egafd.com

A friend has just phoned me.

When trying to use the internet he keeps getting a message Buffer Overrun. Explorer.exe must close. This started yesterday.
Offline apparently everything working but computer running a bit slow.

I am 99% certain he has download a file with a virus/trojan in it.
What could this be?

The computer is running XP SP2 which should be up to date together with AVG Antivirus and Zone Alarm Firewall. He has run both Adaware and Spybot Search and Destroy but they have found nothing.
Since he can't get on line I can't ask him to run Panda active scan.

He uses Firefox as his browser.

I think I will be wasting my time going to look without first knowing things to disable or remove and/or downloading files to clear the problem.

Any ideas of how to fix this will be appreciated.

Sounds like a Vundo infection. Have a google for VundoFix

VundoFix

Have a read of this too

Thanks Jacques, this fits what he has told me and I now have a starting point.

Thanks Jacques, Vundofix found and deleted several files.

Initially he still couldn't get on line but sorted by talking to tech support of his broadband ISP - Talktalk.

Apparently helpful to deal with and although a 0870 number actually not billed if called from a Talktalk registered phone line.

All back to normal now.

When the next update of Spyware Terminator that (hopefully) is not so memory heavy is released I'll install that for him.

I got a quite bad infection of this Vundo stuff on my Desktop and also got repeat infections.

To make sure that your friend doesn't suffer the same fate then can I suggest that if he has Java then he makes sure he has the latest version because Vundo is using older versions of Java to infect some computers.

Also as he's using Firefox then get him to download IE7 as Vundo is also using older versions of IE to spread. He doesn't have to use IE7 but his computer will safer with that than previous versions.

Thanks for sharing that, I will pass it on.