It's ok, it's Bit Defender Free Edition's Scan Server. I should have looked there before. Listen what happened just now:
Immediately after the Web Shield detected:
Sign of "JS:Classloader-6" has been found in
http:// some page /loaderadv416.jar\Counter.class file.
I did a memory scan (ignoring bit defender’s process) and this happens:
Sign of "JS:ClassLoader-5" has been found in "*PROCESS\5a4\1279000\8000" file,
Sign of "JS:ClassLoader-5" has been found in "*PROCESS\5a4\20f1000\3d8000" file,
After I boot scanned all disks and found nothing, memory scan said it was all clean.
Note that after that bit defender found Trojan in some archive. But I don’t see how could he become active?
Another false alarm?