VBShell.tlb, is this a spyware?

Hi,

When I scan my system with SpySweeper, it found a spyware name PortalSearching located in C:\windows\system32\vbshell.tlb

Is this a spyware or simply a false/positive?

Thank you,
Atomas31

 

Hey Atomas31,

Are you by chance using a program called SpywareGuard....and if so do you have it active/running ?

If SpywareGuard is being used....you might want to take a look at the below post by Javacool. While that thread post is over a year old....I'm not able to yet find any recent info of whether this is still a legit type-library file....as far as SpywareGuard is concerned.

This post---> https://www.wilderssecurity.com/showpost.php?p=103375&postcount=9

 

It is a part of both visua basic shell programing and Visual Basic Studio but no it isant a problem. It is a shell of a text library (TLB)

 

Hi Bubba and Reo,

Yes, I am using Spyware Guard so that means that it is a false/positive from SpySweeper!

Thank you guy's,
Atomas31

 

Atomas

Yes it is a false alarm...do yourself a favor and go to that files location...then right click on the files properties....and where it tells you the date that the file was installed on your machine the "Created Date" then take that date and do a search of your PC for all files that were created on that date
?/??/??, and then look for all files that were modified on that date...What you will find I bet is that Spy Guard has the same date associated with it. This is a good method when attempting to form some association with an orphan file.

 

Hi.

Sorry to bring back a buried post, (I found this through google), but my question is relevant & I didn't see a need to post a new one.

I ran the Trendmicro Housecall today & 2 virus' were found & deleted, one of which was this file - Vbshell.tlb ("C:\WINDOWS\system32\Vbshell.tlb","","")

When searching, I also found this post, https://www.wilderssecurity.com/showpost.php?p=103375&postcount=9 . So my question is, do I need to replace this deleted file?

Thank you for any help!


p.s. The other virus found was "SPYW_FPTLBAR.100" but there wasn't any information regarding it at Trendmicro. Does anyone know anything about this one? Thanks again!