What does Trojan Horse downloader PSW Bispy A do?

PSW Bispy A

On further reading, this appears to be spyware. Did your virus scanning software by any chance Quarantine a file named "BI.DLL"? If so, see this: WinPatrol Spyware Alert – BI.DLL

Direct from source: Bi.dll installs as a newer variant of a spyware program called Transponder. This variant is released by a company called "Better Internet". This BHO (browser helper object) monitors the URLs you visit and the data you type into web forms and send that info back to it's home servers (currently stop-popup-ads-now.com and abetterinternet.com). It also generates popup ads and can download updates or other programs to your hard drive without your permission. We'd recommend removing this file. You can do so using WinPatrol or you can find manual removal instructions at »www.doxdesk.com/parasite/Transponder.h...

I, however, removed the virus with a virus remover found at: grisoft.com

{I did not take any chances. I ran it in safe mode (for Win XP, F8 pushed while restarting) and renamed the file, leaving it on my desktop. It did not say the file was gone after it ran; But when I ran AVG Virus Scan again, it did not detect the virus}. Good Luck! I don't know how I got it. I assume I got it on the Internet somehow (probably in a popup while using IE) because my emails are scanned before they are even delivered to me and again before I open them. The question I have is how to prevent getting the darn virus again. PS... Please do not edit or change this response.

Here are more answers and opinions from FAQ Farmers:

• As far as I can tell "Bispy" attempts to install ads etc on a computer. It also tried to delete files on my computer. A friend of mine got it by just browsing the Internet, so watch out this one is sneaky. I use AVG and it detected it and healed it along with WinXP witch did a system recovery.

• I think it's all to do with AVG myself. I kept getting the warning popping up and it was really bugging me, I had more popups than usual, too. I found the file BI.DLL and just deleted it. Since then I haven't had any warnings of the virus or as many popups.

• PSW/BiSpy.A, as far as I'm aware, falls under the Spyware/Password Logger category of viruses. It doesn't have a payload per se, but is reknowned for allowing much more than the normal few pop ups through, especially if the website is sponsored. It doesn't allow other viruses to bypass a PC's firewall, like a Trj.Downloader, but instead opens other ports and protocols that allow pop-ups that can seek out these openings. That's why the PC's report more advertising than normal. Also, bi.dll, the link library that allows PSW/BiSpy to run has a link that writes itself into a random area of Windows Explorer (like a Dial-Up connection does) which makes it so hard to dispose of. Grisoft's vcleaner (http://www.grisoft.com/us/us_remtext.php?id=bagbugnet) tool removes the link to bi.dll (which is the reason that it needs to be run in safe mode, as it can't delete an active link). The best way of not contracting PSW/BiSpy variants is just not to use anything that is ad-funded. Or you can just be vigilant in what you download. AVG (www.grisoft.com), and SpyBot: Search and Destroy (security.kolla.de) can help.

• I think i picked this one up from xoftspy, once downloaded i had 5 of these.good tips here on removal. avg 7 is recomended.

First answer by Melissa B. Last edit by shaun p. Question popularity: 158 [recommend question]