[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.8

Strange anti-virus messages as a result of Sun Java Runtime Environment

Asked by brnbrg in Windows 98 Operating System

Tags: javabyteverifyexploit, java

I run Windows 98SE with a Promise drive array as drive C.  I have also drives D, E, and F.  SFC, Scandisk & Defrag run all fine - P4 3.4GHz, 500 MB memory,  IE6, CA eTrust EzAntivirus (paid version), ZoneAlarm (free version), BHOdemon, Secretmaker, SpyWareBlaster (paid version), WinPatrol (paid version),  AdAware SE free version and SpyBot, all updated daily and latest versions.  SFC runs without reporting anything wrong with any system file.  I religiously do signature downloads/updates & full screens whenever I get up from the PC, sometimes several times daily.

All ran well until I downloaded the latest Java Runtime Environment on 10/6/05.  I suddenly got strange anti-virus messages from ezAntivirus.  It said that a whole series of files in

C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar

were infected, but that it could not remove or quarantine them.   These are all ZIP files, which are still in the above folder ...\jar and have strange names, the first is

a.jar-228d5c98-53736ebc.zip

All these files are accompanied by an idx file with the same prefix:

a.jar-228d5c98-53736ebc.idx

EzAntivirus calls them "a.class", "Dummy.class", Verifierbug.class", "Gummy.class", and "Counter.class".  Weirder yet, instead of removing them, their designations as JavaByteVerifyExploit and Java/Shinwow are highlighted as a web link and there I find the explanation:

Description  
 
This is not a virus, but rather a method to exploit a security vulnerability in the Microsoft Virtual Machine. This vulnerability arises as the ByteCode verifier in the Microsoft Virtual machine does not correctly check for the presence of certain malformed code when a Java applet is loaded. Attackers could exploit this vulnerability by creating malicious Java applets and inserting them into web pages. These web pages could be hosted on a site by a malicious web master, or could be sent to users as an attachment. To read more about this issue, and to download the necessary patches, please visit:

http://www.microsoft.com/technet/security/bulletin/MS03-011.mspx

For more information, or for examples of this exploit in action, please see the description of the following malware (found elsewhere in the encyclopedia):

Java.Shinwow
Note: this detection may be triggered by merely visiting a web page that contains malicious code. It does not necessarily mean your machine has been compromised, nor that your machine is vulnerable to this particular exploit.
 
Now, these weird ZIP files began to proliferate:  At first, there were only 3 such "maybe-viruses" found by ezAntivirus, but then there were more and more, from recognizable web visits strange ZIP files formed and were kept in these directories.  I now have 53 occurrences marked as such irremovable "exploits", with which I apparently should have to live.  But I never had any of this before I installed the Java Runtime Environment and have the following questions:

1.  Why did the complete uninstall, which went well, as did the subsequent reboot, NOT remove this entire directory tree:

C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar

2.  Do I need this bizarre array of folders like ...\jar, or for that matter, that entire tree from \Sun\Java... on at all, or can I safely remove it from C:\WINDOWS\Application Data?

I almost never needed that unstable and weird Java crap and am sorry now that I created this mess.

Note:  Before uninstalling the Java crap, I was only able to reboot into Safe Mode.  If I wanted to get back into Windows, I had to boot to Command Prompt only, run scanreg /restore, click on a previous version of the registry that was not started yet and only then could I finally boot into Windows - ruinously labor intensive.

All this went away when I uninstalled ezAntivirus, then uninstalled the Java Environment from Add/Remove Programs (it has a strange name there - something like j2se and then something about an update to version 5.0 - I am sorry that I did not write that down, I removed it and, of course, can't see it any more, but it was the download from Sun).

In my experience, no download from Sun ever worked right in my Windows 98SE environment and having uninstalled it and reinstalled ezAntivirus now allows me upon Restart to boot steadily back into Windows 98SE.  Does the above directory tree from \Sun... on down serve any function, or can it be safely removed, along with all the garbage, ezAntivirus keeps marking as "exploits"?

Or am I maybe being deceived, that the real cause for all this is something else?

Thank you very much in advance.

Sincerely,
Bernard
[+][-]12/13/05 12:07 PM, ID: 15476828Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/13/05 02:23 PM, ID: 15478038Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/13/05 02:50 PM, ID: 15478212Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/13/05 08:59 PM, ID: 15479965Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/14/05 04:02 AM, ID: 15481163Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/14/05 01:35 PM, ID: 15486046Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/14/05 02:32 PM, ID: 15486459Assisted Solution

Assisted solutions are selected by the member who asked the question as a comment that contributed to their question's solution.

Start your 30-day free trial to view this Assisted Solution or ask the Experts your question.

 
[+][-]12/14/05 11:42 PM, ID: 15488694Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zone: Windows 98 Operating System
Tags: javabyteverifyexploit, java
Sign Up Now!
Solution Provided By: BillDL
Participating Experts: 3
Solution Grade: A
 
[+][-]12/15/05 05:33 AM, ID: 15489896Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/15/05 05:42 AM, ID: 15489981Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/15/05 07:09 AM, ID: 15490603Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/15/05 07:12 AM, ID: 15490632Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/15/05 12:20 PM, ID: 15493279Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/15/05 10:48 PM, ID: 15496100Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/16/05 12:07 AM, ID: 15496261Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]12/21/05 07:28 PM, ID: 15531732Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]12/23/05 04:07 AM, ID: 15541468Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091111-EE-VQP-89