Three days ago, we had one desktop PC reporting the error:
c:windows\system32\service
bo:writable bo:stack
Blocked by buffer overflow protection
in McAfee on access can message.
Now we have around 20 desktops and 6 servers reporting a same or similar message (sometimes it is svchost.exe that it is detected in) and spreading
Have done a search online and this seems to be a McAfee specific error but I can't find any resolution. It does appear to be a virus of some sort as it is spreading.
On one server that does not have McAfee installed it has started rebooting after a few minutes of uptime (windows reports error 128 in services.exe) this doesn't seem like a coincidence!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I have tried running various scans - with various anti virus solutions and the only one that throws this up is McAfee - it cannot cleant the PC though even in safe mode.
Strangely enough these messages seem to have stopped as quickly as they started and we are nt getting any more messages so trying to diagnose what the problem was is very difficult now. Any further advise would be helpful though.
Hi Matt,
That patch basically fixes an exploit in the Plug and Play service that could be exploited by using a Buffer Overflow attack, hence McAfee stops the attack and reports it.
Now the patch has been deployed, the Plug and Play service no longer has a vulnerability
You should keep all your machines patched and up to date using something like Windows Server Update Services
You won't get the messages anymore as you have plugged the hole.
Cheers
Si
Business Accounts
Answer for Membership
by: MattWilkinsonPosted on 2009-01-12 at 06:23:05ID: 23353367
I seem to have solved the server rebooting issue by installing MS update KB899588 but the McAfee messages still appear if anyone has an idea what this might be.