Buddel Posted December 5, 2010 ID:356731 Share Posted December 5, 2010 MBAM just popped up, telling me java.exe is a trojan downloader. Here's the log:DETECTION: C:\PROGRAM FILES\Java\jre6\bin\java.exe - Trojan.DownloaderI'm using the latest version of MBAM, database version 5249. I'm sure this is a false positive. Would be great if you could fix it soon. Thanks in advance. Link to post Share on other sites More sharing options...
JemTheWire Posted December 5, 2010 ID:356735 Share Posted December 5, 2010 MBAM just popped up, telling me java.exe is a trojan downloader. Here's the log:DETECTION: C:\PROGRAM FILES\Java\jre6\bin\java.exe - Trojan.DownloaderI'm using the latest version of MBAM, database version 5249. I'm sure this is a false positive. Would be great if you could fix it soon. Thanks in advance.I have just got that too! Using database5249, again, same as you.I uninstalled Java and ran MalwareBytes again and it was clear. After re-installing Java and completing a new scan, it still reported "Trojan Downloader" in java.exeNeed I be worried, or is this a false positive? Link to post Share on other sites More sharing options...
Nukesforbreakfast Posted December 5, 2010 ID:356736 Share Posted December 5, 2010 Same here. Equally sure these are false positives.Malwarebytes' Anti-Malware 1.50www.malwarebytes.orgDatabase version: 5249Files Infected:c:\Windows\System32\java.exe (Trojan.Downloader) -> No action taken.c:\Windows\SysWOW64\java.exe (Trojan.Downloader) -> No action taken. Link to post Share on other sites More sharing options...
eallison Posted December 5, 2010 ID:356738 Share Posted December 5, 2010 Ditto. Just updated and had these both pop. I had them removed/quarantined, but seeing that others had the same results, I am wondering if I did the right thing.If they are quarantined, I can restore (if they are false positives), correct?Thanks so much! Link to post Share on other sites More sharing options...
kjz Posted December 5, 2010 ID:356741 Share Posted December 5, 2010 Seems to be a FP: java.exe ---> Trojan DownloaderVirustotal scan says the file is clean:http://www.virustotal.com/file-scan/report.html?id=496699e537c06e7b431ea3b766cd13eb6e9ece7c1845e7cba8cbc4b54bfbd5af-1291577682mbam_log_2010_12_05__20_47_00_.zipjava.zip Link to post Share on other sites More sharing options...
Herewegoagain Posted December 5, 2010 ID:356744 Share Posted December 5, 2010 Sames for me, detected.java runtime update 22. Link to post Share on other sites More sharing options...
MAM Posted December 5, 2010 ID:356747 Share Posted December 5, 2010 I think this is by me the same:MBAM 1.50 developer Log:Objects scanned: 186136Time elapsed: 35 minute(s), 8 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 2Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\programme\Java\jre6\bin\java.exe (Trojan.Downloader) -> No action taken. [1b661ff5e21e6799c603f66220e02dd3]c:\WINDOWS\system32\java.exe (Trojan.Downloader) -> No action taken. [82ffc351649c5ca4339678e0e21ed62a]The result Link to post Share on other sites More sharing options...
MAM Posted December 5, 2010 ID:356748 Share Posted December 5, 2010 @ kjzPlease make a full scan with Malwarebytes' Anti-Malware 1.50 MAM Link to post Share on other sites More sharing options...
OwNt Posted December 5, 2010 ID:356754 Share Posted December 5, 2010 MBAM database 5249 is indeed reporting the newest version of java.exe (MD5: 51a850830cb841fbe5b90142bcc6b854) as Trojan.Downloader. Link to post Share on other sites More sharing options...
mynorgeek Posted December 5, 2010 ID:356756 Share Posted December 5, 2010 12:14:06 (null) DETECTION C:\Program Files\Java\jre6\bin\java.exe Trojan.Downloader QUARANTINEThis happened while attempting to play the msn game TextTwister (zone.msn.com/texttwist)Once there, click on Link to post Share on other sites More sharing options...
cahosrahneveloza Posted December 5, 2010 ID:356757 Share Posted December 5, 2010 Same issue as with the others who posted earlier, malwarebytes detecting java.exe as a trojan downloader. Probably just a false positive. Link to post Share on other sites More sharing options...
MAM Posted December 5, 2010 ID:356758 Share Posted December 5, 2010 MBAM database 5249 is indeed reporting the newest version of java.exe (MD5: 51a850830cb841fbe5b90142bcc6b854) as Trojan.Downloader....as a falsepositive, or what ?MAM Link to post Share on other sites More sharing options...
OwNt Posted December 5, 2010 ID:356761 Share Posted December 5, 2010 ...as a falsepositive, or what ?MAMYes, as a false positive. Link to post Share on other sites More sharing options...
guygo Posted December 5, 2010 ID:356764 Share Posted December 5, 2010 Seems to be a FP: java.exe ---> Trojan DownloaderVirustotal scan says the file is clean:http://www.virustotal.com/file-scan/report.html?id=496699e537c06e7b431ea3b766cd13eb6e9ece7c1845e7cba8cbc4b54bfbd5af-1291577682Confirmed here, too. Same files (c:\windows\system32\java.exe along with the one in "SysWOW"), same Trojan.Downloader report. Happens with DB 5249, doesn't with DB 5247.guylauten Link to post Share on other sites More sharing options...
nosirrah Posted December 5, 2010 ID:356772 Share Posted December 5, 2010 Sorry about this, fixed in the next update. Link to post Share on other sites More sharing options...
Buddel Posted December 5, 2010 Author ID:356776 Share Posted December 5, 2010 Just downloaded the latest database version - FP is fixed. Thank you. Link to post Share on other sites More sharing options...
glenski Posted December 5, 2010 ID:356782 Share Posted December 5, 2010 Hi everyone! As you all probably know this is a false positive as i have also uploaded this file to virus total also! Also file is digitally signed too! relax regards glenski Link to post Share on other sites More sharing options...
mynorgeek Posted December 5, 2010 ID:356786 Share Posted December 5, 2010 Sorry about this, fixed in the next update.Thank you, Bruce.Great response time. Link to post Share on other sites More sharing options...
kjz Posted December 5, 2010 ID:356790 Share Posted December 5, 2010 With DB update from 5249 to 5250 the FP was fixed, thanks! Link to post Share on other sites More sharing options...
nosirrah Posted December 5, 2010 ID:356792 Share Posted December 5, 2010 I am really sorry about this one, let me know if anyone still has this post 5250. Link to post Share on other sites More sharing options...
Herewegoagain Posted December 5, 2010 ID:356797 Share Posted December 5, 2010 fixed!! fast update Link to post Share on other sites More sharing options...
JemTheWire Posted December 5, 2010 ID:356813 Share Posted December 5, 2010 Fixed here with 5252 update. Thanks. Link to post Share on other sites More sharing options...
MAM Posted December 5, 2010 ID:356818 Share Posted December 5, 2010 Thanks, for fixing this issue MAM Link to post Share on other sites More sharing options...
eallison Posted December 5, 2010 ID:356819 Share Posted December 5, 2010 Fixed here as well. Restored from quarantine, updated, ran a new scan, and no detections.Thanks so much!Take it and run, Link to post Share on other sites More sharing options...
guygo Posted December 5, 2010 ID:356836 Share Posted December 5, 2010 Sorry about this, fixed in the next update.Thanks for the instant fix! Very cool, folks Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now