Will Avast Stop the Java Problem?

[hilaryp]

I visited a foreign website by someone who posted on a legitimate discussion board (Yahoo Groups) and asked aficianados of the subject discussed to admire their website in Romania dedicated to it. I visited it and also a Russian site. Now I'm paranoid about how slow the start-up on my Windows system is despite Avast. I just want to know if I should be paranoid.

[Irbidan]

Paranoid question.

[Pondus]

If not already, they will as soon as they see samples that try to exploit this vulnerability...
also make sure you have latest java

this is what antivirus companys do 24/7 so leave the worry to them....

if you ned help checking/removing infection, follow the sticky guide in virus and worms forum section

[hilaryp]

this is what antivirus companys do 24/7 so leave the worry to them....

THANKS! I should have added that I recently asked about an Imation Extender (that I returned to Amazon for a refund), because I kept getting Malware! warnings. So I thought that might add to the Java thing.

[DavidR]

Will Avast Stop the Java Problem?

Well it isn't any AVs task to 'Stop the Java Problem' that is Oracles task to close vulnerabilities so they aren't exploited. It is also the users task to ensure that they have the latest version of JAVA so vulnerabilities are closed. If either of those aren't followed promptly then avast will be on the lookout for for these exploits as they have in the past.

That said, you really have to ask yourself is JAVA more hassle than it is worth and do you really need it, e.g. do you have to visit sites that absolutely require it (there may be alternative sites), do you have applications that absolutely require it (there may be alternative applications). If you can answer no to both of these then you don't need it and should seriously consider removing it.

[hilaryp]

That said, you really have to ask yourself is JAVA more hassle than it is worth and do you really need it, e.g. do you have to visit sites that absolutely require it (there may be alternative sites), do you have applications that absolutely require it (there may be alternative applications). If you can answer no to both of these then you don't need it and should seriously consider removing it.That said, you really have to ask yourself is JAVA more hassle than it is worth and do you really need it, e.g. do you have to visit sites that absolutely require it (there may be alternative sites), do you have applications that absolutely require it (there may be alternative applications). If you can answer no to both of these then you don't need it and should seriously consider removing it.

The problem is that laypeople don't know what it is. I swear that's the problem. If there's a No Java for Morons! site or book, I'd appreciate the url or title. Thank you.

[YoKenny]

You can verify the Java version by going to its test page.

Code: [Select]

http://www.java.com/en/download/installed.jsp

[polonus]

Hi hilaryp,

At the moment with the zero Java exploit being actively exploited and abused and still not patched I would like to advise you to put the use of Java to an absolute minimum. So use it where there is no existing alternative (like HTML5) and where you cannot go without it. See to it that for these instances you use the latest version of Java and no older versions are available on your system as exploits prefer these older versions to run even when a patched more recent one is available. Disable Java in you standard programs and browser(s). Enable it in one non-standard browser you just use for these instances for when you cannot go without Java in the browser.

If that is not enough, then here you can read all about the "sloppy" Oracle way of patching: http://www.security-explorations.com/en/index.html
link article author = Security Explorations' founder and CEO, Adam Gowdiak.

"Java is a mess. It's not secure,"

, says Alien Vault's Jaime Blasco in his article here -> link: http://www.reuters.com/article/2013/01/10/us-java-security-idUSBRE90919X2013011

If this will eventually lead to browser without plug-ins is a thing that only time will tell. Personally I think that for later IE browser versions they will take no chances...

polonus

[Ddm5]

I know I'm semi Hijacking the thread but I have a question, since I run my Browsers totally sandboxed. (I have the full internet security), will this prevent it at all?, I've also got noscript, etc.

[polonus]

Hi Ddm5,

You are welcome, thank you for your question, and I am sure hilaryp won't mind you asking this in her thread. Yes with NoScript and run inside a sandbox you are secure against recent and even against future Java script holes. As you are familiar with NoScript I would like you to add RequestPolicy add-on as that pair (NS & RP) will give you the best possible and optimal in-browser protection against these issues by also denying all third party requests to where you do not want to venture out. Always have the avast shields up (Webshield and Network Shield) and under all circumstances. If you expect a situation scan the full browser file location additionally with avast at the end of the browser-session to make absolutely sure there are no left-overs/flags,

polonus

[Ddm5]

Hi Ddm5,

You are welcome, thank you for your question, and I am sure hilaryp won't mind you asking this in her thread. Yes with NoScript and run inside a sandbox you are secure against recent and even against future Java script holes. As you are familiar with NoScript I would like you to add RequestPolicy add-on as that pair (NS & RP) will give you the best possible and optimal in-browser protection against these issues by also denying all third party requests to where you do not want to venture out. Always have the avast shields up (Webshield and Network Shield) and under all circumstances. If you expect a situation scan the full browser file location additionally with avast at the end of the browser-session to make absolutely sure there are no left-overs/flags,

polonus

My good friend polonus, I have requestpolicy, ghostery, noscript, Avast webrep and Adblock plus. I've got noscript on to block near enough everything for new websites that I visit, I've got my shields on all the time, with daily quick scans so I'd say I'm good to go?, stupid question on the side, How safe is the "Safezone browser" from the exploit, compared to FF with the plugins mentioned?

[polonus]

Safezone browsing was developed with safe online banking in view for quite another general audience as it comes sort of imposed. The solution you work with non-admin rights could be worked similarly as you know how to "toggle" the protection extensions, like NS, RP, sandbox etc. This solution  is also as solid as can be for these Java driven issues,

polonus

[Ddm5]

Thank you Polonus, hopefully I won't have any problems with this Java situation, and or any other Virus(s).

[polonus]

Hi Ddm5, hilaryp, YoKenny & DavidR,

Well, we all have to wait until coming Tuesday's Oracle patch cycle: http://isc.sans.edu/diary/Oracle+Patch+Tuesday+Pre-Release/14920
Link from SANS Internet Storm Centre's by Stephen Hall (Version: 1) of what is coming patched,

polonus

[Lisandro]

The problem is that Brazilian online banking depends on Java.
Read the blog (both in English and Portuguese) to get further help.