Unable to access or use javaw.exe since flagged as exploit and blocked

[Hachuurui]

The java executable was flagged as ransomware and now even as the windows administrator account, I have 0 access to the file to remove and reinstall it. It is acting as if all permissions have been stripped. How do I fix this?

[Hachuurui]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 8/19/20
Protection Event Time: 7:22 PM
Log File: e6128a68-e272-11ea-baf8-04d9f57c2e40.json

-Software Information-
Version: 4.1.2.73
Components Version: 1.0.1003
Update Package Version: 1.0.28741
License: Premium

-System Information-
OS: Windows 10 (Build 18362.1016)
CPU: x64
File System: NTFS
User: System

-Ransomware Details-
File: 1
Malware.Ransom.Agent.Generic, C:\Users\polar\.ftba\bin\runtime\jre-x64\bin\javaw.exe, Blocked, 0, 392685, 0.0.0, 7b23b0aab68e65b93bb6477f05999574, 32546ecf1236769d2d777331f90282fb97589bec75da11c8e727d61d3d4c988a

(end)

[AdvancedSetup]

Hello @Hachuurui

This would just be a temporary block. Restart the computer and then exit out of Malwarebytes temporarily and run the following please.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

[Hachuurui]

attached are the files

Addition.txt FRST.txt

[AdvancedSetup]

You have some old compromised versions of Java on the computer.

I would highly recommend that you uninstall all versions. Then if you really have to have Java install the latest version and keep it up to date at all times. Uninstall older versions.  https://java.com

Java 8 Update 261 (64-bit)
Java SE Development Kit 8 Update 241 OLD
Java(TM) 6 Update 45 (64-bit) OLD
Java(TM) SE Development Kit 6 Update 45 (64-bit)  OLD

 

If that does not correct the issue please let me know.

 

 

[AdvancedSetup]

Please run the following after you've corrected the Java issue.

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire on the current-security-update  status  of some applications.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.
• This tool is safe.   Smartscreen is overly sensitive.
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

[Hachuurui]

That version of Java must be installed due to work I do for one of my clients. I'm still pushing for them to update their systems however you know how that goes I'm sure.

[Hachuurui]

That being said, the version of java that was blocked is up to date and in a different directory than the standard install. 

How do I restore access to that file so I can remove and reinstall the application properly?

[Hachuurui]

C:\Program Files\Java\<version>  all run fine and are not blocked.

C:\Users\polar\.ftba\bin\runtime\jre-x64\bin\javaw.exe has had all access removed and I can neither delete the directory nor the file to reinstall the application that uses this file.

 

[AdvancedSetup]

Is that true even while exited out of Malwarebytes? We do not modify permissions so if that's locked out then something else is going on there which we can look at too.

 

[Hachuurui]

No I just noticed I have access again, I did not attempt with Malwarebytes off, thanks for pointing that out. I'll get this purged and reinstalled as a precaution.

[AdvancedSetup]

We can try doing a full clean removal and reinstall and see if that helps.
We could also do a general clean up of temp files on the computer which would also clear out old java files in cache. 

Please follow the directions from here

Uninstall and reinstall Malwarebytes using the Malwarebytes Support Tool

 

Edited August 20, 2020 by AdvancedSetup
corrected typo

[AdvancedSetup]

Hello @Hachuurui

It appears this is a known issue.

It must be added to exclusions until the fix to the ransomware component is released.

Please see the following

https://forums.malwarebytes.com/topic/262583-false-positive-for-modded-minecraft/?tab=comments#comment-1400105

Sorry for that

Let me know if the exclusion works out for you or you need additional assistance.

Thanks

 

[Hachuurui]

No need, I was able to remove the file now and got things reinstalled and sorted. Disabling malwarebytes was what was needed to fix the issue. I have it re-enabled and its working fine now with malwarebytes. Thanks again for your time.

[AdvancedSetup]

Thank you for the update and glad you were able to resolve the issue.

I'll go ahead and close your topic

Take care and have a great weekend

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you