I examined the java a little more. It does have a (mild) virus (trojan, whatever) in it, JAVA_BYTEVER.A, which exploits a flaw in the java VM on internet explorer and could potentially allow any code to be run but probably just changes a few explorer settings (like home page and search page). If your java VM is 3810 or later then the flaw is fixed and the code does nothing (run JView in a command window to get the version. It'll be something like 5.00.3810). A current virus checker should pick it up anyway.