There are several ways to rid your computer of PSW Agent H manually.
A. Manual Removal: follow these steps.Go into safe mode (probably F8 when you reboot).
Search drive C for SYSUPD.EXE and delete it. Apparently this program won't start in safe mode.
Then remove from Recycle Bin.
Restart in normal mode and run a full scan with AVG. It can now heal the infected file and you no longer have a virus on your PC.
Use Malwarebytes You can get rid of the trojan horse by following these steps:
1. Download and install the Malwarebytes on your computer.
2. Update your Malwarebytes.
3. Scan your computer for all the malwares.
4. Remove all the malwares, found while scanning with Malwarebytes.
5. Restart your computer.
Other anti-malware programs you can install and use:1. Install and run Malwarebytes Anti-Malware.
2. Run a complete scan with the utility Dr.Web CureIt!
3. Run the anti-spyware removal programs Spybot or Superantispyware.
4. Install ThreatFire: ThreatFire features innovative real-time behavioral protection technology that provides powerful standalone protection or the perfect complement to traditional signature-based antivirus programs, and offers unsurpassed protection against both known and unknown zero-day viruses, worms, trojans, rootkits, buffer overflows, spyware, adware and other malware.
I also recommend you use Mozilla Firefox or Google Chrome browsers for browsing unsafe websites.
Another option is to run an online virus scan like: Trend Micro HouseCall
Kaspersky free online virus scanner
Windows Live OneCare safety scanner
BitDefender Online Scanner
ESET Online Antivirus Scanner
F-Secure Online Virus Scanner
Avast! Online Scanner
Update your software by running Secunia Online Software Inspector.
An absolute must is:
Install a good antivirus in your computer.
Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
Keep your permanent antivirus protection enabled at all times.
B. If all the above options failed, here are a few steps to follow for manual removal:The way to remove PSW.Agent.H is simple, but the only catch is there is a process running called SYSUPD.EXE which protects the Trojan source file, _UPDATE.DAT, in Documents and Settings from being removed. So, here is what you do:
Read all the steps below before you start.
1. Run a search on the computer for a file called SYSUPD.EXE.
2. Open My Computer, and browse to the folder that contains the file.
3. Press Ctrl+Alt+Del, and click on Task Manager.
4. Look on the bottom of the Task Manager window to see how many process are running (example: Process:15).
5. Find SYSUPD.EXE and stop it. Most likely it will keep starting it self over.
4. Keep looking for it and stopping it, until the number of processes go down by one.
Once you reach this point, you only have a few seconds until it restarts, so be quick.
5. Switch to the window where SYSUPD.EXE is located and quickly remove it. Once it has been removed, you can remove the main file _UPDATE.DAT. which will be found somewhere in Documents and Settings. If you cannot find it, run a search for it.
7. Run AVG again to make sure the Trojan is gone.
If you can't find _UPDATE.DAT with a search, don't be concerned. Just run your AVG and it can heal it once the SYSUPD.EXE file is gone.
Make sure you have AVG installed first. Its the only antivirus that finds it and the only one that can eventually heal it.
C. Another Manual Removal Method All Trojan horses are hidden files, so you would need to go to the Files Option. In Windows XP, go to the Control Panel and click on Tools, then Folder Options, then View. Uncheck both the *Hide file extension for known file types" and *Hide protected operating system files" Recommended boxes, then OK yourself out.
You will then need to restart your computer and and go into Safe Mode by holding the F8 key down at the beginning of start up. When you're at the DeskTop screen, go to Start/ Search/ For Files and Folders and type up the NAME OF THE FILE & EXT which would have shown up on your Anti-Virus software. In the case of PSW Agent H the file is SYSUPD.EXE.
Restart your computer and run a full scan with AVG. AVG can now heal the infected file.
