Many users have experienced repeated warnings of infection by JS/Psyme each time they open their browser. Depending on the antivirus in use, the name given in the warning may be any of the following: Downloader.Psyme (Symantec), Troj/Psyme (Sophos), Trojan.VBS.KillAV (Kaspersky), TrojanDownloader.VBS.Psyme (CA),Trojan.Downloader.JS.Psyme (Kaspersky), VBS/Petch.A (F-Prot), VBS/Psyme (McAfee).
Following well-intended advice from various forums and self-help groups on the Internet, those affected by JS/Psyme alerts have run a wide range of security tools and made multiple configuration changes, yet despite their best efforts the alerts continue. Some have eventually resorted to reformatting their PC. Actually, the solution is quite easy: simply delete the contents of the browser cache (See: How to Delete Temporary Internet Files and Cookies).
JS/Psyme is detection for malicious code embedded in web pages (often on compromised websites). This code attempts to exploit unpatched security vulnerabilities in order to install malware onto the system. Visited web pages are cached in the Temporary Internet folders and antivirus software scanning these folders will naturally detect the presence of this code in those cached pages. This detection will occur regardless of whether the exploit code was able to run or not. This is a good thing - the antivirus is working as it should. But it does pay to delete the contents of the Temp and Temporary Internet Files folders when investigating the source of any antivirus alert.
It's worth repeating that a detection of JS/Psyme isn't any indication of an actual infection. Just an indication that some web site you visited exposed you to the potential for infection. Remember: keep your security patches and antivirus software up-to-date, use a firewall, and follow these Computer Safety Tips.
