Password Protected Items Spontaneously Appearing?

Ok, I had a clean scan on 10/7/10 and a week later it pops up tons of password protected items? They appear to be all Java related, and to my knowledge, no java update has been installed in the timeframe involved. Posted straight from the log:

<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\=>C:\WINDOWS\SYSTEM32\JAVA.EXE=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèXU Password-protected Not scanned (file was password-protected)

C:\Program Files\Java\jre6\bin\instrument.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍè $ Password-protected Not scanned (file was password-protected)

C:\Program Files\Java\jre6\bin\java.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèXU Password-protected Not scanned (file was password-protected)

C:\Program Files\Java\jre6\bin\javaw.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèU Password-protected Not scanned (file was password-protected)

C:\Program Files\Java\jre6\bin\jbroker.exe=>(ZIP Sfx g)=>|$:HL$@LËIÔÿ?O^ Password-protected Not scanned (file was password-protected)

C:\Program Files\Java\jre6\bin\jli.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍè,3 Password-protected Not scanned (file was password-protected)

C:\Windows\Installer\2d7621.msi=>(Embedded EXE)=>(ZIP Sfx g)=>(NO NAME) Password-protected Not scanned (file was password-protected)

C:\Windows\System32\java.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèXU Password-protected Not scanned (file was password-protected)

C:\Windows\System32\javaw.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèU

I realize that normally password protected items are of little concern, but as I see no reason why java would suddenly generate these 9 files concerns me.

Find more posts tagged with

Comments

johnfrench

I have also come across this problem. These look very suspicious but cannot find anything about it. please advise!

File: C:\Program Files\Java\jre6\bin\jli.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI‰??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈI‰I??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??A‰A??¶N??¶F?Áá??È3ÿA‰I?H‹Íè83 Password-protected Not scanned (file was password-protected)

File: C:\Program Files\Java\jre6\bin\jbroker.exe=>(ZIP Sfx g)=>|$:HL$@L‹ËI‹Ôÿ?O^ Password-protected Not scanned (file was password-protected)

File: C:\Program Files\Java\jre6\bin\javaw.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI‰??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈI‰I??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??A‰A??¶N??¶F?Áá??È3ÿA‰I?H‹Íè”U Password-protected Not scanned (file was password-protected)

File: C:\Program Files\Java\jre6\bin\java.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI‰??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈI‰I??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??A‰A??¶N??¶F?Áá??È3ÿA‰I?H‹ÍèTU Password-protected Not scanned (file was password-protected)

File: C:\Program Files\Java\jre6\bin\instrument.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI‰??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈI‰I??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??A‰A??¶N??¶F?Áá??È3ÿA‰I?H‹Íèœ$ Password-protected Not scanned (file was password-protected)

[-]Detailed Scan Summary

Cristi Raducu

Hi there,

What version of BitDefender do you have installed?

Also please post the entire scan log file.

RealWild1

Here you go: As shown, BitDefender Internet Security 2010.

BitDefender Log File

Product: BitDefender Internet Security 2010

Version: BitDefender Antivirus Scanner

Scanning task: System Scan

Log date: 10/30/2010 2:00:03 AM

Log path: C:\ProgramData\BitDefender\Desktop\Profiles\Logs\full_scan\1288422003_1_00.xml

Scan paths:

Path 0000: C:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: No

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 6417727

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 14

System plugins: 5

Unpack plugins: 10

Basic

Scanned items: 281043

Infected items: 0 (no infected items have been detected)

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (the scan options do not include scanning for rootkits)

Resolved items: 0 (no threats have been detected during this scan)

Unresolved items: 0 (no issues remained unresolved)

Advanced

Scan time: 01:12:33

Files per second: 64

Skipped items: 185229

Password-protected items: 9

Over-compressed items: 0

Individual viruses found: 0

Scanned folders: 27107

Scanned boot sectors: 5

Scanned archives: 8652

Input-output errors: 65

Scanned processes: 75

Infected processes: 0

Scanned registry keys: 3808

Infected registry keys: 0

Scanned cookies: 34

Infected cookies: 0

Not scanned objects:Object Path Reason: Final Status

C:\Program Files\Java\jre6\bin\jbroker.exe=>(ZIP Sfx g)=>|$:HL$@LËIÔÿ?O^ Password-protected Not scanned (file was password-protected)

C:\Windows\Installer\2d7621.msi=>(Embedded EXE)=>(ZIP Sfx g)=>(NO NAME) Password-protected Not scanned (file was password-protected)

djallaud

I have the same kind of problem with Bitdefender 2011 :

Chemin d'accès à l'objet Motif : État final

Fichier: F:\eMule\emule.exe=>(ZIP Sfx g)=>ÿÿïÿÿïÿÿïÿÿïÿÿïÿÿj?êïÿÿ ïÿÿQÎf¤ïÿÿ¼ïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??Â¼ïÿÿ?j?êïÿÿQÎ¸ïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??Â¸ïÿÿ?j?êïÿÿQÎÌïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??ÂÌïÿÿ?j?êïÿÿQÎÀïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??ÂÀïÿÿ?j?êïÿÿQÎÈïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??ÂÈïÿÿVèäüÿÿÄ?VÄïÿÿèÕüÿÿÄ?VÜïÿÿèÆüÿÿÄ?j?êïÿÿØïÿÿ?Q3ÿÎ½ÐïÿÿÿP4;Ãv?fêïÿÿf?¶üf?¶ÐÁç??ú½Ðïÿÿ?j?êïÿÿQÎÔïÿÿÿP4;Ãv?fêïÿÿf?¶Åf?¶ÑÁà??ÂÔïÿÿ9ÄïÿÿÜïÿÿu ;Ã?¯ Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: C:\Windows\System32\javaw.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèU Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: C:\Program Files\Java\jre6\bin\java.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèXU Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: C:\Program Files\Java\jre6\bin\javaw.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèU Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: E:\Cap Gemini 1990-2009\1998-Projets\SBF - Perfs\Présentations\Présent1301\PerfSBF.zip=>WINDOWS/TEMP/SyntheseSBF.ppt Ultra-compressé : Pas analysé (fichier ultra-compressé)

Fichier: C:\Windows\System32\java.exe=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍèXU Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: E:\Cap Gemini 1990-2009\1998-Projets\SBF - Perfs\Présentations\Présent2112\SyntheseSBF.zip=>SyntheseSBF.ppt Ultra-compressé : Pas analysé (fichier ultra-compressé)

Fichier: C:\Program Files\Java\jre6\bin\instrument.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍè $ Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Fichier: C:\Program Files\Java\jre6\bin\jli.dll=>(ZIP Sfx g)=>??È?¶F?Áâ?Áá??È?¶F?Áá?HcÉH?ÈI??¶F??¶N?Áá??È?¶F?Áá??È?¶F?Áá?HcÉH?ÈII??¶F,D?¶F-?¶L$CAÁà?D?À?¶F+Áá?AÁà?D?À?¶F*AÁà?D?À?¶D$D?Ð?¶D$B?ÈA?ÖA?ÐD??AA??¶N??¶F?Áá??È3ÿAI?HÍè,3 Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Clé de registre : C:\Windows\System32\java.exe=>(ZIP Sfx g)=>??Ãˆ?Â¶F?ÃÃ¢?ÃÃ¡??Ãˆ?Â¶F?ÃÃ¡?HcÃ‰H?ÃˆIÂ‰??Â¶F??Â¶N?ÃÃ¡??Ãˆ?Â¶F?ÃÃ¡??Ãˆ?Â¶F?ÃÃ¡?HcÃ‰H?ÃˆIÂ‰I??Â¶F,D?Â¶F-?Â¶L$CAÃÃ ?D?Ã€?Â¶F+ÃÃ¡?AÃÃ ?D?Ã€?Â¶F*AÃÃ ?D?Ã€?Â¶D$D?Ã?Â¶D$B?ÃˆA?Ã–A?ÃÂD??AÂ‰A??Â¶N??Â¶F?ÃÃ¡??Ãˆ3Ã¿AÂ‰I?HÂ‹ÃÃ¨XU Protégé par mot de passe Pas analysé (le fichier était protégé par mot de passe)

Cristi Raducu

To further investigate this situation please let me know what version of Java do you have running and also post here a sample of:

C:\Windows\System32\java.exe

C:\Program Files\Java\jre6\bin\jli.dll

C:\Windows\Installer\2d7621.msi

For security reasons you cannot attach files on this forum but you can upload them on a site such as www.sendspace.com and post here the download links.