CSA: Bufferoverflow exposed.

fkhan6_wb — Sun, 10 Mar 2019 10:33:49 GMT

I am looking into the bufferoverflow events in CSA and need your assistance in this one.

Here is the event:

The application 'C:\Program Files\Internet Explorer\iexplore.exe' (***) tried to call the function VirtualProtectEx("<self>") from a buffer (the return address was 0x7c108ec9). The code at this address is 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c'

Is this action is very suspicious since the VirtualProtectEx function changes the access protection on a region of committed pages in the virtual address space of a specified process.?

Is it possible to figure out what does the code 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c' means?

Many thanks

Re: CSA: Bufferoverflow exposed.

tsteger1 — Thu, 12 Apr 2007 22:24:52 GMT

I have a machine that got the exact same message (including the code address) and it was the same day they installed a Tomcat Web server and Spyware Doctor.

I believe Spyware Doctor was the culprit in my case.

Tom S

topic CSA: Bufferoverflow exposed. in Network Security

CSA: Bufferoverflow exposed.

Re: CSA: Bufferoverflow exposed.