I have received a few e-mails asking what the following files and HijackThis entries are:

C:\WINDOWS\comsysobj.exe
C:\WINDOWS\shellexcon.exe
C:\WINDOWS\win32st.exe
C:\WINDOWS\winstrse.exe

O4 - HKLM\..\Run: [SMSERIALWORKSTARTER] “C:\WINDOWS\comsysobj.exe”
O4 - HKLM\..\Run: [SMSERIALWORKERSTART] “C:\WINDOWS\shellexcon.exe”
O4 - HKLM\..\Run: [SMSERIALSTARTER] “C:\WINDOWS\win32st.exe”
O4 - HKLM\..\Run: [SMSERIALWORKERSTARTER] “C:\WINDOWS\winstrse.exe”

These are part of the SpyBurner infection. If you need help removing them, please visit our SpyBurner removal guide below.

Removal instructions for SpyBurner

Marcin Kleczynski