Bastionpoint Technology Posted December 1, 2011 ID:500045 Share Posted December 1, 2011 I had a false positive on the Java Updater this morning. Scan log attached.mbam-log-2011-12-01 (09-26-46).zip Link to post Share on other sites More sharing options...
sUBs Posted December 1, 2011 ID:500047 Share Posted December 1, 2011 That should be fixed by now. Please have mbam update itself. Link to post Share on other sites More sharing options...
ohsusana Posted December 1, 2011 ID:500063 Share Posted December 1, 2011 That should be fixed by now. Please have mbam update itself.Hi -- I had MBAM block javacpl.exe this morning, identifying the 'Trojan.Dropper' also -- is this related?Thanks... Link to post Share on other sites More sharing options...
Staff shadowwar Posted December 1, 2011 Staff ID:500065 Share Posted December 1, 2011 Yes. Please update and it should no longer be detected. If you deleted please restore from quarintine. Thanks Link to post Share on other sites More sharing options...
Lucie Posted December 1, 2011 ID:500113 Share Posted December 1, 2011 Hi -- I had MBAM block javacpl.exe this morning, identifying the 'Trojan.Dropper' also -- is this related?i had trojan dropper today in java and also in system restore when ive scanned early this afternoon. system restore is a false positive aswell? Link to post Share on other sites More sharing options...
sUBs Posted December 1, 2011 ID:500114 Share Posted December 1, 2011 Have you had mbam update itself yet? Link to post Share on other sites More sharing options...
Lucie Posted December 1, 2011 ID:500116 Share Posted December 1, 2011 i started scanning around lunch time. it was updated then. took 4 hrs to scan so i guess i need to update it again to stop the false positive below is what came upFiles Infected:c:\program files\common files\Java\java update\jaureg.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\program files\Java\jre6\bin\javacpl.cpl (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\program files\Java\jre6\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP58\A0007511.cpl (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP58\A0007512.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP58\A0007566.cpl (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP58\A0007582.rbf (Trojan.Dropper.pws) -> Quarantined and deleted successfully.c:\WINDOWS\SYSTEM32\javacpl.cpl (Trojan.Dropper.pws) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
sUBs Posted December 1, 2011 ID:500119 Share Posted December 1, 2011 No need to do a full scan. Just right navigate to the folder - c:\program files\Java\jre6\bin\Right click on it and have mbam scan it. Now that I see your log, there's no need to do the scan. I can confirm it's the same false positive which we fixed earlier. Link to post Share on other sites More sharing options...
Lucie Posted December 1, 2011 ID:500131 Share Posted December 1, 2011 No need to do a full scan. Just right navigate to the folder - c:\program files\Java\jre6\bin\Right click on it and have mbam scan it. Now that I see your log, there's no need to do the scan. I can confirm it's the same false positive which we fixed earlier.thanks alot. could you tell me what the system restore is and thats a f.p aswell along with the dropper in the windows Link to post Share on other sites More sharing options...
sUBs Posted December 1, 2011 ID:500134 Share Posted December 1, 2011 What system restore is: http://en.wikipedia.org/wiki/System_RestoreAnd yes, the files from System Restore were also part of the FP Link to post Share on other sites More sharing options...
fbriones Posted December 1, 2011 ID:500136 Share Posted December 1, 2011 Hi guys, malwarebytes found javacpl.exe as a trojan. but on this it is a false positive. I have already chose to quarentine it. should i restore it again from the qurentine folder??? Link to post Share on other sites More sharing options...
sUBs Posted December 1, 2011 ID:500138 Share Posted December 1, 2011 Yes, you should de-quarantine it Link to post Share on other sites More sharing options...
Lucie Posted December 1, 2011 ID:500139 Share Posted December 1, 2011 Thanks subs. Link to post Share on other sites More sharing options...
ohsusana Posted December 4, 2011 ID:501149 Share Posted December 4, 2011 Yes. Please update and it should no longer be detected. If you deleted please restore from quarintine. ThanksThank you! Everything is back to it's usual wonderful working order. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now