ByteVerify again!

Hi All,

ByteVerify has reared its ugly head again for me. Every time that I run a full system check with AdAware, once a week after an up-date, NAV finds, and removes, the trojan Byte Verify. All the discussions about this subject in the past, and the vulnerability of Java to this infection, never really reached a conclusion.
All the advice seemed to be to disable the Java cache, but in the latest Java, 1.5.0, there is neither a cache tab, nor a browser tab, in the java control panel.
What do you all do about it? Is it a real threat? Why does Norton only find it during an AdAware scan?
Advice please.

Roger

 

Hi Roger,

It's not unusual for a file such as that to be found only when it's accessed, such as during an Ad-aware scan. A fully updated/patched/protected system may easily cache an infected file without it spreading into and infecting other areas of the system. While researching many of the infections that come accross this board, I encounter ALOT of infected web pages, cab files, etc, which often get cached in my TIF folder (or on my desktop or temp folder when I download it to check it out) yet do not infect my system per-say. Jar files are usually packed in a way that is similar to many viruses and sometimes makes them look like an infected file, and that may be what Norton is picking up on too. I have always used the JRE 1.4 series, which does have a cache tab within the Java Plug-in, and was unaware that the 1.5 series lacked it. You mentioned the Java Control Panel, rather than the plug-in. Are you referring to the Java Plug-in that lies within the Windows Control Panel or the Java Console within IE? In the 1.4 version Console, the clear cache option is X, and it's labled 'clear classloader cache'.

 

Thanks for the quick reply Dave.
I was referring to the Java plug-in in the Control Panel. In the IE Java Console I find this for 1.5.0:

Java Plug-in 1.5.0_02
Using JRE version 1.5.0_02 Java HotSpot(TM) Client VM
User home directory = C:\Documents and Settings\roger


----------------------------------------------------
c: clear console window
f: finalize objects on finalization queue
g: garbage collect
h: display this help message
l: dump classloader list
m: print memory usage
o: trigger logging
p: reload proxy configuration
q: hide console
r: reload policy configuration
s: dump system and deployment properties
t: dump thread list
v: dump thread stack
x: clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

But there is still no mention of Cache!

Roger

 

Open the console and type X. No need to even press enter.

 

Roger, in the Java 1.5.0 console under the "General" tab at the bottom there is the section "Temporary Internet Files" with a "Delete Files" and " Settings" buttons. That is where you delete the cached Java files (I don't know why Sun calls them TIF's, confusing ). Under settings the location of the files should be similar to: C:\WINDOWS\Application Data\Sun\Java\Deployment\cache. This is on a Win98SE system, may be different for XP.

 

Thanks for the info guys. I must confess that I tend to ignore Java until doesn't work correctly!

Roger

 

You can disable / enable caching for Java 1.5.0_02

Open Java Control panel - General tab View.
Click on "View Applets" button ... Displays "Java Applet cache viewer ".
Look at lower left of displayed view.
"Untick" Enabling caching ... "ok" out through all screens.

 

Thanks Dennis. I couldn't find that before, but it's done now.

Roger

 

Glad to help.