1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Buffer overrun winlogon

Discussion in 'Virus & Other Malware Removal' started by js73, Apr 19, 2009.

Thread Status:
Not open for further replies.
Advertisement
  1. js73

    js73 Thread Starter

    Joined:
    Jun 10, 2002
    Messages:
    930
    This is my wife's computer: XP (home) SP3, 512 MB RAM, zonealarm, avg 8.0, connected through wireless modem.

    This problem is since yesterday evening. I tried to update AVG 8.0 to 8.5, which it did, I think. However, I got the error "buffer overrun detected in c:\??\windows\system32\winlogon.exe" and that the computer can not continue. When I click on okay, I get a BSOD.

    I tried the last good configuration and safe mode, but that has not helped. I can get to the computer using Knoppix, but do not know what to do next. The computer does NOT have a floppy drive.

    I have searched the net, but have not found many links talking about the winlogon buffer. One link gave me some indication that saswinlo,dll in superantispyware may be corrupt, but I could not rename this file under knoppix.

    Many thanks for your help.
     
  2. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    110,109
    It's likely caused by malware.


    Click here to download HJTsetup.exe.
    • Save HJTsetup.exe to your desktop.
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    • Click Save to save the log file and then the log will open in notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and Paste the log in your next reply.
    • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
     
  3. js73

    js73 Thread Starter

    Joined:
    Jun 10, 2002
    Messages:
    930
    Thank you for your response. However, I can not get the computer to work. It gets to "windows is starting" and then I get the buffer overrun message. After ok, I get the BSOD.

    So I am unable to put a HJT log. Actually, if I could get the computer to work, I could just uninstall superantispyware, and hope that the buffer overrun message would be eliminated.

    Thanks for suggestions as to how to get a HJT log.
     
  4. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    110,109
    Can you boot to safe mode with command prompt?
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/820022

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice