Spyware Warrior

[fcukdat]

For attention of all Sun Java users

A very recently discovered exploit by our very own Calamity Jane
has riddled a lot of PC's recently>>>
Sun Java update exploit=Vundo/Winfixer/Virtumonde infection
http://www3.dslreports.com/forum/remark,14738046~start=0

In short>>>

If you have Sun java on your PC,check the add/remove software part of control panel to see which version(s) you have installed.
The only one required is the latest version 1.5.0_06
Download here>>>
http://www.java.com/en/download/manual.jsp

All others should be uninstalled immediatley since they are at risk from this recently discovered exploit and also surplus to requirement.

Editorial Note by CalamityJane: I did not "discover" this vulnerability - I've just been spreading the word. Two fellow MS MVPs (Steve Wechsler aka MowGreen & Sandi Hardmeier) have been after Sun Microsystems on this since last February 2005. Sun acknowledged back then that older (vulnerable) versions on a system can be called up by Malware and exploit the system, but have failed to do anything about it to date
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[fcukdat]

Here is one removal solution that is effective against some variants of the infection(Not all )

Q: How Do I Remove Trojan Vundo/Winfixer/Virtumonde?

A: A: VirtuMonde is an adware program that downloads and displays popup advertisements. It may also hijack the browser to unwanted advertising related sites.

There is a free removal tool offered by Symantec here:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.removal.tool.html

or here:
http://www.majorgeeks.com/Symantec_Trojan.Vundo_Removal_Tool_d4430.html

Follow the removal directions on the download page. Run the tool twice with a reboot inbetween to be sure it got everything.

*You will still need to post a HJT log for inspection by an expert because there are some variants that this tool dose not remove so other tools/solutions will have to be utilised.
**Also any remnents of removed infection and other malware might be present and will also need removing.

HJT download>>>
http://spywarewarrior.com/files/hijackthis.zip

HJT help forums>>>
http://www.spywarewarrior.com/viewforum.php?f=5

HTH

Ps Huge kudo's and big thanks to Calamity Jane for picking up on this exploit.CJ kicks malware butt yet again

http://calamityjanevirusmd.com/index.php?option=com_frontpage&Itemid=1
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[fcukdat]

Just to clarify about older versions of Sun Java,
They will appear in the control panel>>>add/remove as/or like

J2SE Runtime Environment 5.0 - 97.99Mb
J2SE Runtime Environment 5.0 Update 2 - 143.00Mb
J2SE Runtime Environment 5.0 Update 4 - 144.00Mb
J2SE Runtime Environment 5.0 Update 5 - 151.00Mb
Java 2 Runtime Environment, SE v1.4.2_04 - 130.00Mb

or as illustrated here


It is crucial to stress that all versions need to be uninstalled with the exception of the latest version 1.5.06 which will be listed in the add/remove as
J2SE Runtime Enviroment 5.0 Update 6
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[fcukdat]

Here's what Sun java have to say about the problem

shortened link
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[fcukdat]

*Additional Variant removal update

It has been found that some variants can be removed By Webroot SpySweeper that the Symantec removal tool is ineffective against.

SpySweeper is available on a 14day free trial and can be downloaded from>>>
http://majorgeeks.com/Spy_Sweeper_d3263.html

*Remember it is still crucial to post a HJT log for inspection since other malware may still be on your system

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[thejynxed]

I tried removing previous versions and get an odd "Installer not found" error.
_________________
"I stab thee with a rusty spork."

[fcukdat]

[thejynxed]

I just used jv16powertools to do it. Windows Add/Remove kept looking for an .msi file, couldn't find it, etc. etc. Powertools had no trouble removing the software. Go figure.
_________________
"I stab thee with a rusty spork."

[fcukdat]

Sun Java have updated there warning for this exploit to Critical>>>

http://secunia.com/advisories/17748/


But they still will not reccomend people remove earliar versions.

A suggestion to any victims of WinFixer/Vundo/Virtumondo who have earliar versions of Sun Java software and more than probable victims of this exploit on their PC would be to contact the company and thank them for your infection
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[Webroot_SS]

[CalamityJane]

[fcukdat]

Sunn Java within 24hrs of releasing security patch's have now released software updates

http://java.sun.com/j2se/1.5.0/download.jsp


The madness still continues since Sunn are still not instructing people to uninstall the earliar vulnerable versions from people PC's.

Thanks CJ for additional info supplied,its plain madness to think that this exploit has been known of since Feb2005 and yet Sunn take no effective action

[Nick]

Edited first post to reflect that 1.5.0_06 is the current version of java.
_________________
Nick's Security Ticker

[fcukdat]

[fcukdat]

Ok people's since the Symantec tool is not always effective and finding a working version of SpySweeper that dose'nt cost $'s to see it action here is a free canned removal solution for most variants of Vundo/Virtumondo/Winfixer>>>
http://wiki.castlecops.com/Malware_Removal:_Virtumundo


*But please remember to post an HiJackThis log for inspection by a malware removal expert since there is a chance that you have more malware on your system that is'nt related to Vundo.
http://www.spywarewarrior.com/viewforum.php?f=5
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

[fcukdat]

Eventually Sun Microsystems put their hands up to 7 holes in their earliar software>>>

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102170-1

Great commentary here>>>
http://www3.dslreports.com/forum/remark,15429033

Only took them a whole year to publicly acknowledge it
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html