Buffer Overrun Detected

ZZRKarlos

Hi, can anyone help me sort this out, I now get this pop up message on my pc Microsoft Visual C++ Runtime Library Buffer overrun detected!, then it goes on to say...Program C:\WINDOWS\Explorer.EXE A buffer overrun has been detected which has corrupted the program internal state. The program cannot safely continue execution and must now be terminated.

If I click OK all the desktop icons disappear for a few seconds then reappear. Thinking its some sort of virus I updated both my spybot and adaware and did full scans , but the problem still occurs. It happens when i'm on the net and using Firefox 1.5.0.11.

Any ideas anyone?

thomas01155

Could be a hacker could be a virus make sure you have all the lastest microdoft updates. Then follow this http://forums.moneysavingexpert.com/showthread.html?t=133269

make sure you have a firewall and anti vurs

firewall
http://www.filehippo.com/download_zonealarm_free/

antivirus
http://www.filehippo.com/download_avg_antivirus/

If that does not fix your problem post a hijack this log
http://www.spywareinfo.com/~merijn/programs.php

Chippy_Minton

Start - Run - sfc /scannow - OK.

Close Firefox and run it in Safe Mode and see if it happens then - there should be a Firefox (Safe Mode) option in All Programs. If the problem persists, start in normal mode and remove FF add-ons.

Follow the spyware/malware removal guide.

Jzpop

Are you using ARES P2P? See -
http://www.softwaretipsandtricks.com/forum/windows-xp/18727-microsoft-visual-c-runtime-library-big-annoying-error.html

Lorian

Google for hijackthis and download it, run it, and post the logfile.

ZZRKarlos

Thanks for the help...here is my log file.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:15:33, on 09/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Zoom\PCI ADSL\CnxDslTb.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ZoneLabs\minilog.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - !!53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - !!761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {A9126E0B-A5AC-4666-ACB1-F56CE23ECD86} - C:\WINDOWS\system32\vtsqo.dll
O2 - BHO: (no name) - {E44527F6-1296-4A84-B67D-A6CEA6ED4B69} - C:\WINDOWS\system32\opnnnlj.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Zoom\PCI ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - !!92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDADCE8F-FBB5-4B5C-BD93-1F521AD8F796}: NameServer = 194.106.56.6 194.106.33.42
O20 - Winlogon Notify: opnnnlj - C:\WINDOWS\SYSTEM32\opnnnlj.dll
O20 - Winlogon Notify: urqnopn - C:\WINDOWS\SYSTEM32\urqnopn.dll
O20 - Winlogon Notify: urqqrqo - C:\WINDOWS\SYSTEM32\urqqrqo.dll
O20 - Winlogon Notify: vtsqo - C:\WINDOWS\system32\vtsqo.dll
O20 - Winlogon Notify: yaywust - C:\WINDOWS\SYSTEM32\yaywust.dll
O22 - SharedTaskScheduler: Browseui preloader - !!438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - !!8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\minilog.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4268 bytes


Ref Jzpop...no I am not using that program.

Chippy_Minton

O2 - BHO: (no name) - {E44527F6-1296-4A84-B67D-A6CEA6ED4B69} - C:\WINDOWS\system32\opnnnlj.dll and others

You have a Vundo trojan. See the fix instructions at http://www.geekstogo.com/forum/Vundo-Infection-C-WINDOWSsystem32vtsqo-dll-RESOLVE-t83147.html
or wait for one of the malware experts to give you more specific advice.

ZZRKarlos

Thanks for the quick reply Chippy Minton.

I'll study that link you gave me and try to sort this out now...Cheers