dll..." each time I visited certain sites, including www.theage.com.au or www.smh.com.au so at this stage looked like Firefox may not be my panacea either. :-(

Maybe an upgrade to Windows 2000 be the order of the day?

Cheers

 

[fade2black]

buffer overrun detected

i am an windows xp user and i have the same damn message:

microsoft visual c++ runtime library
c:/windows/explorer.exe

a buffer overrun has been detected which has corrupted the program's internal state. the program cannot safely continue execution and must now be terminated.

this message used to pop up when i opened the internet explorer now the damn thing pops up when i log on to my computer and i have yet to hear of a rectifiable solution. i need to get this error message off of my computer ASAP