Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Buffer Overrun Detected


  • Please log in to reply
11 replies to this topic

#1 justjeena

justjeena

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Miami
  • Local time:09:28 PM

Posted 09 October 2007 - 08:05 PM

This message keeps popping up....
Microsoft Visual C++ Runtime Library
Buffer overrun detected!
Program:C:\WINDOWS\Explorer.EXE
A buffer overrun has been detected which has corrupted the programs internal state. The program cannot safely continue execution and must now be terminated.
When i click ok the screen goes blank for about 5 sec and either closes all windows or i get booted.
I'm using WindowsXP
It pops up continuously every 2 min....... if i just ignore it, nothing happens, only when i click ok or close it. I recently added itunes

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:28 PM

Posted 09 October 2007 - 09:42 PM

What type of anti-virus are you using? Have you performed any anti-spyware scans? Have you tried doing your scans in "SAFE MODE"? Are you doing scans while logged into the Administrator's account or an account with administrator privileges?

Many malware programs can be uninstalled by using Add/Remove Programs so check there. Click on Start > Settings > Control Panel and double-click on Add/Remove Programs. From within Add/Remove Programs uninstall questionable programs by highlighting them and selecting Remove. Questionable programs may have recognizable names like IntCodec, WinTools, NavHelper, etc. For a list of such programs see BC's Uninstall Programs Database.

Please download ATF Cleaner by Atribune & save it to your desktop. DO NOT use yet.

Please download and install SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
  • Under "General and Startup", make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Click Close to exit the program.
Then perform at least one of these online Virus scans:
(The following require Internet Explorer to work. Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Install ActiveX component.)
BitDefender Online Scanner <- Add a check by "Autoclean".
ESET Nod32 Online Scanner (Vista compatible)
F-Secure Online Scanner <- Be sure to follow the directions on the F-Secure page for proper Installation. (also checks for rootkits).
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 justjeena

justjeena
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Miami
  • Local time:09:28 PM

Posted 11 October 2007 - 09:26 AM

Thanks QM,
I followed your instructions and the last online scan detected nothing!!!!! :thumbsup: But now I'm getting a message that says
RunDLL
error loading C:\WINDOWS\system32\mqnkpqxa.dll
What does that mean, and how do I fix it?

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:28 PM

Posted 11 October 2007 - 12:35 PM

From what you describe in regards to the error message, the file(s) is probably an orphaned entry related to malware that was set to run at startup. Windows is trying to load this file but cannot locate it since the file may have been removed during an anti-virus scan, the uninstall of a program or use of a specialized fix tool. However, an associated registry entry remains and is telling Windows to load the file when you boot up.

When Windows loads, it looks for any files associated with registry entries for programs that are set to run at startup. If the file was removed but not the registry entry, Windows will display an error message indicating that the file was not found. You need to remove this registry entry so Windows stops searching for the program when it loads. To resolve this download and run Autoruns, search for the related entry and then delete it.

Edited by quietman7, 11 October 2007 - 12:38 PM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 justjeena

justjeena
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Miami
  • Local time:09:28 PM

Posted 13 October 2007 - 03:19 PM

Quiet Man,

Thank You so much for your rapid replies....... But did I forget to mention that I know NOTHING about computers, programs, etc..... In other words "you lost me"!!! I went to the link you sent me, and I have NO clue where to find the related entry, or what it would be..... I apologize for my lack of knowledge.

Also want to inform you of another error message,
iexplorer.exe-Application Error
The instruction at "0x01514042"
referenced memory at "0x0174560"
the memory could not be read.
click ok to terminate
click cancel to debug

I don't know which one to click, and have no idea what it means.....HELP

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:28 PM

Posted 13 October 2007 - 05:35 PM

Click the below link to directly download AutoRuns.zip.
http://download.sysinternals.com/Files/Autoruns.zip
  • Create a new folder on your hard drive called AutoRuns and extract (unzip) the file there. (click here if your not sure how to do this.)
  • Open the folder and double-click on autoruns.exe to launch it.
  • Please be patient as it scans and populates the entries.
  • When done scanning, it will say Ready at the bottom.
  • Scroll through the list and look for a startup entry related to mqnkpqxa.dll.
  • Right-click on the file and choose delete.
  • Reboot your computer and see if the startup error returns.

Edited by quietman7, 13 October 2007 - 05:43 PM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 justjeena

justjeena
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Miami
  • Local time:09:28 PM

Posted 14 October 2007 - 11:24 PM

:trumpet: :flowers: :inlove: :thumbsup: :huh: IT WORKED!!!!!! THANK YOU QUIET MAN FOR ALL OF YOUR HELP!!!!!!! Is there anythsing else I should do? Like a hijack this log?

Edited by justjeena, 14 October 2007 - 11:25 PM.


#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:28 PM

Posted 15 October 2007 - 07:29 AM

Good job. :thumbsup:

If everything is running fine and there are no more issues, you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recent Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
To protect yourself against malware and reduce the potential for re-infection, read:
"Simple and easy ways to keep your computer safe".
"How did I get infected?, With steps so it does not happen again!".
"The Ten Most Dangerous Things Users Do Online".
"PC World's: The 10 Biggest Security Risks".
"Seven ways to keep your search history private".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 justjeena

justjeena
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Miami
  • Local time:09:28 PM

Posted 17 October 2007 - 12:09 PM

Quiet Man,

THANK YOU!!!!!!THANK YOU!!!!!!THANK YOU!!!!!!THANK YOU!!!!!!

You have been a great help!!!! I didn't have any trust in myself to tackle this problem even with your help because of my lack of knowledge...... but your instructions were so thorough that it was so simple for me. Thank you for your patience!!!! :thumbsup:
Jena

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,126 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:28 PM

Posted 17 October 2007 - 12:52 PM

Your quite welcome. :thumbsup:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 caffeineer

caffeineer

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 31 January 2008 - 10:32 AM

I had the same problem. It started shortly after I picked up some &%*$# adware that kept launching popups warning me of bogus infections and trying to get me to buy software to fix the problems they were causing. Some computer mafia protection scheme, I guess. lol.

Anyway, I had to run everything you recommended (including all three virus scanners) to clean it up, but it seems fine, now. AdAware, Ad-Watch, Windows Defender and a few other AntiSpy & AntiVirus programs didn't catch everything, but this thread fixed me up. Thanks, quietman7!!! :thumbsup:

#12 NightHawk85

NightHawk85

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:28 PM

Posted 20 May 2008 - 11:01 PM

I am running XP Home, 300 Gb HD, 1Gb RAM, AMAD Athlon 1.2 Ghz, cpu, Class 2 Video Card, it's slow as all get out.

Every time I try to use any program to get to the Internet, this Message shows up:
Microsoft Visual C++ Runtime Library
Buffer Overrun Detected
Programs:C:\ProgramFiles\InternetExplore\IEXPLORE.EXE

Internet Explorer has been Corrupted!!!!
I c an't get to the Internet, every time I try, no matter what the program, this pops up and no Internet. HELP!!! What can I do to Uncorrupt the Internet Explorer




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users