Java Vulnerability - Trojan "Backdoor.Flashback"

Hello everyone,

Most of you may have already heard about the recent security exploit with Oracle's Java. The exploit is a continuation of the BackDoor.Flashback Trojan from September 2011. The virus is embedded in webpages and emails that pose as legtimate content. Once the link is clicked, the Java Script runs in the background and is completely transparent to the user. Usually the virus isn't noticeable until after a reboot of the system. You can read more about the BackDoor.Flashback here.

Oracle is set for Java Patches quarterly, however, Oracle released an unexpected emergency patch to fix only part of the problem on 9/4/2012 ("Oracle's Java Patch Not Enough to Stop Hackers"). So, Java still poses a vulnerability to systems. Oracle still has plans to implement a complete fix in its quarterly update this October 2012.

What does this mean for libraries? Unfortunately, we cannot remove/uninstall Java completely because Horizon is dependent upon it. However, disabling Java within your Web Browser is safe and will not disrupt service for most web applications. If a computer does not need Java, disable or uninstall Java until a complete patch is developed and released later this October 2012.

How to Uninstall Java

Windows 7 - Click Start > Control Panel > Programs/Uninstall a program. Select Java and Click Uninstall. Follow the on-screen prompts to complete the uninstall.

Windows XP - Click Start > Control Panel > double-click Add or Remove Programs.
In the Currently installed programs box, click Java, and then click Change or Change/Remove. Follow the on-screen prompts to complete the uninstall.

Here are quick instructions to disable Java in your Web Browser:

Google Chrome (all versions) - Open Chrome and type in the address bar/URL bar chrome://plugins/, and hit Enter. All of the plugins will be displayed; disable all Java plugins by clicking Disable. Close the web browser and re-open Chrome.

Mozilla Firefox (14 & 15) - Open Firefox and click Firefox Button or Tools > Add-ons. Select the Plugins panel. Select the Add-on (Java) you wish to disable. Click the Disable button. Click Restart if a pop-up window from Firefox requests for the web browser to restart or just close the browser and re-open Firefox.

Internet Explorer (IE 8 & 9) - Open Internet Explorer and click Tools > Manage Add-ons. In Toolbars and Extensions panel locate the Java Plug-In. Click the Disable button. Close the web browser and re-open Internet Explorer.

If you suspect that your computer is infected with a virus the safest thing to do is first disconnect the computer from the network temporarily by removing the Ethernet cable from the computer (this will help prevent the virus/infection from propagating). Then run a Full Scan with your Anti-Virus (Kaspersky) on the infected machine. After the Full Scan is complete, if any files are quarantined, review the files to see if they're legitimate. If the files are not, then delete all suspicious files.

If you have any questions please contact me.

Kind regards,
Shaun