CSA: Bufferoverflow exposed.

[fkhan6_wb]

I am looking into the bufferoverflow events in CSA and need your assistance in this one.

Here is the event:

The application 'C:\Program Files\Internet Explorer\iexplore.exe' (***) tried to call the function VirtualProtectEx("<self>") from a buffer (the return address was 0x7c108ec9). The code at this address is 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c'

Is this action is very suspicious since the VirtualProtectEx function changes the access protection on a region of committed pages in the virtual address space of a specified process.?

Is it possible to figure out what does the code 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c' means?

Many thanks

[tsteger1]

I have a machine that got the exact same message (including the code address) and it was the same day they installed a Tomcat Web server and Spyware Doctor.

I believe Spyware Doctor was the culprit in my case.

Tom S