Trojan in Java

Question

Is it true that there was a Trojan detected and that the Java update yesterday was to patch the hole?
So it begins.....

Answer 1

I haven't actually seen any documentation of such a variant beyond the fairly vague information on F-Secure's page, which does not describe exactly what the contents of the file placed in LaunchAgents are.
I think the following is the primary thread where this variant first appeard in these forums:
.rserv wants to connect to cuojshtbohnt.com
And if you look at page 3 of that (still growing) thread you will see a typical example of the launchagent.
However, it is obvious from reading posts from infected folks on forums like these that the instructions - no matter what they may be - are inadequate.
I think they are adequate to find the top-level insertions of the current trojans.  Not find every piece of code that may have been injected.
If there's a variant out ther that adds some control, injects its payload, and removes the control code, other than, for example, injecting code into browsers, then I haven't heard about it yet.
As are the numerous detection and removal tools based on those instructions.
I agree with that.
As that has become more clear, I have significantly modified my instructions, and have been considering pulling them altogether.
Which was my whole point of making you aware of this variant.
More and more, it's looking like anti-virus software is the best way to detect an infection.
To each his own.  Let's agree to disagree.
As for removal, that's similarly difficult for novice users.  I would have to say that if you can't find and remove the pieces on your own, without needing to rely on instructions, you shouldn't be trying.  Either erase the hard drive and reinstall everything from scratch, or get a tech guru who really knows what he/she is doing to take care of the removal for you.  Any other recommendation, at this point, is starting to look irresponsible.
There's a longish applescript floating around curently that attempts full detection and removal.  I just don't have the link handy at the moment.