VBShell.tlb, is this a spyware?

Discussion in 'other anti-malware software' started by Atomas31, Jan 11, 2005.

Thread Status:
Not open for further replies.
  1. Atomas31

    Atomas31 Registered Member

    Joined:
    Sep 7, 2004
    Posts:
    923
    Location:
    Montreal, Quebec
    Hi,

    When I scan my system with SpySweeper, it found a spyware name PortalSearching located in C:\windows\system32\vbshell.tlb

    Is this a spyware or simply a false/positive?

    Thank you,
    Atomas31
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey Atomas31,

    Are you by chance using a program called SpywareGuard....and if so do you have it active/running ?

    If SpywareGuard is being used....you might want to take a look at the below post by Javacool. While that thread post is over a year old....I'm not able to yet find any recent info of whether this is still a legit type-library file....as far as SpywareGuard is concerned.

    This post---> https://www.wilderssecurity.com/showpost.php?p=103375&postcount=9
     
  3. Reo

    Reo Registered Member

    Joined:
    Sep 12, 2004
    Posts:
    6
    It is a part of both visua basic shell programing and Visual Basic Studio but no it isant a problem. It is a shell of a text library (TLB)
     
  4. Atomas31

    Atomas31 Registered Member

    Joined:
    Sep 7, 2004
    Posts:
    923
    Location:
    Montreal, Quebec
    Hi Bubba and Reo,

    Yes, I am using Spyware Guard so that means that it is a false/positive from SpySweeper!

    Thank you guy's,
    Atomas31
     
  5. Reo

    Reo Registered Member

    Joined:
    Sep 12, 2004
    Posts:
    6
    Atomas

    Yes it is a false alarm...do yourself a favor and go to that files location...then right click on the files properties....and where it tells you the date that the file was installed on your machine the "Created Date" then take that date and do a search of your PC for all files that were created on that date
    ?/??/??, and then look for all files that were modified on that date...What you will find I bet is that Spy Guard has the same date associated with it. This is a good method when attempting to form some association with an orphan file.
     
  6. Skarrllett

    Skarrllett Registered Member

    Joined:
    Mar 3, 2005
    Posts:
    1
    Hi.

    Sorry to bring back a buried post, (I found this through google), but my question is relevant & I didn't see a need to post a new one.

    I ran the Trendmicro Housecall today & 2 virus' were found & deleted, one of which was this file - Vbshell.tlb ("C:\WINDOWS\system32\Vbshell.tlb","","")

    When searching, I also found this post, https://www.wilderssecurity.com/showpost.php?p=103375&postcount=9 . So my question is, do I need to replace this deleted file?

    Thank you for any help!


    p.s. The other virus found was "SPYW_FPTLBAR.100" but there wasn't any information regarding it at Trendmicro. Does anyone know anything about this one? Thanks again!
     
Loading...
Thread Status:
Not open for further replies.