JS\Psyme help

Jul-06-2004

Help!
I have the JS\Psyme virus on one of my computers. Avg quarantines it but then it just comes back. Is it possible

I am getting infected or re-infected by visiting a particular web site?
I would love to hear any information or ideas anyone has.
Thank you,
Breearnold

Alan · Jul-07-2004

In short the answer is yes....

It resides in a HTML page that can vary in size. The dropped file is a 1,536-byte Win32 executable that are detected by other Antivirus solutions as TrojanDownloader.Win32.Revop or TROJ_REVOP.A. Its only function is to download two more files from Internet to "c:\Program Files\pup.exe" and "c:\Program Files\over.exe", then execute them.
The two additional files, PUP.EXE and OVER.EXE, may vary depending on the web site that employees the trojan, but known versions of them are all classified as Adware that displays advertisements on the affected system. These two files are not malicious and not considered as components of the trojan.

Jul-07-2004

Alan,
Thank you for your response. I love to get as musch information as I can. You have been very informative.
You mentioned that this virus downloads the two other files "pup.exe" and "over.exe" . You saiad they are not malicious, should I find and remove them? Do you know what purpose they serve? And is there any way of finding out which site keeps infecting my computer?
I hate to be a pain, but like I said I LOVE to get information. The computer is fine and I believe the problem is under controll. I guess I am just curious by nature. Thank you again for all you help.
Breearnold

Alan · Jul-07-2004

The files pup.exe and over.exe are associated with scripts on NT platforms, like XP. If you find them just delete them. As far as knowing which site affected your PC, it is hard to say. But you can try this to narrow down your search. As you visit each site in your Internet History, scan your hard drive for the virus after your visit. I know this method is going to take a while but it will be worth it in the end, if only to identify the infected site.
I would make sure your anti-virus software is fully up to date and that your firewall is up and running.

Regards

Jul-07-2004

Alan,
Thank you! You are awesome!!!!!!!

Breearnold

Rob · Jul-07-2004

Yes, Alan is awesome and we appreciate all he does at PCSupportforums.com

Alan · Jul-07-2004

Thanks for the kind words, they are appreciated but I am just glad to help out when I can.