Help with Trojan please

Tatty_

I wonder if anyone could point me to another AV scan that I could do to double check whether a Trojan has been completely removed from my laptop. My OS is Vista and I use McAfee (yes, I know it's unpopular), supplemented with Malwarebytes.

I updated and ran Malwarebytes on Sunday, which didn't find anything. I forgot to do my weekly McAfee scan last week and when I ran it tonight, it found and deleted 3 threats in AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\52de297d-29f4548c

I updated and ran Malwarebytes again, which didn't find anything, but is there another scan that I could do to check whether I'm clear?

I am not very techie so please go easy on me.


Edit. Sorry, I should've said that I know that there is a thread on virus scanners above, but do I just pick any one? Is there one that is more appropriate to me?

waddler_8

Clear your Java cache.

http://www.java.com/en/download/help/plugin_cache.xml

This explains a bit more about the detections.

http://www.java.com/en/download/help/cache_virus.xml

(Russ will be along in a moment to tell you to remove Java completely. )

santer_2

You can run any or all of them, online virus scans can have the advantage of being updated more frequently

RussJK

waddler_8 wrote: »

(Russ will be along in a moment to tell you to remove Java completely. )

It does seem to be my mantra lately

You can view this thread for my reasons Tatty:
https://forums.moneysavingexpert.com/discussion/3527787

Ironically you'll need Java to run an online virus scan, as they are almost always programmed under Java.

marywooyeah

I actually clicked on this because I thought you were having technical issues with the other kind of trojan!

I've always used AVG on my pc and found that to be a good virus detector - have you tried that one?

Tatty_

Thank you for the replies.

1) I cleared Java cache like waddler said.

2) I have downloaded and run Panda active scan (should I now uninstall this?). Good news, it says Today you are not infected.

3) Russ, I will have a read of the linked thread.

4) Mary, I did consider AVG about 18mths ago, but thought that the consensus was that it slowed pc's quite considerably. Has this changed?

I'm off to do another scan just to be sure. Can anyone tell me whether the Trojan that I picked up was bad, obviously none are good, but could it have stolen anything eg passwords etc. McAfee stated:

Generic Exploit!bk
Generic.dx!baqw
Downloader.a!iu

waddler_8

These work by exploiting older, insecure versions of Java to download and install further malware.

If at the time you contracted these you had the very latest version of java installed and no older versions, then the exploits wouldn't have worked.

http://java.com/en/download/installed.jsp

Tatty_

waddler_8 wrote: »

These work by exploiting older, insecure versions of Java to download and install further malware.

If at the time you contracted these you had the very latest version of java installed and no older versions, then the exploits wouldn't have worked.

http://java.com/en/download/installed.jsp

Thing is I don't know how or when I picked them up. Nothing was flagged at the time. It's only come to light following the scan.

It seems that my Java is very out of date. I'm on version 6 update 7 :o Is it ok to just click on the link that it has given me to update it or should I uninstall and then start with a fresh download of the current version? I do keep windows and flash etc updated but it seems that I have overlooked Java.

RussJK

Uninstall first, then reinstall with the latest. Alternatively you can use Javara which automates it to some extent:
http://raproducts.org/wordpress/software

It's pretty common to see malicious code in the Java cache, even if it hasn't lead to an infection.

waddler_8

Tatty_ wrote: »

Nothing was flagged at the time. It's only come to light following the scan.

It's possible at the time you got them that Mcafee didn't have the signature definitions to recognise them as a threat. Definitions have been updated since and so Mcafee then recognised them as a threat when you ran your most recent scan.