Trojan Horse in javaw.exe?

[Ken]

Hi.

I was just doing some Java programming on Windows XP. I'm using Java
1.4.2. While compiling/running in Eclipse 3.0, Norton Anti-Virus gave
me the following message:

****
Rule "Default Block Master Paradise Trojan horse" blocked communication.
Local address: All local network adapters(3129).
Process name is "C:\WINDOWS\system32\javaw.exe".
****

Any idea what this means? Anyone else ever come across this? Should I
delete the javaw file and download it again?

Thanks for any info,

Ken

 

[DR]

"C:\WINDOWS\system32\javaw.exe" is not the TRUE of JRE's javaw.exe
it is probably a spyware that have the same name of javaw.exe of JRE


Ken a écrit:

 

[Alan Moore]

The JRE installer puts copies of java.exe, javaw.exe and javaws.exe in
C:\Windows\system32. You'll find the same files in the JRE install
directory--probably C:\Program Files\Java\jre1.4.2\bin (or whatever
version you're running). If the date and size of each file is the same
as those of its its counterpart in the JRE dir, you're probably okay.

 

[kk_oop]

Hi.

I was just doing some Java programming on Windows XP. I'm using Java

1.4.2. While compiling/running in Eclipse 3.0, Norton Anti-Virus gave
me the following message:

****
Rule "Default Block Master Paradise Trojan horse" blocked communication.
Local address: All local network adapters(3129).
Process name is "C:\WINDOWS\system32\javaw.exe".
****

Any idea what this means? Anyone else ever come across this? Should I
delete the javaw file and download it again?

Thanks for any info,

Ken

Thanks for the feedback. I actually got a useful response from the
folks at Symantec. I'm posting it to benefit future generations :

*****Symantec Response

I understand from your message that you are receiving the following
alert from the Norton AntiVirus (NAV):

"Default Block Master Paradise Trojan horse" blocked communication.

Kenneth, this alert message does not indicate the presence of the
Master Paradise Trojan horse on your system. This issue can happen if
javaw.exe is using the local port 3129 on your system. This port is
usually used by Master Paradise Trojan horse program.

Please note that there is a block rule for Master Paradise Trojan horse
under Trojan Rules section in Internet Worm Protection. This rule
monitors activities and communications through the local port 3129.
When it finds a communication through the local port 3129, it will
display this alert message.

If you wish to disable this alert, I suggest that you follow the steps
provided below:

1. Open Norton AntiVirus.
2. Click Options.
3. On the left pane, select Internet Worm Protection.
4. On the right pane, click Trojan Rules.
5. Scroll to and uncheck the entry "Default Block Master Paradise
Trojan horse".
6. Click OK.

After this, I suggest that you create a program rule to Permit the
javaw.exe file. To do so, please follow the document provided below:

Title: 'Creating new program rules in Norton AntiVirus Internet Worm
Protection'
Document ID: 2004091413133506

Web URL:

http://service1.symantec.com/Support/nav.nsf/docid/2004091413133506?Open&src=w
*****End of Symantec Response

See ya,

Ken