Virus psw.bispy

mcguiver

Help!!

Anyone out there come across this one yet? I'm running windows 98,
AVG7 is installed and has detected this (Plus lots pop us are coming up ).
It's told me to download software, re-start in safe mode, unplug from network etc. + all will be solved... unfortunately it's still there though!

Wiping the drive isn't really an option at the moment...anyone any quick fixes for a pc novice??

Sleipnir

It's not actually a virus. Check autostart entries. Check running processes.


Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>
Explorer>Browser Helper Objects
In the right panel, locate and delete the entry or entries:
{000006B1-19B5-414A-849F-2A3C64AE6939}
Close Registry Editor.


Virus type: Not a Virus

Destructive: No

Aliases: PSW.Bispy.A, TR/BiSpy.DLL.B

Scan engine needed: 6.500

Overall risk rating: Very Low

---

Reported infections: Low

Damage Potential: Low

Distribution Potential: Low

---

Description:



This adware program has an .EXE and a .DLL file component. The .EXE component looks for certain registry entries and deletes them, while the .DLL component maintains a particular registry entry related to browser helper objects.

Solution:



Identifying the Spyware Program

Download the latest spyware pattern file and scan your system. Note all files detected as SPYW_BISPY.A.

Terminating the Spyware Program

This procedure terminates the running spyware process. You will need the name(s) of the file(s) detected earlier.

Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the spyware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected spyware files in the list of running processes.
To check if the spyware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

---

*NOTE: On systems running Windows 95/98/ME, Windows Task Manager may not show certain processes. You may use a third party process viewer such as Process Explorer to terminate the process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the spyware from executing at startup.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>
Explorer>Browser Helper Objects
In the right panel, locate and delete the entry or entries:
{000006B1-19B5-414A-849F-2A3C64AE6939}
Close Registry Editor.

---

NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.
Running Trend Micro Antivirus

mcguiver

Perfect,

It's working fine now...no more f****ing smileys!!