javacpl.cpl (Threat or False Positive?)

[Zaire]

Hello. I ran a quick scan upon coming back to my system (WinXP SP3 with Malwarebytes PRO, Zone Alarm, & Avast all doing their thing...) and javacpl.cpl came up as a threat. In the quarantine area the vendor was listed as trojan.Dropper.pws but upon doing a removal and restart (and another quick scan) nothing came up. Doing a basic search about this "threat" it seems to be legit. I'm not really sure what I should do as a result. Should I just leave the file in quarantine or add it to my ignore list as it seems to be related to Java?

Also in the log when this occured nothing seems to appear which is bizarre.

[MPB]

Hello

I've got exactly the same problem this day on a freshly installed PC.

After installing MalwareBytes, I've launched a Standard scan and I was really surprise that Malwarebytes have found one bad item :

Trojan.Dropper.pws on C:\WINDOWS\system32\javacpl.cpl

javacpl.cpl is the java icone in the Windows controle panel

I've download the last java version (29) directly from http://www.java.com/fr/download/manual.jsp just before installing it, so I think it's a false positive.

Could you confirm this, please.

Best regards

PS : I've used the last Malwarebytes version 1.51.2.1300 with the last database 8283.

[Zaire]

I was uninstalling old versions of Java and I got a warning from Malwarebytes that the above threat was trying to perform a malicious operation. So it does seem like this is indeed a false positive...any confirmation though would be appreciated.

[philtec]

The same thing is happening to me. (winXP home sp3)

This file is the java control panel.

It was last modified Oct 14,2011

If it had been corrupted with a trojan would not the mod date be yesterday? (Nov.30)

I run a scan first thing every day.

If I quarantine the file, the java app in my control panel is gone.

It is coming up as "trojan.Dropper.pws"

On AVG forum it also has come up:>>> http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=183088

I am almost sure that this is a false positive but would like to be sure before I quarantine it.

[ItsJustMe]

I got the same or similar detection:

c:\WINDOWS\system32\javacpl.cpl (Trojan.Dropper.pws) -> No action taken.

[0853a57b629eb44cff6950950ef2a55b]

Attached is a log and a zapped copy of the file.

Please note that neither http://www.virustotal.com/ nor http://virusscan.jotti.org/en pick up anything.

ItsJustMe

mbam-log-2011-12-01 (08-47-57).txt

javacpl.zip

[malfish]

also got some similar detections. I scanned all files on virustotal.com - no infections.

The scanner found infections in different directories in these files:

javacpl.exe

jaureg.exe

javacpl.cpl

[malfish]

just found this thread

http://forums.malwarebytes.org/index.php?showtopic=100946

So I can assume these items to be false positives, right?

[MPB]

With database version 8286 this problem does not appear any more.

Thank's

[malfish]

I can confirm this. thanks

[ConsumerReport]

I've just got the same threat. I wonder, with a .pws which I think must be some password tracker, if this isn't something that java uses to remember our passwords for java login windows. I know I use java for work to sign in to a website so I think this may be something related to those activities.