Exploit:Java/CVE-2010-0094.DB

Question

This virus or trojan turned off my firewall and security center and all notices that would have told me this was happening. I reinstalled Window Vista Home Premium, saving a copy of Window.old. But after all that I still have this virus. It is not detected by Avast free. The antivirus I had before the clean ininstall, nor is it detected by Bitdefender, the paid version I have now. It is detected by Microsoft Safety Scanner, but can only be partially removed. Does anyone know how to completely get rid of it?

Answer 1

In that case just update Java and make sure latest update for Java been installed and run a full system scan with your Anti-Virus.

Answer 2

HI,

Thank you for your response.

In response to your questions.

 1: Why do you state it is only partially removed? What's the complete message you received?

This is because that is the result given by MSSafety Scanner. It states that it was partially removed and directed me here for a solution. I reinstalled the OS 3 days ago and every day I have run MSSafety Scanner and it is still there. A couple of times i ran MSSafety Scanner in Safe mode as that can sometimes work.

 I only have the latest version of JAVA on my machine. Jave 7 update 7. From what I have read I understand this virus once installed later connects with some other executable or peice of malware and turns off the Security center, firwall, etc/ which is what it did to my machine and then was hijacking my google search results. Although that could have been some other peice of malware. I can not be certain. When I would open a page it would change the link and open some other spam page instead. Not every time. Just the first page I opened in google.

So as for 2. I don't have any othe versions of Java other than the very latest version. The safety scanner will give me the same result. The bit defender doesn't even detect it, nor does Spybot search and destroy.

Answer 3

I don't have older versions of Java. I just did a reinstall of the OS.

Answer 4

... nor is it detected by Bitdefender, the paid version I have now...

Since you are actually using a 'paid version' of BitDefender AV I may suggest you ask BitDefender Support or post your question to their support forums here >  http://forum.bitdefender.com/index.php?showforum=132

[1]

BitDefender should've detected this as 'Java.Trojan.Exploit.Bytverify.Q'.

Exploit:Java/CVE-2010-0094.DB (as detected by MSSafety Scanner) is a Java based malware that exploits a vulnerability discussed in CVE-2010-0094. The vulnerability affects Java Runtime Environment (JRE) up to version 6 release 18 inclusive.

Why do you state it is only partially removed? What's the complete message you received?

It may happen sometimes that a legitimate website could be compromised or unwillingly host a malicious applet through advertising frames which could redirect to or host a malicious Java applet. It is not uncommon for antivirus software to detect malicious Java applets in a web browser's cache. It doesn’t necessarily mean that the system is compromised. Most of the time it reflects the fact that, at some stage, a webpage with a malicious applet had been visited and cached internally. To thwart such a notification it is often enough to purge the cache using the web browser's configurable security options.

[2]

On the other hand, this threat exploits a known vulnerability in the Java Runtime Environment (JRE). Keeping old and unsupported versions of Java on your system presents a serious security risk, but nowadays it's a known issue that just keeping Java installed (even at its latest and current version) is a threat itself.

I would therefore recommend you take immediate action as follows:

• Remove ALL Java versions from your system/browsers,
• Clear the Java cache,
• Reboot the machine and
• Run MS Safety Scanner (again) and/or any BitDefender Removal Tool suggested by your BitDefender Support.

Trust this Helps - Please report back to tell us how it went. Thanks.

___________________________________________________________________________________________________________

[1] http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Exploit%3aJava%2fCVE-2010-0094.DB#top

[2] http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/mse-advanced-membership-is-worthless-on-my/6a8ba6f7-eb27-4e4f-aecf-3f8c92518450?msgId=830636ff-2c6c-403f-9944-b5e33a9cf4bb

____________________________________________________________________________________________________________

Answer 5

It is vulnerability in Java, if you have old version of Java uninstall it. It is better to update your Java and install the latest version.

To remove older version of Java follow:

http://www.java.com/en/download/faq/remove_olderversions.xml