Java Cache Virus Identified by Norton Antivirus for Mac - Please Advise

I have Norton Antivirus for Mac installed and I run updates for it daily, as well as keeping up with the Apple software updates. Last night I ran a virus scan and it showed a Trojan Horse virus in my Java cache, specifically a v1.0/jar/bof.jar file. I have tried finding exact information about this virus, but haven't been able to. Does anyone else know anything about it?

Norton Antivirus could not repair the file, and would not let me choose to delete it - so I deleted it manually using the Empty Securely trash feature. Was this okay, or did I make things worse?

The name of the Java cache file was bof.jar-69c92f24-687e6f3f.zip

Any help or advice would be greatly appreciated. Thank you.

MacBook, Mac OS X (10.5.8)

Posted on May 26, 2010 9:23 AM

Reply
17 replies

May 26, 2010 10:56 AM in response to Dever424

Welcome to Apple Discussions!

Try ClamXAV. Norton anti-virus is unreliable and often slows you down.
If there is still a problem, deleting the cache files in safe mode that are Java related probably wouldn't hurt. Which browser is using Java, or is this happening outside of a web browser? Safe mode is accomplished by booting the Mac with the shift key held down.

May 26, 2010 11:30 AM in response to a brody

Thank you for your response!

I just downloaded and installed ClamXAV and scanned my Mac with it - it detected no infected files, so I am going to assume that I am in the clear. I went ahead and deleted everything in my Java cache to be on the safe side - unfortunately I didn't do this in safe mode, but nothing strange has happened.

I am using Safari 4.0.5 and, aside from this virus notification when performing the routine virus scan with Norton Antivirus, I hadn't experienced a single problem when browsing the web.

If this was a legitimate virus, are there things I should be on the look out for that would indicate it's still somewhere in my system? Or would deleting those particular files have gotten rid of it?

I would be grateful for any more advice you might have.

May 26, 2010 11:35 AM in response to Dever424

Macs in general don't get viruses that affect the Mac OS X operating system. However, passing an infected file to a Windows operating system may result in infection of the Windows system. Java being a crossplatform development offers an intriguing loophole in this, which not being a security expert myself, I can't say if one would succeed as a trojan horse or not. As long as you aren't using Peer2Peer software, and aren't downloading from illegitimate websites for software, I doubt that you have a virus. If you aren't opening attachments from unknown sources, you are even safer.

Backup your data frequently*:

http://www.macmaps.com/backup.html

There are bigger things to worry about.

- * Links to my pages may give me compensation.

May 26, 2010 12:03 PM in response to Dever424

Last night I ran a virus scan and it showed a Trojan Horse virus


These is no such thing as a "Trojan Horse virus." Trojan Horse and virus are two different things. A Trojan Horse tricks you into installing and authenticating it. You install something with your password, and it comes with a nice trick inside. A virus -- and there are no viruses for Mac "in the wild" (that translated means no Mac viruses) can get in behind your back.

If it is a Trojan Horse, one way or the other you had to have installed it. You could run the free, demo version of MacScan (be sure to update after installing.)

http://macscan.securemac.com/

ClamX will scan only for known Windows viruses, which will not affect a Mac. That it didn't report anything doesn't mean much.

In addition, Norton has a terrible reputation for wrecking OSX. It is not recommended you use it. Many who have will tell you to uninstall it ASAP.

May 28, 2010 10:46 AM in response to WZZZ

Thanks for your reply. I downloaded the demo of MacScan and, after updating it, scanned my entire system - it showed no spyware found, so I guess I'm okay. I plan to buy MacScan and use it instead of Norton, though I've used Norton for almost a year and haven't had any problems with it until this warning.

"Trojan Horse - Virus" was how Norton identified it, so that should have told me something about how reliable it was. That, and the fact that searching for the file name on Symantec's site produced no results.

May 28, 2010 10:53 AM in response to a brody

Thanks again for your help. I don't use Peer2Peer software or download software except for Apple updates, but I had been using Java applications recently to view virtual tours on real estate websites and play the occasional games at legitimate sites. I wonder if perhaps Norton misidentified a legitimate Java application as something bad. I'm hardly a technology expert, so when any anti-virus program tells me there's a problem, I tend to panic.

May 31, 2010 8:13 AM in response to Dever424

Hi,

The exact same thing happened to me, and I couldn't find the file anywhere. I downloaded MacScan, but that didn't indicate any problems. Then I downloaded Mac EasyFind which allows you to find invisible files, and I found the file and deleted it manually.

Then just today, Norton indicated that I had another intrusion, and when I hit "repair" the window indicated that the files had been deleted. However, when I used the Mac EasyFind to double check, the files were still there and once again I had to delete them manually. It seems that Norton is able to detect intrusions on a Mac, but not remove them.

As I said, MacScan didn't find anything even though the files were there, so I really don't know what's best to do at this point.

May 31, 2010 5:00 PM in response to kohls

I've only had my Mac for a year and I'm not nearly as tech-savvy as the others on this board, but I'll tell you the exact steps I took to delete the files Norton identified on my machine.

To delete the file manually I took the following steps: Library>Caches>Java>Cache>Javapi>V1.0>Jar. I just dragged the file from here to my trash can and secure deleted it. There were three files with the same name and I got rid of all three. You can always search for a file by name using Finder>File>Find and go directly to it that way, but I like to get the location and then find it the long way to get a feel for where things are in the system.

By the way, just to be on the safe side I deleted ALL of the files in my Java cache. I haven't noticed any problems when surfing the web.

After I did that, and after reading various threads on the net concerning Java cache files, I took the precaution of deleting temporary Java files through Java Preferences: Finder>Go>Utilities>Java Preferences>Network. Click on "Delete Files". This was probably overkill since I had already manually deleted the files - but, like I said, I'm not that tech-savvy and I just wanted to be sure they were really gone!

I hope this helps you.

May 31, 2010 5:51 PM in response to Dever424

Dever --

Norton can't identify anything on a Mac.
In fact, it misidentifies stuff on a PC all the time, too.

You are frought with worry for nothing.
Please get that crapola off your Mac by uninstalling.
Then get ClamXav if you feel you absolutly will not sleep at night without an AV app.

You're deleting innocuous, harmless files.
I wouldn't let a Norton disk in my house, let alone on my Mac.
Just my two cents.

Jun 7, 2010 7:00 PM in response to Dever424

Not certain it's the same virus, but just recently, when trying to access a web site www.faithbiblecamp.com on either my Mac Book Pro or my iPod Touch, the address bar changes to http: and then I get hijacked? to http: , a swedish web hosting site that wants me to pay money to get rid of whatever's the problem. Web site works fine on my Windos PC and DROID smartphone so it seems to be OS related. Same in all browsers.

< Edited by Host >

Jun 7, 2010 7:11 PM in response to Susan Smith2

Could be your DNS is getting hijacked, redirected. Like dialing the right phone # but getting connected to a wrong one. From BDAqua:

"Try putting these numbers in Network>TCP/IP>DNS Servers, for the Interface (Ethernet, Airport, Dial up modem) you connect with...

208.67.222.222
208.67.220.220

Then Apply"

This will connect you to the Internet using servers from OpenDNS, which are faster than your ISP servers, and patched against these kinds of redirects. Also you might have downloaded and installed a Trojan Horse which is responsible for this.

Get the free DNS Changer Removal Tool from MacScan. It will scan your drive for at least one of the possible Trojans.

http://macscan.securemac.com/files/DNSChangerRemovalTool.dmg .

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Java Cache Virus Identified by Norton Antivirus for Mac - Please Advise

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.