Internet Security Threats

Trojan-Downloader.VBS.Psyme.f

RISK LEVEL:2

When launching, the Trojan causes an image called "nice_warm_pussy.jpg" to be displayed. At the same time, it downloads a file from the followinglink:

http://vnm.musx.net/***p.exe

(At the moment of writing, this link was not working.)

The file is saved to the Windows temporary directory as “browsercheck.exe":

C:\windows\temp\browsercheck.exe (absolute path)

The file will then be launched for execution.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
2. Delete the following file:

   C:\windows\temp\browsercheck.exe

3. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).