Java class packages

Two related questions here. Hope they are not OT

Last night I deleted all those java class packages and all the other files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I have
GoBack, so I can restore everything the way it was.) So far, no problem do
anything I normally do. What is all this stuff and do I really need it?


Also, invariably, files that AVG antivirus identifies as trojans or viruses
end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
details - It identifies these are viruses that exploit a vulnerability in IE
or Java that changes my home page. (I'm sure I've downloaded a critical
Windows Update that fixes the vulnerability.) But what are these things and
where to they come from. AVG doesn't detect them on the way in (every AVG
module is active) but only on a scan. Are they really malicious? Last night
I had five (one identified as a trojan, four as virus - "java verify" or
something like that). Anyone know? Every once in a while I stumble on a web
site that asks me if I want to reset my home page to that site (I say "No"
and there's never any problem). Could these be coming from those sites?

Thanks
--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.

From: "Anthony Giorgianni" d

| Two related questions here. Hope they are not OT
|
| Last night I deleted all those java class packages and all the other files
| that are in my C:\Windows\Java\Packages folder. I also deleted all the
| associated registry entries. Is this okay or did I do a bad thing? (I have
| GoBack, so I can restore everything the way it was.) So far, no problem do
| anything I normally do. What is all this stuff and do I really need it?
|
| Also, invariably, files that AVG antivirus identifies as trojans or viruses
| end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
| details - It identifies these are viruses that exploit a vulnerability in IE
| or Java that changes my home page. (I'm sure I've downloaded a critical
| Windows Update that fixes the vulnerability.) But what are these things and
| where to they come from. AVG doesn't detect them on the way in (every AVG
| module is active) but only on a scan. Are they really malicious? Last night
| I had five (one identified as a trojan, four as virus - "java verify" or
| something like that). Anyone know? Every once in a while I stumble on a web
| site that asks me if I want to reset my home page to that site (I say "No"
| and there's never any problem). Could these be coming from those sites?
|
| Thanks
| --
| Regards,
| Anthony Giorgianni
|
| The return address for this post is fictitious. Please reply by posting back
| to the newsgroup.
|

I can't answer the first part but here's how to deal with Java Script infectors.

1) Dump the contents of your IE cache -
Start -- settings -- control panel -- Internet options -- delete files

2) Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools -- Options -- Privacy -- Cache -- Clear

3) Dump the contents of your Sun Java cache -
Start -- settings -- control panel -- Java applet -- cache -- clear
or
Start -- settings -- control panel -- Java applet -- general -- settings --
delete files

4) Download the TrendMicro Sysclean Front End

Download the utility SYSCLEAN_FE at the following URL --
http://www.ik-cs.com/got-a-virus.htm
SYSCLEAN_FE automates the download and execution process of the Trend Sysclean Package.
Direct URL --
http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe

5) Execute; SYSCLEAN_FE.EXE
Choose; Unzip
Choose; Close


Execute; c:\sysclean\SYSCLEAN_FE.BAT
{ or Double-click on 'SYSCLEAN_FE Link' in c:\sysclean }
when you get to the menu exit the utility so you can boot into Safe Mode.

6) Reboot your PC into Safe Mode and shutdown as many applications as possible.

7) Execute; c:\sysclean\sysclean.com
Let SYCLEAN.COM scan your computer.

8) Restart your PC and perform a "final" Full Scan of your platform
Execute; c:\sysclean\SYSCLEAN_FE.BAT
{ or Double-click on 'SYSCLEAN_FE Link' in c:\sysclean }
This time, choose to execute SYSCLEAN.COM from the menu.


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

"Anthony Giorgianni"
d wrote:

Two related questions here. Hope they are not OT

Last night I deleted all those java class packages and all the other files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I have
GoBack, so I can restore everything the way it was.) So far, no problem do
anything I normally do. What is all this stuff and do I really need it?

If you never use a page that includes a Java applet, then you'll never
notice anything. But if you do go to a Java page, it won't work. I'd
bring all that Java stuff back immediately.

--
Tim Slattery
MS MVP(DTS)

Anthony Giorgianni wrote:
Last night I deleted all those java class packages and all the other files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I have
GoBack, so I can restore everything the way it was.) So far, no problem do
anything I normally do. What is all this stuff and do I really need it?

Why did you do this?

Also, invariably, files that AVG antivirus identifies as trojans or
viruses
end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
details - It identifies these are viruses that exploit a vulnerability in
IE
or Java that changes my home page. (I'm sure I've downloaded a critical
Windows Update that fixes the vulnerability.)
snip

1. Check in at Windows Update.

2. See David Lippman's reply.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

I deleted this stuff because a lot of it had old dates. I hate running java
anything. Also, since I was getting virus hits on the other folder, I wasn't
sure where all these classes came from. It was tons of MBs. Actually, I
moved it all to "recycle" to see if anything would be affected, but I forgot
and emptied my recycle been while doing a cleanup with Easy Cleaner.

I'll out it all back now. But I'm still wondering if I need all this stuff.
What do these java class things do?


--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.



"PA Bear" wrote in message
...
Anthony Giorgianni wrote:
Last night I deleted all those java class packages and all the other
files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I
have
GoBack, so I can restore everything the way it was.) So far, no problem
do
anything I normally do. What is all this stuff and do I really need it?

Why did you do this?

Also, invariably, files that AVG antivirus identifies as trojans or
viruses
end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
details - It identifies these are viruses that exploit a vulnerability
in
IE
or Java that changes my home page. (I'm sure I've downloaded a critical
Windows Update that fixes the vulnerability.)
snip

1. Check in at Windows Update.

2. See David Lippman's reply.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

Oh, I meant to add that I go to Windows update all the time. I don't have
any more critical updates available.


--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.
"PA Bear" wrote in message
...
Anthony Giorgianni wrote:
Last night I deleted all those java class packages and all the other
files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I
have
GoBack, so I can restore everything the way it was.) So far, no problem
do
anything I normally do. What is all this stuff and do I really need it?

Why did you do this?

Also, invariably, files that AVG antivirus identifies as trojans or
viruses
end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
details - It identifies these are viruses that exploit a vulnerability
in
IE
or Java that changes my home page. (I'm sure I've downloaded a critical
Windows Update that fixes the vulnerability.)
snip

1. Check in at Windows Update.

2. See David Lippman's reply.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

Hello David

I started that process but unfortunately I'm on dialup, and the combined
downloads are over 10 MB, which would take me until I'm dead.

Neither AVG or Ad-Aware is showing anything on my machine. So I'm assuming
that these files (all zipped by the way) were sent to me but that nothing
actually was used or installed. (Deleting the jpl cache stuff per your
instructions got rid of the malicious files). Is there any reason to believe
there is bad stuff on my machine the either AVG or Ad-Aware is not finding?
Downloading that SYSCLEAN stuff really is impractical given my online speed.
Plus I believe I have long ago downloaded stuff from Windows Update to
prevent those files from doing anything anyway.

Thanks.


--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.
"David H. Lipman" wrote in message
...
From: "Anthony Giorgianni"
d

I can't answer the first part but here's how to deal with Java Script
infectors.

1) Dump the contents of your IE cache -
Start -- settings -- control panel -- Internet options --
delete files

2) Dump the contents of the Mozilla FireFox Cache { if you use
FireFox }
Tools -- Options -- Privacy -- Cache -- Clear

3) Dump the contents of your Sun Java cache -
Start -- settings -- control panel -- Java applet -- cache --
clear
or
Start -- settings -- control panel -- Java applet --
general -- settings --
delete files

4) Download the TrendMicro Sysclean Front End

Download the utility SYSCLEAN_FE at the following URL --
http://www.ik-cs.com/got-a-virus.htm
SYSCLEAN_FE automates the download and execution process of the Trend
Sysclean Package.
Direct URL --
http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe

5) Execute; SYSCLEAN_FE.EXE
Choose; Unzip
Choose; Close


Execute; c:\sysclean\SYSCLEAN_FE.BAT
{ or Double-click on 'SYSCLEAN_FE Link' in c:\sysclean }
when you get to the menu exit the utility so you can boot into
Safe Mode.

6) Reboot your PC into Safe Mode and shutdown as many applications as
possible.

7) Execute; c:\sysclean\sysclean.com
Let SYCLEAN.COM scan your computer.

8) Restart your PC and perform a "final" Full Scan of your platform
Execute; c:\sysclean\SYSCLEAN_FE.BAT
{ or Double-click on 'SYSCLEAN_FE Link' in c:\sysclean }
This time, choose to execute SYSCLEAN.COM from the menu.


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

I restored using GoBack and deleted the jpl stuff using David's method. Now
I have 22 MB of zipped files (and a folder with about 12 .dat files) in my
classes folder.

Thanks.


--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.


"PA Bear" wrote in message
...
Anthony Giorgianni wrote:
Last night I deleted all those java class packages and all the other
files
that are in my C:\Windows\Java\Packages folder. I also deleted all the
associated registry entries. Is this okay or did I do a bad thing? (I
have
GoBack, so I can restore everything the way it was.) So far, no problem
do
anything I normally do. What is all this stuff and do I really need it?

Why did you do this?

Also, invariably, files that AVG antivirus identifies as trojans or
viruses
end up in my Windows\.jpi_cache/jar folder. AVG doesn't have a lot of
details - It identifies these are viruses that exploit a vulnerability
in
IE
or Java that changes my home page. (I'm sure I've downloaded a critical
Windows Update that fixes the vulnerability.)
snip

1. Check in at Windows Update.

2. See David Lippman's reply.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

From: "Anthony Giorgianni" d

| Hello David
|
| I started that process but unfortunately I'm on dialup, and the combined
| downloads are over 10 MB, which would take me until I'm dead.
|
| Neither AVG or Ad-Aware is showing anything on my machine. So I'm assuming
| that these files (all zipped by the way) were sent to me but that nothing
| actually was used or installed. (Deleting the jpl cache stuff per your
| instructions got rid of the malicious files). Is there any reason to believe
| there is bad stuff on my machine the either AVG or Ad-Aware is not finding?
| Downloading that SYSCLEAN stuff really is impractical given my online speed.
| Plus I believe I have long ago downloaded stuff from Windows Update to
| prevent those files from doing anything anyway.
|
| Thanks.
|
| --
| Regards,
| Anthony Giorgianni


That's your decision. But... AVG has misssed *many* infectors so the fact that it doesn't
now doesn't mean much and Ad-aware SE is for non-viral malware and Sysclean is for viral
malware (Trojans included) so that doesn't mean much either. Using Sysclean can fings
things both AVG missed and Ad-aware would never find in the first place.

As for the Critical Updates. That just means that Exploit code won't take advantage known
vulnerabilities that have been patched. However, you could have been infected prior to
being patached and AVG signature were released.

Good luck !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Thanks David

I hope to be getting cable internet soon and will try Sysclean again then.

Thanks.


--
Regards,
Anthony Giorgianni

The return address for this post is fictitious. Please reply by posting back
to the newsgroup.
"