Rootkit attempts though java update. Requesting patching help.

vpwin7

New member
Excuse typo in title.

On occasion I receive a java update notification. The updater is completely legitimate from what I can tell, however I do not have an update available. I have downloaded the latest version of Java manually, and when granting this other Java update permission Microsoft Security Essentials(MSE) states that there is a rootkit/trojan in a java install file, in my temp folders.

This Java update appears at the most random times, yesterday I was watching Hulu and it popped up. Just before this post I had uninstalled Java 6 Update 22 as I already have manually installed Java 7 installed. I'm wondering if this was likely a fake Java installation or a problem installation and if there is a good chance I got the bug, or is there something more specific I should look for besides typical virus sweeps?
 

My Computer

Computer Manufacturer/Model Number
Toshiba A505-S6960
OS
Windows 7 Home Premium x64
CPU
Intel Core 2 Duo T6500 / 2.1 GHz
Memory
4.0GB Dual-Channel DDR2 @ 398MHz (6-6-6-18)
Graphics Card(s)
Onboard - Intel GMA 4500MHD 128MB
Sound Card
Onboard

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
Ahh. My mistake, the link opened up in my NitroPDF and for some reason I though your attachement was the link to Nitro :D
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
Ahh. My mistake, the link opened up in my NitroPDF and for some reason I though your attachement was the link to Nitro :D
A good lesson has just been learned to being more careful in the future.
Happy Safe surfing.
 

My Computer

Computer Manufacturer/Model Number
Look in my Signature.
OS
Win7 H.Prem. 32bit+SP1
I use this instead of the normal Java. Never had any trouble. View attachment 207080

That is actually what I did awhile ago and I continued to get false update notices. I didn't uninstall other Java entries though since I figured it would overwrite them. After finding an older version of Java today in my control panel I uninstalled it; the fact that it was there seemed a little odd to me.

I haven't had any update pops lately but it only occurs every once in awhile and they're never legitimate.

Additionally, all scanners come clean. I only get alerts if I were to accept the Java update. I'm looking mostly for preventative measures. But since you suggest manually updating Java, I probably already chose the right path.
 

My Computer

Computer Manufacturer/Model Number
Toshiba A505-S6960
OS
Windows 7 Home Premium x64
CPU
Intel Core 2 Duo T6500 / 2.1 GHz
Memory
4.0GB Dual-Channel DDR2 @ 398MHz (6-6-6-18)
Graphics Card(s)
Onboard - Intel GMA 4500MHD 128MB
Sound Card
Onboard
Hi,

Depending on the rootkit, you might have to do a little more work to ensure your system isn't compromised. Did MSE name the rootkit in question?

Some background reading:

https://en.wikipedia.org/wiki/Rootkit

Regards,
Golden
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
Although the updater may LOOK legitimate, you still have to be careful. Virus writers take great care to craft things to look almost exactly like the real thing. If you know your system is up to date, it would be best to ignore these updaters. Any time you see an updater pop up, it's a good idea to go to the companys website & confirm they have indeed updated their software.

It might be a good idea for you to uninstall Java & then re-install it. Make sure you get it from the Java site and not another website offering it as a d/l.

There are several rootkit scanners available:

GMER - Rootkit Detector and Remover

Anti-rootkit utility TDSSKiller

Be sure to research the items the software finds as mistakes do happen & you can end up crippling your PC. The best thing would be to make a system image before you run these and delete any files.

http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell Hell oh Well
OS
Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10
CPU
Intel Core 2 Duo 2.93GHz
Memory
Not much with my ADHD
Graphics Card(s)
ATI Radeon HD 4350
Monitor(s) Displays
24" HDTV/Monitor
Screen Resolution
Blurry after a Scotch or 2
Hard Drives
1 HDD 250 GB, 1 HDD 1 TB, 3 - 1 TB Externals
Case
Don't get on my case...man :D
Cooling
I have an Air Conditioner & Diet Pepsi
Keyboard
Saitek Cyborg
Mouse
10 yr old MS optical mouse that still works
Internet Speed
Never fast enough
Antivirus
Various
Browser
Various
It's Java launching from the installed location. In the files it attempts to download contains the rookit. I don't know the literal name of it, but it's the one that puts the ZeroAccess malware on your computer. There's not much point in scanning, I know my system is clean at the moment. I think it was exploiting a vulnerability in an older Java version.
 

My Computer

Computer Manufacturer/Model Number
Toshiba A505-S6960
OS
Windows 7 Home Premium x64
CPU
Intel Core 2 Duo T6500 / 2.1 GHz
Memory
4.0GB Dual-Channel DDR2 @ 398MHz (6-6-6-18)
Graphics Card(s)
Onboard - Intel GMA 4500MHD 128MB
Sound Card
Onboard
I use this instead of the normal Java. Never had any trouble. View attachment 207080

Additionally, all scanners come clean. I only get alerts if I were to accept the Java update. I'm looking mostly for preventative measures. But since you suggest manually updating Java, I probably already chose the right path.
Its not advisable to use 2 different Java programs.
 

My Computer

Computer Manufacturer/Model Number
Look in my Signature.
OS
Win7 H.Prem. 32bit+SP1
The fact that you keep getting these pop up messages indicates a good possibility that something on your system has been compromised and is still attempting to get you to d/l a malicious software package.

It might be advisable to clean out all your older versions of Java.

JavaRa is a simple tool that does a simple job: it removes old and redundant versions of the Java Runtime Environment (JRE).

Usually older versions of programs are removed during the install of new versions but Sun (the owner of Java) has somehow decided not to do this. The result is that a number of different versions of the JRE may exist on your computer. These older versions potentially pose a threat to your sense of security due to the possible vulnerabilities or security holes that may exist in them.
JavaRa | Free System Administration software downloads at SourceForge.net
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell Hell oh Well
OS
Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10
CPU
Intel Core 2 Duo 2.93GHz
Memory
Not much with my ADHD
Graphics Card(s)
ATI Radeon HD 4350
Monitor(s) Displays
24" HDTV/Monitor
Screen Resolution
Blurry after a Scotch or 2
Hard Drives
1 HDD 250 GB, 1 HDD 1 TB, 3 - 1 TB Externals
Case
Don't get on my case...man :D
Cooling
I have an Air Conditioner & Diet Pepsi
Keyboard
Saitek Cyborg
Mouse
10 yr old MS optical mouse that still works
Internet Speed
Never fast enough
Antivirus
Various
Browser
Various
In order to help the original poster, the specific name and type of the rootkit infection would help greatly in order to clean up the infection. I am dropping Corrine a line via PM - Corrine is one of our anti-malware experts on this forum and has cleaned up more computers (including mine) than I can imagine ;-)
vpwin7: in the meantime, by all means do not use your computer for bank transactions, exchange of personal/confidential data or the like, and do not attempt to remove the malware on your own. You will need expert hands to guide you through this.
 

My Computer

OS
-
Thank you, Athene.

The fact that you keep getting these pop up messages indicates a good possibility that something on your system has been compromised and is still attempting to get you to d/l a malicious software package.

It might be advisable to clean out all your older versions of Java.

JavaRa is a simple tool that does a simple job: it removes old and redundant versions of the Java Runtime Environment (JRE).

Usually older versions of programs are removed during the install of new versions but Sun (the owner of Java) has somehow decided not to do this. The result is that a number of different versions of the JRE may exist on your computer. These older versions potentially pose a threat to your sense of security due to the possible vulnerabilities or security holes that may exist in them.
JavaRa | Free System Administration software downloads at SourceForge.net

FYI: Since SourceForce.net is still referencing RaProducts, I suggest going to the source for JavaRa. JavaRa | SingularLabs

Download links: Download JavaRa | SingularLabs

BTW, Fred deVries is still working on JavaRa, blog post about latest beta: Freð ðe Vries: [Released] JavaRa 2.0 Beta3

I use this instead of the normal Java. Never had any trouble. View attachment 207080

That is actually what I did awhile ago and I continued to get false update notices. I didn't uninstall other Java entries though since I figured it would overwrite them. After finding an older version of Java today in my control panel I uninstalled it; the fact that it was there seemed a little odd to me.

I haven't had any update pops lately but it only occurs every once in awhile and they're never legitimate.

Additionally, all scanners come clean. I only get alerts if I were to accept the Java update. I'm looking mostly for preventative measures. But since you suggest manually updating Java, I probably already chose the right path.

Hi, vpwin7.

Uninstalling old versions is important and, since you updated to Version 7, I suspect that the previous version was left behind. For some reason, the update to 7 does not remove JRE6.

Running JavaRa, as suggested by Borg 386 is an excellent idea. Generally, the "complaints" about Java are from the Java cache. If you haven't run JavaRa, I suggest you follow that advice.

If you use Firefox, it may also be necessary to remove the old Java Consoles. Make sure you already have the most recent version of Java Runtime Environment (JRE) using JavaRa.

Go to C:\Program Files > Mozilla Firefox > extensions. Delete the folders "{CAFEEFAC-0016-0000-xxxx-ABCDEFFEDCBA}", where xxxx is the number of the JRE-version. Keep the highest number as this is the latest version.

Next, download TFC by Old Timer from here (direct download): http://www.itxassociates.com/OT-Tools/TFC.exe

  • First, save any files as TFC will close ALL open programs including your browser!
  • Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
  • Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
  • Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

More info:
TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB).

Before running, it will stop Explorer and all other running applications. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.
-- TFC only cleans temp folders.
-- TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail.

TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

After restarting your computer, update MSE and do a full system scan. Let me know if MSE finds anything or if you get any additional pop-ups.
 

My Computer

OS
Windows 7 & Windows Vista Ultimate
Back
Top