Trojan.Java.Payphish.a

Technical Details
Payload
Removal instructions

Technical Details

This program is a Trojan. It contains several modules. The files detected are Java class files and web pages (html files). Its components can be from 676 to 2139 bytes in size.

Payload

When the infected page is opened, Java class code starts to run, which leads to the following actions:

• The following file is created and launched:

  Ñ:\Windows\pay.reg

  This causes a change in the following system registry key value to:

  [HKCU\Software\Microsoft\Internet Explorer\PhishingFilter]
  "Enabled"="00000001"
  

  Internet Explorer's phishing filter is thereby disabled.
• Internet Explorer is launched and the following link opens in its window:

  http://www.mps****/~isara/payment_cancel_websc_4535/webscrcmd=_login-submit_main=0000.html

At the time of writing, this link was inactive. The Trojan then ceases running.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following file:

   Ñ:\Windows\pay.reg

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).