need help on vbstub.exe and iexplorer.exe startin at startup

[ashnik]

hey guys, few days ago I found vbstub.exe and iexplorer.exe running at startup automatically with 100% CPU usage. also if i try to open any window e.g. my computer, it opens, but it continuosly keeps on flashing making the PC unusable. this happened i 1 of my 3 users (i.e. me ,dad, bro) then spread to all as i went on restarting pc and logging in different users.
Then i booted in safe mode and deleted following files
vbstub.exe
system.exe
system16.exe
all were in windows folder

but today again all those files came to same dir and started causing trouble i did the same ad solved the prob.

I also tried google, symantec and pchell.com but no particular soln.

Plz help me to get rid of this permanentally.

 

[sakumar79]

Try submitting the suspected files to *www.virustotal.com/flash/index_en.html for scanning. The above site uses multiple av scan engines to verify if there is a virus or not...

You can also download Microworld AV Scan (free scanner, wont remove though) and check your system.

From Google searches, it appears that you are dealing with a spyware/Keylogger...

BTW, pl post your AV software, Firewall, Antispyware software, OS, etc...

Arun

 

[swatkat]

Those files are trojans. Its better you try Ewido. Download Ewido and install it. Then run, you will receive a warning message saying "Database not found", click "OK" for this. Next in the main screen, click "Update" and click "Start Update".
After the update process, click on the "Scanner" button in the left menu, then click on the "Complete System Scan" button.
If ewido finds anything, it will pop up a notification. You can select "Clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.

 

[ashnik]

i have zone alarm 5 + adaware se + spybot 1.4 on win xp pro
H/W
AMD 1800+,MSI KT4 mobo, 512 MB DDR 333 RAM, 5200/128 agp 8x, 160 GB Seagate Barracuda, 40GB Samsung SP HDD, Sony 52x62x52, Sony 16x DVD ROM etc.

 

[ashnik]

Ewido worked thanks. Sorry for delay for the reply.