Browser Exploitation w/ JAVA

[keyplyr]

Just for the hell of it, I ran a thorough AV scan and found an infected file in Windows\JAVA\jpi_cache\archive.jar

It was an unopened .zip containing several dummy files and Shinwow, a Trojan of the BlackBox class. I deleted it, ran AV again and came up clean; glad it never unzipped!

I run major brand AV software and firewall, use web-based, text-only email, and am behind a router. I never download or trade files, use Spybot to alert me of "undesirables" when browsing and still this sucker got in! My guess is from a website using JAVA servlets. I use IE6, with Sun's VJM.

This browser exploitation really annoys me, especially since I'm diligent. How about users who never pay attention? Wonder what they've got on board?

[dcrombie]

Does a .jar file have to be unzipped to run?

[ppg]

>My guess is from a website using JAVA servlets.

Why? Servlets process requests server side, and push the HTML response back over to you. You don't need to download anything for a servlet to do its job.

[keyplyr]

Does a .jar file have to be unzipped to run? - dcrombie

It wasn't a .jar file. Anyway, no telling how long it had been in my machine. Doesn't appear that it ever executed.

Why? Servlets process requests server side, and push the HTML response back over to you. You don't need to download anything for a servlet to do its job. - ppg

I understand how servlets work. What's your point?

[ppg]

I'm not making a point :-)

I'm just curious why you think it was from a site which runs servlets.

[drbrain]

A .jar file is a ZIP format archive with the extension 'jar'. It is completely possible (and likely) that the code in that jar file was run by the Java VM on your machine.

The Java VM understands and runs jar files, unpacking them into memory.

[keyplyr]

The .zip file was inside the archive.jar and had not been unzipped or run according to the log.

The reason I think my machine picked it up from a website running JAVA is because of the location of the infected file and the fact that I do not download, other than what the browser downloads in normal website viewing. First occurrence in 9 years though, guess I should feel lucky.

Anyway, all the more reason to use a browser that is not so deep rooted into the OS as IE is. Firefox is looking better all the time. Anyone know how to import IE's favorites? There was an option when I first installed Firefox, but now I don't see it, and the "import" feature doesn't seem to be able to.

[klogger]

Bookmarks => manage bookmarks

New window opens

File => import

[keyplyr]

klogger, as I said, that does not import favorites for IE

[klogger]

Yea, I think I was going mad when I replied, I noticed you said that after hitting submit. Did you export from IE OK?

In IE:

File => Import and Export (opens wizard)
Next => Export Favourites => follow the wizard

then as I said in above post. If you did do that then sorry I can't help and please ignore me :)

[keyplyr]

The first time I installed firefox, there was an import feature listed under files, which offered menus for importing favorites, history, passwords, cache etc from either Netscape or IE. I successfully retrieved IE favorites.

But firefox.exe was kept causing error alerts, so I uninstalled (also images were not displaying 100% of the time, especially here at WW.)

I've re-installed 3 separate times, each time being diligent in cleaning up any remaining files/folders. The option to import IE favorites has not displayed since. I've used the Windows installer as well as the zipped method.

I will likely wait until another build is offered and try my luck with that.

[keyplyr]

klogger - saw the part about the IE Wizard 'after' I posted. DL/d another Firefox copy, then opend IE. Although it did not detect the presence of Firefoix, I exported my favorites list to a temp file and then retrieved it with Firefox from the Bookmarks > File > Import that you mentioned, thanks. Just can't operate without those shortcuts!