New Spyware/Trojon found!! - vbstub.exe - Safer-Networking Forums

byteme · 2005-10-30, 11:19

Greatings Fellow Cybernoids.
My PC was recently infected with a little devil called vbstub.exe.
It continually tried to redirect me to a site "bestplace.ru".
It auto started IEXPLORER and vbstub.exe which caused my CPU to lock up at 100%. I only noticed it because I use Firefox as my default browser, and IE has to ask pemission to access the internet, this through up a warning on my Firewall, which made me aware. All the latest updates and scans couldn't pick it up so I tracked the little bugger down and deleted it manually.
Restart your PC in safemode.
Goto C:\Windows and delete these files
system.exe
system.ini
system16.exe
system16.ini
vbstub.exe
vbsub.ini
Reboot your PC then goto regedit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run
Check to see if any of the file names are there, if so delete them.
If any one else has had a similar problem please let me know, or if ther is a better way of removal of this pesky little beast.
My PC seems to be clear ( For the moment!!!)
Good Luck
Byteme

**LonnyRJones** · 2005-10-30, 12:01

Hello

Check policies to
http://www.sophos.com/virusinfo/anal...ojagenten.html

goodgameral · 2005-11-05, 23:58

Can spybot get rid of it now?
Please someone say yes!

europanorama · 2005-11-11, 12:31

escan(free) has found vstub.exe in winnt of win2k:
c:\winnt\vstub.exe

all deleting efforts in safe-mode and command/dos-prompt did not work. this worked: go to windows explorer and delete there. maybe as administrator. killbox did not work. maybe i made something wrong. could not see the program-window properly. after executing one of the option i could see c:\killbox\vstub.exe but original location was untouched. we will see if its a permanent solution.

kevin434445 · 2006-11-04, 11:03

thks to byteme. your ins. got rid of vbstub for me

thks again

kevin434445

2005-10-30, 11:19	#1
byteme Junior Member Join Date: Oct 2005 Posts: 1	New Spyware/Trojon found!! - vbstub.exe Greatings Fellow Cybernoids. My PC was recently infected with a little devil called vbstub.exe. It continually tried to redirect me to a site "bestplace.ru". It auto started IEXPLORER and vbstub.exe which caused my CPU to lock up at 100%. I only noticed it because I use Firefox as my default browser, and IE has to ask pemission to access the internet, this through up a warning on my Firewall, which made me aware. All the latest updates and scans couldn't pick it up so I tracked the little bugger down and deleted it manually. Restart your PC in safemode. Goto C:\Windows and delete these files system.exe system.ini system16.exe system16.ini vbstub.exe vbsub.ini Reboot your PC then goto regedit HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run Check to see if any of the file names are there, if so delete them. If any one else has had a similar problem please let me know, or if ther is a better way of removal of this pesky little beast. My PC seems to be clear ( For the moment!!!) Good Luck Byteme

2005-11-05, 23:58	#3
goodgameral Junior Member Join Date: Nov 2005 Posts: 1	Can spybot get rid of it now? Please someone say yes! Last edited by goodgameral; 2006-01-15 at 05:23.

2006-11-04, 11:03	#5
kevin434445 Junior Member Join Date: Nov 2006 Posts: 1	thks to btteme thks to byteme. your ins. got rid of vbstub for me thks again kevin434445

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

2005-10-30, 12:01	#2
LonnyRJones Visiting Staff Join Date: Oct 2005 Posts: 5,089	Hello Check policies to http://www.sophos.com/virusinfo/anal...ojagenten.html

2005-11-11, 12:31	#4
europanorama Junior Member Join Date: Nov 2005 Posts: 7	escan(free) has found vstub.exe in winnt of win2k: c:\winnt\vstub.exe all deleting efforts in safe-mode and command/dos-prompt did not work. this worked: go to windows explorer and delete there. maybe as administrator. killbox did not work. maybe i made something wrong. could not see the program-window properly. after executing one of the option i could see c:\killbox\vstub.exe but original location was untouched. we will see if its a permanent solution.