Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CSA: Bufferoverflow exposed.

I am looking into the bufferoverflow events in CSA and need your assistance in this one.

Here is the event:

The application 'C:\Program Files\Internet Explorer\iexplore.exe' (***) tried to call the function VirtualProtectEx("<self>") from a buffer (the return address was 0x7c108ec9). The code at this address is 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c'

Is this action is very suspicious since the VirtualProtectEx function changes the access protection on a region of committed pages in the virtual address space of a specified process.?

Is it possible to figure out what does the code 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c' means?

Many thanks

1 REPLY
Blue

Re: CSA: Bufferoverflow exposed.

I have a machine that got the exact same message (including the code address) and it was the same day they installed a Tomcat Web server and Spyware Doctor.

I believe Spyware Doctor was the culprit in my case.

Tom S

116
Views
0
Helpful
1
Replies