Troj/Pisaboy-A

Please follow the instructions for removing Trojans.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the Trojan has made.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System
<windows>\systray.exe

and delete it if it exists.

Close the registry editor.

Troj/Pisaboy-A is a backdoor Trojan targeted at users of MSN Messenger.

Troj/Pisaboy-A also installs advertising software without the user's consent.

The backdoor functionality of the Trojan allows a remote user to perform a number of operations related to Messenger, such as spying on messages sent and received or sending messages in the infected user's name. The Trojan may also connect to arbitrary websites or restart the machine.

The Trojan may display the following message:

"People in your MSNlist have been messing around with you... Also wanna be a MSNhacker?"

When first run the Trojan copies itself to the Windows folder as SYSTRAY.EXE and creates the following registry entry in order to run itself on system logon or startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System
<windows>\systray.exe

The Trojan also drops and runs a file ABZ.EXE in the Windows folder that installs advertising software.

Troj/Pisaboy-A may append the following line to the system HOSTS file to deny access to the URL:

127.0.0.1 messenger.hotmail.com