Java malware

Hi,
Last night I ran my weekly scans: SuperAntiSpyware, MalwareBytes, Spybot, and Avast. The first 3 were clean (the quick versions of Sas & MalwareBytes). But the Avast quick scan picked up something with a high severity rating. For some reason I could not move it to the chest, so I deleted it instead. I rebooted the computer with the recommended auto scan and that picked up about 6-7 problems. I kind of panicked and lost track. I deleted them all, but I did notice
that most of them were on Java.

I’ve since run full scans using Avast, SAS, MalwareBytes, and Spybot. All of them are clean. Do you think I’m okay now? I’m wondering if the malware came from the issue Java was having before they released Java 7? Firefox warned me to update that plug-in on Suday (which I did immediately). But I didn’t think to run a scan at the time.

I’ve also changed all important password (via an iPad) but I’m still nervous about logging onto anything on my computer, even though everything looks clean.

thanks in advance.

We need to know what was detected before we can possibly make any suggestion.

What was the file name, location and malware name ?
You can open the avastUI, Scan Computer, Scan Logs and select the scan that you ran, you can make a screenshot of this (or copy the information) and attach the image to your reply.

Hi, David
Thanks for the reply. I can’t find it. I looked under “settings” and didn’t see anything (I’m using the free edition of Avast). I could not put it in the chest last night, so I just deleted it.

The scan that ran after the computer rebooted, detected several things. And l deleted those as well. I couldn’t get all of their names, but the last 2 I managed to jot parts of: Java:Agent-AGU[Expl] and the other one was Java:CVE-2010-0094-A[Expl]

I’m 90% sure that all of them had the word Java.

does that help?

Try again Alicia82. Relax, and follow DavidR’s instructions.

1.) As you updated to the latest version of Java, you should have been OK.
2.) With the info in your Logs, any Files deleted that may cause you problems in the future can be addressed. Also details of Viruses, and their File names are important, to keep the Virus Database a powerful tool.
3.) Is you Computer running OK ?

Hi Abraxas,
yes, my computer is running beautifully (but she seemed fine before too). And thank you for the advice, I’ll try to be sure to keep a record if this happens again.

I’m not sure if you saw my reedited response above, but i managed to scribble down the last two things that Avast’s reboot scan detected last night: Java:Agent-AGU[Expl] and Java:CVE-2010-0094-A[Expl]

I’m quite sure that all of them were Java…something. Is that useful?

(I’m now craving coffee. again.) :wink:

I found the logs and took screen shots:
The photo with just one detected problem is the quick scan result.

*I’m still trying to figure out how to re-size the other screen shot so it fits and is still legible. *

Reboot scan results:
All were said to have been successfully removed…I cropped that bit out to make the screenshot fit.

*I'm still trying to figure out how to re-size the other screen shot so it fits and is still legible. *
save pic as gif to make it smaller

if you put the mous pointer on the vertical line just in front of SEVERITY and drag sideways you will get the full file path

guessing it is in java cache …looking for a old java to exploit

Hopefully this one is better. Thanks for the tip, Pondus.

Now that it’s been caught and every scan I’ve run is clean (and I have the latest version of Java), do you think I’m in the clear?
I know it’s hard to say without knowing more, but things seem to be okay so far. knock on wood

empty your java cashe

you may use CCleaner and or ATF cleaner …i use both :wink:

i recomend CCleaner slim installer … no toolbar :wink: http://www.piriform.com/ccleaner/builds
ATF cleaner http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25 small cleaner that is not installed …can be run from USB stick

Thank you, Pondus!
I’ll give the CCleaner-Slim a go first.

The CCleaner was fast, and simple. Now that everything is cleaned, should do anything with the registry issues? CCleaner picked up a few, but I have no idea what anything means. (I don’t want to delete anything that will mess up something vital.)

Sadly I’m very unacquainted with the workings of my computer.

On a side note, when I use Firefox, I have the settings set to “never remember history,” I’m hoping that this may have been a potential safety net for me concerning the Java exploit?

Now that everything is cleaned, should do anything with the registry issues? CCleaner picked up a few, but I have no idea what anything means. (I don't want to delete anything that will mess up something vital.)
i always let it fix what it find with default settings .....never had a problem with it

My default setting have every box checked in the Registry Cleaner option. Is that normal, or should I un-check a few? (Run at start-up and Windows Services sound important…I don’t want to lose anything.)

And again, thank you for helping me out on this. I’m sure people like me, the computer illiterate, are not the easiest bunch to work with. :smiley:

yep thats normal, everything checked here also

That was easy too. (Most of the registry errors were old AVG bits that were left behind from over a year ago…before discovering Avast.) :smiley:

Is there anything else I should do, or does it sound like my computer is as clean as she get at this point?

well…as said before i also use ATF cleaner…it will find a bit extra ?

and if you want all toolbar crap to be gone run the fist program here AdwCleaner http://forum.avast.com/index.php?topic=53253.0

you may post the log here

and i would uninstall SpyBot …no good with todays malware …you dont need it when you have MBAM and SAS

Here is the txt. of AdwCleaner (after computer reboot).
I’ll try the ATF cleaner too.

The ATF cleaned 1, 325.285 MB

Anything else I should try? :slight_smile:

Anything else I should try?
yea .... visit this forum regularly ;)