none
A driver has overrun a stack based buffer 0x000000F7

    Question

  • I was on my laptop earlier today and I suddenly hit a blue screen that amounted to something along the lines of
    A driver has overrun a stack-based buffer, and near the bottom the coding was

    *** STOP 0x000000F7 (0x03BF1B53, 0x00004C92, 0xFFFFB36D, 0x00000000)

    If that matters. Anyway, so I started the computer again, it came up to my background and a small box (which I've never seen before) said 'Loading Custom settings for Internet Explorer 6 (I haven't had IE installed on that computer for months), and after about 1-2 minutes of being able to do nothing that same blue screen error pops up, prompts me to restart the computer and says it's dumping physical memory. This has happened about five times now, including when I've tried to run it in Safe Mode. Anyway, hope that someone has a solution for me, thanks!
    • Moved by Max Wang_Chinasoft Tuesday, April 26, 2011 1:28 AM forum consolidation (From:Windows Error Reporting for ISVs)
    Monday, March 24, 2008 4:20 PM

Answers

  •  

    I received this “BSOD” on the system as referenced in this thread at least three times during the half hour I spent at client’s location. I also remember a mention about this could allow the execution of malicious software or some reference to this type of warning.

     

     

    Came across same situation on a client's laptop that recently had OS re-installed with all updates applied and virus protection installed and updated before delivery 1.5-2 weeks ago but 4-5 days ago client stated today new icons appeared which some I recognized as spyware/virus but new application call "Virus Heat" ver 4.0 something and a dead shortcut to "Virus Ranger". Went through normal steps for removal of most malicious software on the laptop and at one point received NT shutdown notice during uninstall and ran command line entry "shutdown /a" and the shutdown window disappeared but system still restarted. So back to desktop and looked through the "Program Files" directory and started cleaning up remaining folders I came across relating to software I uninstalled I found one labeled "Helper", attempted to access the folder and was told "access denied" after different approaches to access folder I found nothing to be successful until I removed drive and attached to different system via USB adapter. At this point I started a virus scan on the drive as a whole then went to the folder "Helper" again and my current virus protection automatically prompted about removal of "trj.Downloader.TCF". The file it removed and the only one in the folder and was labeled "1206123248.dll" (random name most likely).

    After the full scan completed it removed “Rootkit/Agent.IJW” file reference with virus infection was

    “tdidrv.sys” in the system32 folder. After going through this process rebooted laptop and found “e404mgr Class as a browser plug-in for IE7 referencing the .dll file above, there was other plug-ins’ referring to software relating to the “Online Security Test” adware/spyware that is currently on the net today. Installed drive back in system, boot operation was normal and used system online for about an hour randomly surfing with no issues or pop-ups. Hope this helps.

     

     

    Thursday, March 27, 2008 8:09 AM

All replies

  • I just had the same issue occur Sunday March 23rd. I cannot get past the ***STOP message.

     

    Wednesday, March 26, 2008 1:25 AM
  •  

    I received this “BSOD” on the system as referenced in this thread at least three times during the half hour I spent at client’s location. I also remember a mention about this could allow the execution of malicious software or some reference to this type of warning.

     

     

    Came across same situation on a client's laptop that recently had OS re-installed with all updates applied and virus protection installed and updated before delivery 1.5-2 weeks ago but 4-5 days ago client stated today new icons appeared which some I recognized as spyware/virus but new application call "Virus Heat" ver 4.0 something and a dead shortcut to "Virus Ranger". Went through normal steps for removal of most malicious software on the laptop and at one point received NT shutdown notice during uninstall and ran command line entry "shutdown /a" and the shutdown window disappeared but system still restarted. So back to desktop and looked through the "Program Files" directory and started cleaning up remaining folders I came across relating to software I uninstalled I found one labeled "Helper", attempted to access the folder and was told "access denied" after different approaches to access folder I found nothing to be successful until I removed drive and attached to different system via USB adapter. At this point I started a virus scan on the drive as a whole then went to the folder "Helper" again and my current virus protection automatically prompted about removal of "trj.Downloader.TCF". The file it removed and the only one in the folder and was labeled "1206123248.dll" (random name most likely).

    After the full scan completed it removed “Rootkit/Agent.IJW” file reference with virus infection was

    “tdidrv.sys” in the system32 folder. After going through this process rebooted laptop and found “e404mgr Class as a browser plug-in for IE7 referencing the .dll file above, there was other plug-ins’ referring to software relating to the “Online Security Test” adware/spyware that is currently on the net today. Installed drive back in system, boot operation was normal and used system online for about an hour randomly surfing with no issues or pop-ups. Hope this helps.

     

     

    Thursday, March 27, 2008 8:09 AM
  •  

    What do you do if the virus is on a laptop?

     

    Cause your solution suggests removing the hardrive, which i can't do.

     

    Also i can't run any virus scanners as the blue message pops up, restarting the computer, partway through each virus scan.

     

    Any help would be much appreciated

    Thursday, March 27, 2008 8:01 PM
  • Only other option i can think of is recovery console. and command line removal of files.
    Thursday, March 27, 2008 8:13 PM
  • hi. i just got the same problem with my computer, and after a week of trying i am still struggling to fix it. i did however figure out (on my own lol) that the file mentioned above (helper) is most likely my problem, as this is the only change on my pc from that date that my pc will not allow me to delete, it says cannot delte because it isnt empty, or something like that. any ideass on how to fix this problem? i dont understand the fix mentioned Sad maybe i would understood it put simpler lol

    Monday, April 07, 2008 3:39 PM
  • Just as a reminder, this forum is meant to host discussions around the Windows Reporting (WER) APIs and the Watson/Winqual portals at Microsoft. Other forums may provide more and better help on how on virus removal techniques, or on how to diagnose driver issues.

    Good luck!

    Claus

    Tuesday, April 08, 2008 2:03 PM
  • I found this problem stops when I dont run messanger the newest version.
    Sunday, June 15, 2008 10:16 PM
  • i got the same error message...but...i know it is not a virus...i did a clean install of xp on a clients pc after getting this...and then after the clean install i got it again...i get this BSOD when i try to access the "A" drive...(remember them?) yes...a floppy disc drive...so i tried it on my pc and wham! i get the bsod when trying to access this floppy..or any floppy for that matter?? HELP!!!
    ps...updated bios and installed xp-sp3 as well....
    Friday, October 23, 2009 3:51 AM
  • i got the same error message...but...i know it is not a virus...i did a clean install of xp on a clients pc after getting this...and then after the clean install i got it again...i get this BSOD when i try to access the "A" drive...(remember them?) yes...a floppy disc drive...so i tried it on my pc and wham! i get the bsod when trying to access this floppy..or any floppy for that matter?? HELP!!!
    ps...updated bios and installed xp-sp3 as well....

    Hardly people here can answer your question as you post it in the wrong forum. You'd better get it to the right forum.
    Tuesday, August 03, 2010 1:33 AM