troubleshooting Question

McAfee reports bo:writable bo:stack - now spreading...

Avatar of MattWilkinson
MattWilkinsonFlag for United Kingdom of Great Britain and Northern Ireland asked on
Anti-Virus Apps
5 Comments3 Solutions13889 ViewsLast Modified:
Three days ago, we had one desktop PC reporting the error:

c:windows\system32\services.exe KERNEL32.LoadLibraryA
bo:writable bo:stack
Blocked by buffer overflow protection

in McAfee on access can message.
Now we have around 20 desktops and 6 servers reporting a same or similar message (sometimes it is svchost.exe that it is detected in) and spreading

Have done a search online and this seems to be a McAfee specific error but I can't find any resolution. It does appear to be a virus of some sort as it is spreading.
On one server that does not have McAfee installed it has started rebooting after a few minutes of uptime (windows reports error 128 in services.exe) this doesn't seem like a coincidence!
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 3 Answers and 5 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 3 Answers and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros