Always seem to have stuff in Java during Boot scan.

[WBFAir]

Hello all

I have the free avast installed on a Win7 64 bit machine.

Program does a great job but every once in a while I decide to do a boot scan and never fine anything aside from a bunch of virus's in a folder in my Java program.

So much so that I have now setup a boot scan dedicated just for that folder.

As its been awhile since I had done one, I did one this morning and it found like 13 things.

Note I also have one set up to scan the exact same folder but with the system up and running and ran that just before the boot scan and it found nothing.

So what is the deal with this?

Does this happen to everyone?

Is Java some kind of place Avast or no one can keep this from happening?

Are these even Viruses or something of just the program?

I guess in the end I'm just wondering if I should be doing this more often or every time I start up the machine?

Thanks

[Asyn]

More info please.
What is detected..?
What did you do with it..??

[WBFAir]

Sorry that I didn't provide more but I'm not to sure what to give.

As I mentioned, there were 13 things found this time and all with weird names but all in the same folder of Sun\Java\Deployment\Cache\6.0

The log seems to list them as Java:Agents with two letters after that like XX or UB, then after that is written [Expl].

As far as what I did it with, as mentioned, this was the Free version on a Win7 64.

If which version, it is what ever it the latest one there is (6.0.1289) and that was downloaded from the Avast site

[Asyn]

As far as what I did it with, as mentioned, this was the Free version on a Win7 64.

No, I meant what you did with the findings..?!!
Did you delete them..??
As it's in the cache, just clear them.

[WBFAir]

Oh sorry.

I have the boot scan setup to move them to the chest if that is what you are asking.

[jrace]

So what is the deal with this?
Does this happen to everyone?
Is Java some kind of place Avast or no one can keep this from happening?
Are these even Viruses or something of just the program?
I guess in the end I'm just wondering if I should be doing this more often or every time I start up the machine?

1. Java is prone to pick up stuff like that, yes it is malware!
Normally it is sitting in Folder (Win7 path) C:\user\"YOUR NAME"\AppData\LocalLow\Sun\Java\Deployment\cache\6.0

2. Be sure your avast! reports system clean!
To manage the future situation: go to control panel click on Java. At the bottom of the opening window click on the button "Settings". In the new window popping up uncheck the top line reading "Keep temp. files on the computer" (this disables the collecting mania of Java). Then click at the bottom "Clear Files". On next popup check all items "on" and then close all windows by "ok"
The mentioned buttons may read a bit different I am just translating the German system!

3. You might wont now to erase everything which is in the above mentioned (1.) folder "6.0", just go ahead, there is no harm but also no need to do it.

[WBFAir]

Wow thanks jrace

Never knew that option was there in Java, does this mean that even if it picks up something it will always get deleted every time my browser closes?

I'm guessing it still wouldn't be a bad idea to run the boot scan from time to time.

As well, I deleted all the files in that 6.0 folder, guess it would be good to keep an eye on that too.

So this is Malware huh.

For sure I believe it but its funny how both Avast while running regularly in the system as, and running a scan of that folder finds nothing. As well neither does Malwarebytes.

But for sure I sure seem to get a lot of junk mail and always unsubscribe from those but always seem to get the same ones back.

I would suspect that not all of that is from this but I would bet some of it is and anything one can do to reduce this it better then nothing.



 

[jrace]

Your browser has its own settings to clear stuff when closing!

Java is storing its stuff in the folder "6.0" but now there is just no way to store it there.
If you want, you can navigate every now and then to "6.0" and have it just checked (right click on folder) by avast! or MBAM. It should stay clear except for Java rebuilding the empty(!!!) folders.

Glad I could help you!

[WBFAir]

Yeah I have my browser setup to clear things already.

I guess what I was asking was what would trigger the removal of the Java file but I think I get it now that more what would happen before was that, if it decided when it used it that it wanted to save it, Java would store a file in the 6.0 folder.

So its not like now when it uses it, it keeps it, then when Java closes, it deletes it then. (Kinda like the browser does).

Now what happens is no matter what Java uses, it just uses it, but never stores it.

[Ivanych]

здравствуйте!Когда я установил лицензионный AVAST!Internet Security v 6.0.1289,то установил бранмауэр на дом/зона низкой опасности.И аваст пропустил вирус в архивном файле,который сам себя поместил на диске D:/внутри папки/внутри папки/внутри папки.При экспресс сканировании перед выключением компьютера вирус не был обнаружен.Перед выключением компьютера я включил режим-сканирования при загрузке,установил чувствительность анализа-высокий.Днём я включил компьютер,AVAST! начал поверку жёсткого диска ДО ВКЛЮЧЕНИЯ ЗАГРУЗКИ ОПЕРАЦИОННОЙ СИСТЕМЫ.И этот файл был обнаружен.А потом и УНИЧТОЖЕН.Попробуйте так сделать.Владимир.

[jrace]

@ WBFAir:
That's about what it is!


@ ivanovich:
Sorry I can not read, write or understand the Russian language!

[DavidR]

Your post is not related to this topic - Please start a New Topic of your own here http://forum.avast.com/index.php?board=28.0, in the Russian forum, click the New topic button at the top of the page see image and we will try to help.

####
Ваше сообщение не имеет отношения к этой теме - Пожалуйста, начните новую тему собственного здесь http://forum.avast.com/index.php?board=28.0, в русском форуме, нажмите Новая кнопка тему в верхней части страницы см. рисунок, и мы постараемся вам помочь.

Пожалуйста, простите он-лайн перевода.

[WBFAir]

Actually in thinking about this more...

When Java in the first place gets, or uses or interacts with one of these files that it used to store in that folder.....is there still a Malware thing happening?

I guess what I'm thinking is, yes it is not storing/saving the file anymore, but still, at least for the time it is getting used, there still is a infraction yes?

So I don't know if anyone can tell me this, but from before, just because these files were stored there, were they always getting used in someway?

I guess what I'm asking is, just because I am not allowing them to be saved in the Cache folder, since they were able to get there, I would assume they are still getting into my system and not being stopped by any program and are at least being used for what they were made for, for at least the amount of time they are being used?

As well to ask, and I know this is not a Java forum, but were these files/infections that were getting found by Avast really doing anything every time I used my browser?

My thinking is, just like typical, things that are stored in a browser cache fashion are just there so you don't have to download them quicker, so perhaps they weren't really getting used unless I clicked on the same page that gave them to me?

I guess what I'm looking for here is, am I doing myself any favors by one, getting rid of these in the first place, or monitoring the collection of these at all?

[jrace]

Sorry, WBFAir, I honestly can not answer these questions.

But if you go with these problems to the "Viruses and Worms" section I am sure that will be answered by our "Viruses- Worms- and Trojan-" specialist "essexboy".

Good luck to you!

[WBFAir]

NP jrace and I will give that a shot.

I great appreciate the help you have given and for sure have informed me of something I knew nothing about before I made this post so you have helped me out greatly.

Thanks again.