There are several ways to rid your computer of PSW Agent H. Some involve manually removing files and others require downloading programs and running them. Here are the suggestions from Wiki s' contributors:

Manual Removal

This worked for me: Go into safe mode (probably F8 when you reboot) Search drive C for SYSUPD.EXE and delete it. Apparently this program won't start in safe mode. Then remove from Recycle Bin. Restart in normal mode and run a full scan with AVG. It can now heal the infected file and you no longer have a virus on your machine! Simple eh!

Use Malwarebytes

You can get rid of the Trojan horse , by following these steps .

1 Download and install the Malwarebytes on your computer .

2 Update your Malwarebytes .

3 Scan your computer for all the malwares in your computer .

4 Remove all the malwares , found while scanning with the malwarebytes .

5 Restart your computer.

Use Malwarebytes and More

You need to run these 3 essential programs to remove all the spyware on your computer.

If you do not have an internet security suit and only an anti virus

1. Run Malwarebytes Anti-Malware.

2. Run a complete scan with free curing utility Dr.Web CureIt!

3. Run the anti spyware removal programs Spybot or Superantispyware.

Browsers

Use Mozilla Firefox or the Google Chrome browser for browsing unsafe websites.

Install ThreatFire

ThreatFire features innovative real-time behavioral protection technology that provides powerful standalone protection or the perfect complement to traditional signature-based antivirus programs, and offers unsurpassed protection against both known and unknown zero-day viruses, worms, trojans, rootkits, buffer overflows, spyware, adware and other malware.

Run an online virus scan like:

Trend Micro HouseCall

Kaspersky free online virus scanner

Windows Live OneCare safety scanner

BitDefender Online Scanner

ESET Online Antivirus Scanner

F-Secure Online Virus Scanner

Avast! Online Scanner

Update your software by running Secunia Online Software Inspector.

Install a good antivirus in your computer.

Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.

Keep your permanent antivirus protection enabled at all times.

Heal It With AVG

AVG antivirus (free) heals it !

Steps for Manual Removal

I had the same Trojan on my computer. Booting the OS in safe mode and disabling system restore did not work for me. I also tried almost every Anti-Virus, Adware, and Trojan software available, but nothing removed it. The way to remove PSW.Agent.H is simple, but the only catch is there is a process running called SYSUPD.EXE running which protects the Trojan source file, _UPDATE.DAT, in Documents and Settings from being removed. So, here is what you do:

Read all the steps below before you start.

1. Run a search on the computer for a file called SYSUPD.EXE.

2. Open My Computer, and browse to the folder that contains the file.

3. Press Ctrl+Alt+Del, and click on Task Manager.

4. Look on the bottom of the Task Manager window to see how many process are running (example: Process:15).

5. Find SYSUPD.EXE and stop it. Most likely it will keep starting it self over.

4. Keep looking for it and stopping it, until the number of processes go down by one.

Once you reach this point, you only have a few seconds until it restarts, so be quick.

5. Switch to the window where SYSUPD.EXE is located and quickly remove it. Once it has been removed, you can remove the main file _UPDATE.DAT. which will be found somewhere in Documents and Settings. If you cannot find it, run a search for it.

7. Run AVG again to make sure the Trojan is gone.

If you can't find _UPDATE.DAT with a search, don't be concerned. Just run your AVG and it can heal it once the SYSUPD.EXE file is gone.

If I can do this anyone can. I am a mom, not a computer tech. It took many attempts, but this worked for me. Make sure you have AVG installed first. Its the only antivirus that finds it and the only one that can eventually heal it.

More About the Above Procedure:

I did almost the same thing above. I had to move the SYSUPD.EXE file to the desktop after stopping the process in the task manager. Then, it was easy to delete.

Use AVG 8.0

You can get rid of these virus by following these steps .

1. Download and install the AVG 8.0 on your computer.

2. Update yourAVG 8.0.

3. Scan your computer for all the malwares in your computer.

4. Remove all the malwares , found while scanning with AVG antivirus.

5. Restart your computer.

Another Manual Removal Method

All Trojan horses are hidden files, so you would need to go to the Files Option. In Windows XP, go to the Control Panel and click on Tools, then Folder Options, then View. Uncheck both the *Hide file extension for known file types" and *Hide protected operating system files" Recommended boxes, then OK yourself out.

You will then need to restart your computer and and go into Safe Mode by holding the F8 key down at the beginning of start up. When you're at the DeskTop screen, go to Start/ Search/ For Files and Folders and type up the NAME OF THE FILE & EXT which would have shown up on your Anti-Virus software. In the case of PSW Agent H the file is SYSUPD.EXE.

Restart your computer and run a full scan with AVG. AVG can now heal the infected file.

I had four Trojan horses on my C drive and used this method for each. I also deleted the Temp file from the Restore folder after unchecking the hidden files boxes before going to SafeMode to delete the file. My computer is now absolutely free of the trojans.

wtoolsa.exe is a process belonging to an advertising program by WebSearch( WinTools (Huntbar variant)). This process monitors your browsing habits and distributes the data

http://www.pchell.com/support/wintools.shtml

Visit http://iyogi.ca

wsup.exe is a hijacker which means it will intermittently change your Internet Explorer settings / Desktop to the link of it's author's sponsors

wsup.exe known as Ibis Toolbar

www.liutilities.com/products/wintaskspro/processlibrary/wsup/

Download and run firefox to protect your computer from future spyware attacks and pop ups which are coming in through internet explorer (Trojan downloaders, win32 ).Browser attacks aren't easy to spot because they piggyback on legitimate traffic that doesn't exhibit many obvious warning signs

Run Deckard's System Scanner (DSS)

Run Malwarebytes Anti-Malware

Run the anti spyware removal programs spybot

Run Superantispyware

Run a complete scan with free curing utility Dr.Web CureIt!

Download and run firefox to protect your computer from future spyware attacks and pop ups which are coming in through internet explorer (Trojan downloaders, win32 ).Browser attacks aren't easy to spot because they piggyback on legitimate traffic that doesn't exhibit many obvious warning signs

1. Run Deckard's System Scanner (DSS)

2. Run the vundo and combo fix

3. Run Malwarebytes Anti-Malware

4. Run the anti spyware removal programs spybot

5 Run Superantispyware

6. Run a complete scan with free curing utility Dr.Web CureIt!

Try to do free online scan from: pandasoftware Good luck.

Try the following programs-they will stop all unwanted stuff from getting on your PC-I went to www.webattack.com and found a way to remove it by doing the following-clicked on green link at the top of the page stating "FREEWARE",then clicked on virus tools/or you can search on that site for this program-"Avast home edition".It is the best freeware program,that i have ever used and removed the virus in no time.The Funweb A is a Trojan horse virus,and when Avast picked it up was goung under another name-i think that's why everybody have difficulty in removing it,and cant find anything under funwe A ,coz it is going under another name.Avast has also detected and removed 2 other virus infected files on my PC!It is important to do a live update of avast virus deff and to set program to run a full system scan.Do download the full free home adition and not just the computer cleaner.Its AMAZING and kicks budd! : )Thank you so much Avast!!!!Two programs going really well with Avast and also freeware on the same site is Ad-Aware spy detector and Zone Alarm firewall.I have all three and they work together like magic!: )GREAT STUFF!!!!Try it,you wont look back!

• Because it's in your system32 folder you need to click start menu, right click on my computer, click properties, then click system restore and turn system restore off on all drives. Then go to this website (its Mcafee sub site) http://vil.nai.com/vil/stinger/ Download stinger, a Trojan detector, and Eliminator. Run that and it should catch the Trojan and delete or fix the file. After you run it, restart your computer and the go back to system restore and turn it back on. Run Stinger again to see if it has gone.

• Download Hijackthis and look for anything referencing stivc.com and delete. It worked for me after the virus kicked my butt for two weeks.

yeah saw same problem at windows 98Se and same program called Search Assistant and its not able to remove ... just installed add-remove platinium and its has been addressed an dll file called "eaop.dll" that's is doing replacein file in windows temp folder called "se.dll" avg anti software finding that file anyway ...

just deleted "eaop.dll" with startup disk then restarted in safe mode after that deleted serach assistant with add remove platinium and deleted all files under windows temp folder ...

restarted computer and problem solved :)

goodluck that file name always changing ...

When I had ththsi exact problem I saw a program in add/remove programs called search help utility or something like that and when I removed it the problem was gone

a b 's answer exactly fixes the problem. From Add/Remove Programs, I found a program called "Search Assistant Uninstall". I remove it and now it is ok.

Go to www.download.com and run a search of downloads for CWShredder. It's a small program (700K) and it will hammer this Trojan right out of existence.

Yes, I got rid of this Startpage.16.BD trogen.This is how it is done.

1. Booted through a flopy.2. Noted the size of file c:\windows\temp\SE.DLL3. Deleted the above file.4. Searched for a DLL file equal in size as SE.DLL and with a file date which is latter than the date of the last program installed.5. I found the name to be GHFI.DLL6. Deleted this file

7. The registry was modified by deletiing the following lines.

"sp"="rundll32 C:\\WINDOWS\\TEMP\\SE.DLL,DllInstall"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall]"DisplayName"="Search Assistant Uninstall""UninstallString"="regsvr32 /s /u C:\\WINDOWS\\SYSTEM\\GHFI.DLL"

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{25D6D360-8C6D-11D9-AABA-0050C80317DF}\InProcServer32]@="C:\\WINDOWS\\SYSTEM\\GHFI.DLL""ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{25D6D361-8C6D-11D9-AABA-0050A74FB244}]

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{25D6D361-8C6D-11D9-AABA-0050A74FB244}\InProcServer32]@="C:\\WINDOWS\\SYSTEM\\GHFI.DLL""ThreadingModel"="Apartment"

Now everything is fine

Kevin G's answer works but the Trojan will not always have the same file name as GHFI.DLL

This is a slightly modfied fix...

1. Restart in Safe Mode

2. Your antivirus S/W may have deleted or removed the SE.dll file. Search for it anyway and delete if found. It will likely be 39kbytes.

3. Search your drive for *.dll in the last 10 days. Sort your search by size and look for the obvious.You will find the XXXX.dll (e.g. cheo.dll) files.

4. You will likely find some backup files too.

5. Use your common sense in deleting these. If you are not sure...rename them to .bak from .dll

6. Search for the XXXX.dll string in the Registry Editor. remove the lines that refer to it. Remove the "Apartment" files too.

7. Press F3 to make sure you have all the xxx.dll entries in the registry.

8. Reboot into normal Windows.

The best way to find this dll file:1 delete se.dll from TEMP directory2 close all applications3 change the date for e.g. 1 may 19804 start internet explorer, then se.dll will be created again5 go to start/find files and find all files with last connect/use in 1 may 1980 (not create or modify)I am not sure how it is in ENGLISH. One from this files will be this dll file of 39 kb (in my computer it is BFBJ.dll)6 do the rest like in the lines 1-8 and change the date, good look!

Download CW-Shredder at the link below: (don't run it yet)

http://cwshredder.net/bin/CWShredder.exe

Download 'SpSeHjfix' at the link below. (don't run it yet)

http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

1.Temporary Files

2.Temporary Internet Files

3.Recycle Bin

Reboot into safe mode.

Disconnect from the net and Close ALL OPEN PROGRAMS.Run 'SpSeHjfix'. and click on "Start Disinfection".When it's finished it will reboot your machine to finish the cleaning process.The tool creates a log of the fix which will appear in the folder.

Now run the Shredder - Hit The FIX button!

Reboot and run 'SpSeHjfix' again until you get the message 'note infected' You may have to run it several times to completely remove the infection.If it fails to completetly remove it, you'll have to manually delete the Stealth-String in pure dos (not ms-dos)

Thanks, MrCharle

1)Find the other *.dll file using one of the methods above (mine turned up in c:\windows\system32 and was 39kb [sorry I've forgotten the name - it was four random letters .dll])

2)CUT (not copy)it allows you to rename or cut but not delete (you may need to rename it before cutting)

3)Reboot your computer

4)Once your desktop has loaded (don't wait for background activites to start eg. Antivirus) immediately select the *.dll file and press SHIFT+DEL (this will by-pass the recycle bin)

This solved the problem for me but I haven't check the registry - that may need editing to.

Spoony Man

Looking for a website?<->>SPIFT<<-> STUDIOS for all your web design needs (HTML, flash and more)

The 8-step answer above is an effective way of locating and dealing with the offending .dll file if you have this problem. Although the filename may change from time to time, the .dll should remain fairly constant in size at 39Kb - so if the worst comes to the worst, just run a search on your computer for *.dll, arrange the results by size and isolate any suspicious files of that size.

The problem I had was dealing with the file once I found it - I couldn't rename, delete, cut or edit it in any way in Windows. The solution that eventually worked for me was to boot into DOS, then use the command prompt to delete the problem files - at the C:\ prompt type

del c:\windows\system\****.dll del c:\windows\temp\se.dll

obviously changing the folder and filenames as necessary. To check that they've gone you can use the command

dir c:\windows\system/P

and scroll through the list.

Ideally all this shouldn't be necessary, but if you simply can't erase the virus normally it's fine as a last resort.

I hope this is of some use.

Andrew

Download and run firefox to protect your computer from future spyware attacks and pop ups which are coming in through internet explorer (Trojan downloaders, win32 ).Browser attacks aren't easy to spot because they piggyback on legitimate traffic that doesn't exhibit many obvious warning signs

1. Run Deckard's System Scanner (DSS)

2. Run the vundo and combo fix

3. Run Malwarebytes Anti-Malware

4. Run the anti spyware removal programs spybot

5 Run Superantispyware

6. Run a complete scan with free curing utility Dr.Web CureIt!

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

Ad-aware seems to get rid of it pretty easily.

i found a great community at yahoo groups and they did helped me a lot! so I'm sharing the same help i got form the... try downloading at www.grisoft.com. hope this will help you somehow, it did helped me.

All Trojan horses are hidden files so you would need to go to the Files Option (click the View tab)at Control Panel and uncheck both the *Hide file extension for known file types & *Hide protected operating system files (Recommended)-boxes, then OK yourself out. You will then need to restart your computer and and go into Safe Mode by holding the F8 key down -(kind of at the beginning of bootup). When you're at the DeskTop screen go to Start/ Search/ For Files and Folders and type up the NAME OF THE FILE & EXT (not PSW.Briss.C) but the actual name of the file, which would have shown up on your Anti-Virus software. You can delete this file from here, also make sure to empty your Recycle Bin.

I have had 4 Trojan horses on my C drive and kinda figured out the above method a week ago. I deleted the Temp file (as these keep putting the same files back into your system) from the Restore folder after unchecking the hidden files boxes, then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests!

PS. I also have AVG 6.0 (the free one) & also the Ad-aware 6 and I use them every day as my kids love to play games from the Internet.

AVG Anti-virus is free and it picks up any viruses then it has got to be good. Sometimes, even running AVG will not show up a virus because it may be residing in the System Restore files which AVG cannot access. System restore should be disabled, the files deleted, the PC rebooted and then System Restore re-enabled.

Running AVG and Ad-Aware will remove the pesky Trojan. Also AVG can access the system restore if the resident shield is enabled it will detect the files. I have 80 clients all running AVG 7.0 I know its not free for this version yet but there are some good enhancements to the new product versus 6 which we used to be on. Also if you are a non-profit you can apply for a charity license from them which is what we have. You get client,server both regular and exchange for nothin. Best thing is we haven't had a major virus incident since the usage of AVG. Mind you the updates are done centrally here so needless to say "your antivirus is only as good as your definitions"

I too had a problem with trojans and dialers. AVG would detect it and "heal" it yet with every reboot the infected files would come back. So here's a simple solution that works. A guy by the nickname "webwizard" posted his recommendation here and I went home and tried it and it worked.

Solution: Go to your control panel, select system restore, and then tick off the "stop system button" button and click on apply. Then run AVG. It should come up clean. Now reboot and go back and turn on your system restore feature. The problem should be fixed.

After speaking to different so called "experts" and trying useless software like adaware and spybot and pest patrol ..it was nice to see this simple 10 min procedure was all it took..Thanks for the tip webwizard!!!

You can get rid of the Trojan , by following these steps .

1 Download and intall the SuperAntiSpyware on your computer .

2 Update your SuperAntiSpyware .

3 Scan your computer for all the Trojan in your computer .

4 Remove all the Trojan , found while scanning with the SuperAntiSpyware.

5 Restart your computer .

You have a very formiadble infection. good thing you know the name. PSW Bispy B has infected many computers. The problem is that that most antivirus programs don't detect it. The only ones that do is AVG and windows live onecare. However AVG detects but it can't do anything about it. Go to this link http://onecare.live.com/standard/en-us/3/communications/trytoday.htm

It will allow to download live onecare with a free 90 day trial.

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

Go to GriSoft and download their AVG anti-virus software. Be sure to get the free version. Run the program. It will automatically isolate & remove the Trojan horses PSW.Bispy.A and PSW.Bispy.B, as well as most other viruses and Trojan horses.

On Win 2000:

After AVG picked up the instances of BIspy.A and .B in my users /Local Settings/Temp folder, I deleted the 6 files associated (cab, ini, exe and some others that started with BI)then went into the registry (start > Run > Regedit), searched for "BI.dll" and deleted the registry entry for the program when i found the correct string.

If you are not keen on editing the registry yourself, get hold of Spybot - Search and Destroy

After I restarted the machine, and was able to delete the /winnt/BI.dll

im running AVG too, same problem with virus vault. To get rid of it (using winXP) this is what i did.

ran command prompt.

CD 'local settings'\temp

del bi*

seemed to work for me.

I too had the virus that my avg would not remove. what I did was move the infected file to the recycle bin and then ran the avg scan again. This time it healed it and put it into the vault. ..

I too had the PSW.Bispy.A and PSW.Bispy.B viruses on my C- Drive.

AVG anti-virus software detected and removed the bi.dll file but was not able to delete the virus contained in a file in the C:\_restore\temp folder. I am running Windows ME and I think the files in the folder cannot be accessed because they are used by the RESTORE function. To get around this, I downloaded a windows bootfile from www.bootfile.com, copied the files to a floppy and then booted from the floppy. At the A> prompt, I changed the drive and directory to C:\_restore\temp. Since I booted from the floppy, I was able to delete the infected file. I then rebooted from the hard drive and ran AVG anti-virus software again. This time it found the virus in another file in the same folder. I then rebooted from the floppy, erased the infected file and rebooted from the hard drive. AVG was rerun and the virus has been removed completely. It took two iterations to remove it completely.

Two online virus programs did not detect the virus before it was removed. AVG was the only one that did.

I have XP Home Edition and ran AVG. The program detected and removed the virus just easily.

Finally after a day of trying to clean it, I turned off my system restore, then rebottted ...ran AVG. it stuck them in virus vault and I was able to delete them...have scanned 3 times now and they are all gone...

this got rid of it for me.download WINPATROL and then run it it will come up with a screen pretty much straight away click on ie helpers tab and you will now see a file bi dll.delete file,it will say that it wont delete it but it will stop it running by doing this it enables avg or your own virus software to delete it cos its not running.run your virus software and it will heal it problem solved.

For those with PSW.Bispy.B or A or C AVG now has a small executable program on their homepage to deal with these and 60 others..simply boot up in safe mode(I'm running Windows ME) click on the downloaded file,and it removes all 3 files associated with the virus..reboot normal and Voila! Worked on my version A.

If you can move them to your recycle bin then delete them and your problem is solved.

All Trojan horses are hidden files so you would need to go to the Files Option (click the View tab)at Control Panel and uncheck both the *Hide file extension for known file types & *Hide protected operating system files (Recommended)-boxes, then OK yourself out. You will then need to restart your computer and go into SafeMode by HOLDING the F8 key DOWN -(at bootup - after the first screen info - be quick!). [You have to use your keyboard when you're in SafeMode - the keys to use are Ctrl/Alt/Delete (to exit the Help and Support screen) - Tab/Arrow keys/ Pageup/Pagedown/ the Window key(between Ctrl & Alt) & Enter] So, from the DeskTop screen press the Window key to get Start/ arrow up to Search/ arrow right to For Files or Folders and type up the NAME OF THE FILE & EXT (not Horse PSW.Bispy.B) but the actual name of the file, which would have shown up on your anti-virus software. To delete this file from here just press Page Up to highlight the file and then delete. To get out of Search -Alt F/ arrow down to Close and press Enter.

It will be safe to empty your Recycle Bin in the Normal mode where you can use your mouse.

I have had 4 Trojan horses on my C drive and kinda figured out the above method a week ago. I deleted the Temp file (as these keep putting the same files back into your system) from the _Restore folder after unchecking the hidden files boxes, then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests!

PS. I also have AVG 6.0 (the free one) & also the Ad-aware 6 and I use them every day as my kids love to play games from the Internet.

The AVG cannot get rid of it because it is locked into your system as a hidden file. The way to get at it is to unlock the file by going to Start/Settings/Control Panel/Folder Options/View tab and uncheck the Hide file types...etc. as I mentioned above. Then all you would need to do is to go to Search and delete it. If not in the Normal mode, then Search and delete it in SafeMode.

the problem with the virus in the restore folder is that AVG cant delete/modify files in there. you need to disable system restore. I also had this virus in a backup of my accounts. I tried running the removal tool from Grisoft but it didnt work. I disabled system restore, deleted the files associated with the virus then rebooted. I also searched the registry for any "bi" or"bispy" entries. there were none, so i guess im all good now. what ever you do just remember to disable system restore. if you don't you will continue to get the AVG extension message and if you ever need to restore to an earlier date you will reinfect your puter.

I have AVG and it could not take it off even though it was updated. I, however, did find an alternative given by grisoft/AVG at the following URL: grisoft.com

I would suggest following its instructions to the letter. If you do, you can then run AVG again and the Virus will have disappeared.

You can get rid of the Trojan horse , by following these steps .

1 Download and intall the Malwarebytes on your computer .

2 Update your Malwarebytes .

3 Scan your computer for all the malwares in your computer .

4 Remove all the malwares , found while scanning with the malwarebytes .

5 Restart your computer ,

You can get rid of the Trojan horse , by following these steps .

1 Download and intall the SuperAntiSpyware on your computer .

2 Update your SuperAntiSpyware .

3 Scan your computer for all the malwares in your computer .

4 Remove all the malwares , found while scanning with the SuperAntiSpyware.

5 Restart your computer .

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

• It's a Trojan password stealing virus. The Free version of AVG by Grisoft removed it from my computer. They also have a free removal tool.

• I downloaded the trial version of AVG and it found PSW.Bispy.A and B. Then I downloaded a tool, but when I scanned with the tool it removed PSW.Bispy.D. I'm kinda confused now as my PC is still showing I have A and B.

• Try this link: grisoft.com. Change the file name, restart the computer in safe mode and then run executable file.