Bunch of Java false positives??

Viruses and worms
1

I looked around for a bit, but I wasn’t able to find a “Post false positive stuff here” message or whatever, so if this isn’t the right place, sorry.

A few of these ‘viruses’ have been in the chest for awhile now, but a few I just found yesterday

x2 rotor/Zom.class Java:Agent-JW [Expl]
x1 rotor/Zo666.class Java:Agent-ZZ [Expl]
x2 rotor/zalux$1.class Java:Agent-ZX [Expl]
x2 rotor/Glocker.class Java:Agent-ZY [Expl]
x1 andora.class Java:CVE-2011-3544-AA [Expl]
x1 EFC4d01 JS:Downloader-BEE [Trj]

Then this just popped up after I looked up something on google

URL: http://www.google.com/url?sa
Process: file://C:\Program Files (x86)\Mozilla Fi…
Infection: js:ScriptIP-inf [Trj]

Not sure exactly what to do with these things so help would be appreciated!

2

why do you think they are false positives ?

seems to be java exploits from websites you have browsed…
is your java updated ?

3

Yep, always update it as soon as ones available. I also looked it up once or twice and the person posting on the OPs thread said these are most likely false positives. The Google block also makes little to no sense as I literally had had just pressed enter to search for info on these exploits. Also, since its a Trojan downloader, how do I find any of the programs it may have uploaded?

4
Also, since its a Trojan downloader, how do I find any of the programs it may have uploaded?
you mean if it succeeded.....avast did chatch this...and i guess before it could do anything

if you suspect infection, then there is a guide here to follow…attach the logs and Essexboy will have a look
http://forum.avast.com/index.php?topic=53253.0

5

The BEE Trojan was found by a Boot-Time scan, the Trojan blocked was a different one. Thank you, I will follow up on here. My knowledge on malware and the like isn’t as large as I would prefer.

6

Alright, I already used Malwarebytes, so I scanned and found a single infected file. That file in particular I am pretty sure is not a virus or malware. The file in particular was one in a program called Bitpim used to extract hidden files from phones without having to do it more complicated ways. The program itself worked fine, so I’m not sure what to make of that… Should I move onto the next step?

I posted the Malwarebytes log just in case:
Malwarebytes’ Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7856

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

10/6/2011 02:04:59
mbam-log-2011-10-06 (02-04-59).txt

Scan type: Full scan (C:|D:|)
Objects scanned: 344575
Time elapsed: 47 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

7

you did not update Malwarebytes before you scanned… always click the update button before you start a scan

update and run a quick scan…and continue with next step

OBS and attach the logs

lower left corner > additional options > attach

8

I updated it before I scanned, I’m 100% sure, but alright. I also completely missed the additional options tab, duh on my part.

9

your log say Database version: 7856

my malwarebytes say 911122301 ( i think they started with a new number system a couple of days ago- but it is more then a week since it was under 8000 )

10

Alright, for some strange reason the logs would not save in the place where I wanted them and the log file wasn’t accessible, thats why I posted an extremely old log by accident. I attached the log I thought I posted earlier, and the one I just scanned for, its completely clean.