Trojan Horse in javaw.exe?

Discussion in 'Java' started by Ken, Jan 24, 2005.

  1. Ken

    Ken Guest

    Hi.

    I was just doing some Java programming on Windows XP. I'm using Java
    1.4.2. While compiling/running in Eclipse 3.0, Norton Anti-Virus gave
    me the following message:

    ****
    Rule "Default Block Master Paradise Trojan horse" blocked communication.
    Local address: All local network adapters(3129).
    Process name is "C:\WINDOWS\system32\javaw.exe".
    ****

    Any idea what this means? Anyone else ever come across this? Should I
    delete the javaw file and download it again?

    Thanks for any info,

    Ken
    Ken, Jan 24, 2005
    #1
    1. Advertising

  2. Ken

    DR Guest

    "C:\WINDOWS\system32\javaw.exe" is not the TRUE of JRE's javaw.exe
    it is probably a spyware that have the same name of javaw.exe of JRE


    Ken a écrit:
    > Hi.
    >
    > I was just doing some Java programming on Windows XP. I'm using Java
    > 1.4.2. While compiling/running in Eclipse 3.0, Norton Anti-Virus gave
    > me the following message:
    >
    > ****
    > Rule "Default Block Master Paradise Trojan horse" blocked communication.
    > Local address: All local network adapters(3129).
    > Process name is "C:\WINDOWS\system32\javaw.exe".
    > ****
    >
    > Any idea what this means? Anyone else ever come across this? Should I
    > delete the javaw file and download it again?
    >
    > Thanks for any info,
    >
    > Ken
    DR, Jan 24, 2005
    #2
    1. Advertising

  3. Ken

    Alan Moore Guest

    The JRE installer puts copies of java.exe, javaw.exe and javaws.exe in
    C:\Windows\system32. You'll find the same files in the JRE install
    directory--probably C:\Program Files\Java\jre1.4.2\bin (or whatever
    version you're running). If the date and size of each file is the same
    as those of its its counterpart in the JRE dir, you're probably okay.
    Alan Moore, Jan 24, 2005
    #3
  4. Ken

    Guest

    Ken wrote:
    > Hi.
    >
    > I was just doing some Java programming on Windows XP. I'm using Java


    > 1.4.2. While compiling/running in Eclipse 3.0, Norton Anti-Virus

    gave
    > me the following message:
    >
    > ****
    > Rule "Default Block Master Paradise Trojan horse" blocked

    communication.
    > Local address: All local network adapters(3129).
    > Process name is "C:\WINDOWS\system32\javaw.exe".
    > ****
    >
    > Any idea what this means? Anyone else ever come across this? Should

    I
    > delete the javaw file and download it again?
    >
    > Thanks for any info,
    >
    > Ken


    Thanks for the feedback. I actually got a useful response from the
    folks at Symantec. I'm posting it to benefit future generations :) :

    *****Symantec Response

    I understand from your message that you are receiving the following
    alert from the Norton AntiVirus (NAV):

    "Default Block Master Paradise Trojan horse" blocked communication.

    Kenneth, this alert message does not indicate the presence of the
    Master Paradise Trojan horse on your system. This issue can happen if
    javaw.exe is using the local port 3129 on your system. This port is
    usually used by Master Paradise Trojan horse program.

    Please note that there is a block rule for Master Paradise Trojan horse
    under Trojan Rules section in Internet Worm Protection. This rule
    monitors activities and communications through the local port 3129.
    When it finds a communication through the local port 3129, it will
    display this alert message.

    If you wish to disable this alert, I suggest that you follow the steps
    provided below:

    1. Open Norton AntiVirus.
    2. Click Options.
    3. On the left pane, select Internet Worm Protection.
    4. On the right pane, click Trojan Rules.
    5. Scroll to and uncheck the entry "Default Block Master Paradise
    Trojan horse".
    6. Click OK.

    After this, I suggest that you create a program rule to Permit the
    javaw.exe file. To do so, please follow the document provided below:

    Title: 'Creating new program rules in Norton AntiVirus Internet Worm
    Protection'
    Document ID: 2004091413133506
    > Web URL:

    http://service1.symantec.com/Support/nav.nsf/docid/2004091413133506?Open&src=w
    *****End of Symantec Response

    See ya,

    Ken
    , Jan 27, 2005
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. SAP BASIS Consultant
    Replies:
    1
    Views:
    1,812
    icebattle
    Nov 14, 2003
  2. javaw.exe

    , Dec 16, 2003, in forum: Java
    Replies:
    3
    Views:
    452
    Chris Smith
    Dec 16, 2003
  3. patrick

    javaw.exe proccess

    patrick, Jun 28, 2004, in forum: Java
    Replies:
    5
    Views:
    4,478
    Stefan Poehn
    Jun 29, 2004
  4. Roy Epperson

    Tomcat 5* and javaw.exe

    Roy Epperson, Dec 31, 2005, in forum: Java
    Replies:
    0
    Views:
    772
    Roy Epperson
    Dec 31, 2005
  5. Tim Ward

    INT 3 in javaw.exe

    Tim Ward, Jun 23, 2006, in forum: Java
    Replies:
    0
    Views:
    468
    Tim Ward
    Jun 23, 2006
Loading...

Share This Page