Securing Java

Content

Tip: keyboard shortcut Ctrl+F searches in the page contents

In this tutorial: How to secure Java Runtime Environment by removing older versions

Last modified: 2011-12-28 10:11:36 EET

Java Runtime Environment (aka Java, Java RE, Java SE, JRE) is a common plug-in in all web browsers. Sadly, it has become a major target for malware by 2010, surpassing even products of Microsoft and Adobe. It is mainly because of older versions still installed on users' computers and a unbelievably slow automatic updates schedule.
The first cause is often not even users' fault as Java installer does not remove most older versions automatically. Yep, that's right - many computers have 5 or more versions of Java installed! And that's what makes these PCs an easy target for hackers.
The second cause is again really strange. The automatic updates schedule of Java is like Brainiacs' episode of "Things... but very slowly". By default, the schedule activates the updater only once a month, and if the computer is not turned on at that time, there will be no checks at all! Hey Oracle, fix this now (not very slowly)!

To keep Java updated automatically, it is best to use the free program called Secunia PSI. You can also visit winhelp.us home page or see the Plug-in Check on the right to see if the installed version is up-to-date.

Downloading and installing the latest version of Java Runtime Environment

To get the latest version of JRE, go to Java download page and click the link that has "Offline" in it.
Java Runtime Environment download page, click the link that has "Offline" in it

After download is complete, launch the setup program. Click Install.
Java Setup, Welcome page. Click Install.

Now that's what I like - no series of Next buttons! Just click Close after the install is complete.
Java Setup, install Complete page. Click Close.

Cool, you now have the latest version of Java installed! If you have a brand new computer, you can stop now, but those who have used Java previously, should continue reading.

Removing older versions of Java Runtime Environment with JavaRa

As Java installer does not remove older versions of JRE, many computers have several versions of JRE installed as in an example below:
Windows XP, Add or Remove Programs. Note how many Java Runtime Environments are installed!

And that is not the worst case I've seen! You could now remove all these old versions by clicking Remove or Uninstall buttons (depending on which version of Windows you have), but this can be really slow and might require several restarts.

Luckily, there is a small program called JavaRa available that does the same job really quickly.

Click the Download button to the right of Windows Binary (.zip) line on the page.
Please note that while the version number of the program might remain the same for a longer time, its definitions for detecting Java installations still get updated. To achieve best results, it is recommended to download the program each time you want to run it.
JavaRa download page, click Download Windows Binary (.zip file).

After downloading is complete, extract the contents of the file to a folder you can find easily (e.g. a subfolder in My Documents).
In Windows XP, double-click the JavaRa.exe file to launch it.
In Windows Vista and 7, right-click the file and select Run as administrator.
Windows XP, Windows Explorer, double-click JavaRa.exe to launch JavaRa. Windows 7, Windows Explorer, right-click JavaRa.exe and select Run as administrator.

In Windows XP, Windows Explorer will open a Security Warning dialog because the file has no digital signature. Click Run.
In Windows Vista and 7, User Account Control will pop up. Click Continue or Yes.
Windows Explorer, Open File - Security Warning. Click Run.

JavaRa will ask for language the first time you run the program. Select English from the combo box and then click to select Remember my selection. Then click Select.
JavaRa, Language Selection dialog on first run. Select English from the combo box and then click Remember my selection box. Then click Select.

Now click Remove Older Versions:
JavaRa main window. Click Remove Older Versions to delete all older Java Runtime Environment installations.

Click Yes in the confirmation dialog.
JavaRa warning about removing older versions of JRE. Click Yes.

JavaRa will then remind you that Internet Explorer should be closed during the JRE removal process. Close all Internet Explorer windows and click OK.
JavaRa warning about open Internet Explorer windows. Close all Internet Explorer windows and then click OK.

Old versions of Java will then be removed. You will see a deletion window popping up from time to time during the process. Do not click Cancel!
JavaRa deleting old versions of Java Runtime Environment. Stand by and do not click Cancel.

Please note that under certain circumstances, JavaRa might crash during the process. Run the program again and click Remove old versions to complete the cleanup.

After the removal process is complete, a dialog with a list of removed versions will pop up. Click OK.
JavaRa, removal of old JRE versions complete. Click OK.

JavaRa will then inform you that a log file has been created and that the file will now open. Click OK.
JavaRa, removal of old JRE versions complete, a log file will open. Click OK.

Close the log file as it contains mostly technical stuff.
JavaRa log file open in Notepad. Close it.

And that's it! Close JavaRa.
Your Java Runtime Environment is now up-to-date and all older versions of it have been removed! To continue being on the safe side, learn about Microsoft EMET for protecting the JRE from security threats.