Explorer being assaulted by trojan

[mycompisbroke]

This keeps poping up and considering some of the *censored* i've had on my computer lately I'm pretty sure its a trojan or virus.

"Buffer overrun detected!
Program : C:\WINDOWS\Explorer.exe

A buffer overrun has been detected which has corrupted this files internal state . The program cannot safely continue exectution and must now be terminated"


[title edited due to complaints]

[mycompisbroke]

heres a screenshot if it helps .
http://s101.photobucket.com/albums/m80/imageking_01/?action=view&current=untitled-2.jpg

When I x it out my comp crashes.

[LtRyan5184]

Try Ad-Aware (Google It) By Lavasoft, it works for me. but if its totaled take it to a shop to get the important stuff off or if there is no important suff on it just use a low- level HD format to wipe everything

[mycompisbroke]

I've tried ad aware.  I'm not gona take it to a shop and I'm not clearing all my data. Is there anyway I can fix explorer?

[Deerpark]

There is no need to take it to a shop or do a format just yet. Wait for CBMatt or one of the other resident virus experts to come and help you out. I can get you started though.

We need to know what version of windows this is and what version of IE you're using. Do you have any anti-virus or anti-spyware programs installed?

Also get HiJackThis, run a scan and then post the log here.

[Fed]

Update your Windows.
http://www.update.microsoft.com

[dl65]

mycompisbroke ....... What operating system are you using? ............ and
is it up to date as Fed asked in the last reply?

If you have spybot installed, I would like you to run it and let us know what it finds. If you dont have it d/l it from ....... http://www.tucows.com/software_detail.html?id=310138    ..... once installed, be sure and get the latest updates and then run a full scan.

You mentioned you suspect you have trojans....... what evidence do you have to support that ?

xxx At this time do not consider using system restore if it is available with your operating system xxx

Which Anti - Virus program are you using and is it up to date?

Have you attempted to run your anti-virus from the safe mode ?

Please get back to us with some answers.

dl65 

[CBMatt]

I actually had a very similar problem on my own computer recently.  It could be a worm (there are about three or four I know of that cause this problem), but before we assume it's an infection, update your Windows like Fed suggests.

Also, you should download and install KB935448, as it's often related to this problem.

You may also need to update your codecs.  It may not apply to you, but it worked for me and another member claims it worked for him as well.  The codec pack we both downloaded was AVI Codec Pack Plus 2.2, so you might as well give it a shot.


Once you have tried these things, post back with an update on how things are running.

[mycompisbroke]

Because I've had a lot of viruses and trojans and spyware from a program that I instaled on a warez site and its the one that wont go away. I use mcafee but Its a pretty old version. I have  windows xp.


How do I get in safe mode? I've run it but nothing came up and as I sayed it pretty old so I'm not surprised. I'll d/l hijackthis tomorrow.
Also while I was typing this cb matt posted  . I guess I've got a lot of downloading to do tomorrow.

[dl65]

mycompisbroke .....

I use mcafee but Its a pretty old version

does this mean that the subscription has run out ?
If it has please download the following......
1. ccleaner.... from http://filehippo.com/download_ccleaner/   
Install it without the Yahoo toolbar....but don't run it at this time.

2. AVG free antivirus...... from http://free.grisoft.com/doc/2/ 
install it, update it ..... but don't run it at this time.

3. AVG Antispyware .... from http://free.grisoft.com/doc/20/lng/us/tpl/v5
install it, get the latest update..... but don't run it at this time.

Next , shutdown your existing outdated McAfee AV .......... ( remove it if you wish as you wont need it anymore.)

Then ..... open ccleaner and run the cleaner portion ( the brush icon) click on run cleaner and when it has reached 100% ........ click run cleaner again and all that was found will be removed.
Run cleaner again to be sure it got everything.

Now then reboot into SAFE mode ( as soon as the pc shuts down and just begins to boot up again ....repeatedly tap the F8 key untill you are offered differant start options....... choose Safe Mode.......   Let it load. ( it will look differant than the normal mode.........
Next find the shortcut to AVG free antivirus and do a full scan.
Once it's finished ....and it will take a while ...... either quarantine or delete anything it finds.
Next ...... close that up and open AVG Antispyware .... and do a full scan with it as well. Remove anything it finds.

Now reboot back into normal mode and report back how things are.
If things are still not right, open up hijackthis ( which I'm assuming you have D/L per CBMatt ) and do a scan and post the results here . Use several posts if necessary to get it all in .

dl65 

[CBMatt]

The fact that you have McAfee makes it seem even more likelier that your problem is related to my own.  This seems to be becoming somewhat common with McAfee users.  However, if my post doesn't help, then please follow dl65's instructions.  Heck, even if my post does help, you still might want to follow his instructions, just to be on the safe side.

[mycompisbroke]

Looks like my family has decided to go on a  spur of the moment vacation so I'll have to wait another day. Looks like this is starting to become a pretty common problem. *censored* you mcafee.

[copycat]

Hi,

Try downloading Prevx! @ http://free.prevx.com

It works everytime

Good Luck,

Copycat

[Deerpark]

copycat the site you linked to is just a domain parking site without any real content. I think the site you meant to link to is this one http://free.prevx.com/. Notice the dot between free and prevx.

[CBMatt]

Well, mycompisbroke, when you get a chance to try everything out, let us know how it goes.

copycat the site you linked to is just a domain parking site without any real content. I think the site you meant to link to is this one http://free.prevx.com/. Notice the dot between free and prevx.

The link has now been fixed.