Question to essexboy (or anyone really) on Malware getting snuck in via Java.

[WBFAir]

Hello all

I was asking some questions about this over on the main avast! Free/Pro/Suite section and was advised that I might best come to this section and pose the questions.

Basically am looking for info on Malware that seems to be sneaking into, and I am assuming is getting used, via Java.

Don't know if I want to clog up the board with a repeat of everything I posted there so perhaps a link to the thread is best: http://forum.avast.com/index.php?topic=87647.0

For the most part the question related to the topic is in the last few posts.

Thanks for any help.

[Pondus]

these are java exploits from infected websites trying to exploit vulnerabilities in you java and/or Browser and then download malware to your machine

do you have latest updated versions?
(important bc then the exploit want work....unless it is very new and not fixed yet)

http://www.java.com/en/download/help/cache_virus.xml

As well neither does Malwarebytes.

malwarebytes does not look for this.....but it will look for the malware it will try to download

[WBFAir]

I just checked and the version I have is Ver 6 update 26

It tells me there is a update 29.

I'll install that but I have to say that I have been finding these files in this folder for quite sometime now and through many updates so while for sure I don't know all the technicals on this, I am assuming a update is not a very good solution for very long is it?

So is there anyway to stop these things from doing what they are doing?

Or is the only option to just keep doing boot scans on a regular basis?

Thanks

[Asyn]

Or is the only option to just keep doing boot scans on a regular basis?

Forget about the boot time scan, update your Java..!!!

[Pondus]

So is there anyway to stop these things from doing what they are doing?

yes....stay updated....then they cant do what they want to do

The boot-time scanner is an expert feature, and was designed to be used when there’s something bad going on on the system............

https://blog.avast.com/2010/02/04/v5-bts-auto-actions/

[WBFAir]

Interesting read of the reason for not automating the Boot scan.

One thing though I might suggest is that for situation like I just mentioned, the boot scan that I have set up once I found this problem was just one that scanned just that folder.

For sure I could see the FP condition being a real problem but remember, on the flip side and I have no idea why, non of those Malware infections were being found during a scan when everything was up and running either.

So again I don't know why but if it weren't for the boot scan, I would have never have found them.

I guess my point is, while I think this has been fixed in other ways, if it couldn't and if you happen to know of a place or section that gets regularly infected and can only be cleaned during a boot scan, it would be nice to setup a scan that can be done on a regular, or scheduled basis, just for that so you can be sure it gets cleaned.

I mean we have all that capability for the regular system, why can't we have things like that for a Boot Scan as well?

Yes I know manually keeping on top of this is something that can be done, but with the 2 zillion other people out there who think they are the only things going on and so force us to deal with what ever condition they make us do as a result of that thinking, the time that is available for all of them is limited.

So its always nicer if you can automate something to take care of a problem like this.

Anyway, just my 2

[polonus]

Hi WBFAir,

It is a good habit to go with your browser here once in a while to check if all critical software have the right updates, go here: http://secunia.com/vulnerability_scanning/online/?task=load

polonus

[ady4um]

@WBFAir,

Please try the following after updating JAVA.

Before rebooting, clean your web cache and your JAVA cache.

Only *then* do a boot scan. Are those suspicious objects still being reported?

BTW, it is possible to have several different JAVA version simultaneously. So, unless you specifically need a specific version of JAVA, uninstall your older versions and keep only the latest.

[essexboy]

Yep agree with ady4um the amount of times that I have seen a system with java 1.4

Remove all old versions using Javara if neccessary

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  
• Accept any prompts. 
• Open JavaRa.exe again and select Search For Updates.
  
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.