I went to the Oracle.com site this morning and downloaded the JRE 8.65 with no problem, then it said update to the current version 8.66, so I downloaded JavaSetup8u66.exe.jc - when I did this I had a warning from Comodo regarding Packed.Win32.MUPX.Gen@129019204 which it said it quarantined.
What made me really suspicious, is that I was also logged into my bank website, which had logged me out for inactivity, when I went back in to my bank website a different window popped up asking for my username and password, which I entered. Then the normal bank window continued to the place I normally input my password after inactivity. When I saw this screen, it made me really suspicious that the previous little popup window was possibly a hack. I changed the bank password immediately after logging in again, but I need to see if my computer is compromised or if the bank account is compromised.
ANY SUGGESTIONS GREATLY APPRECIATED!
Blessings,
Brenda
The file was quarantined so that makes it not likely you are infected. The detection is for using UPX packer for the installer. That is an open open source packer which is sometimes used by malware makers. So it could be a false positive.
What strikes me as odd is that you downloaded an older version from Oracle pages first. Update 66 was release November 16 2015. Can you upload both the executables to www.virustotal.com and post the url’s to the reports here? I want to see their sizes and if they are digitally signed or not. How did you download JavaSetup8u66.exe.jc?
What also strikes me as odd is that JavaSetup8u66.exe.jc has a double extension. Can you confirm that the second extension .jc and not js?
As you see I am in doubt how to understand your situation. In case of doubt scanning your computer with various scanners is a good way of getting confirmation you’re clean or not. If you are using CIS first run the Comodo AV. Then run the following scanners:
TDSS Killer
Hitman Pro
Super Antispyware Free
Malwarebytes Antimalware Free
Norton Power Eraser
Keep us posted.
In attempting to recreate the sequence, I found that preparing to download the JRE 8.66 file with FlashGet 3 prompted the malware warning, but when I closed FlashGet and downloaded the file directly with IE, the warning did not reappear. So, it may have been something to do with FlashGet.
At any rate, I will scan my computer as suggested - the username/password window at the bank website was definitely suspicious…
Thank you!
Brenda
I did scan both of the JRE files that I downloaded from Oracle at VirusTotal.com. They both came up clean other than the option to change the default browser search.
My computer is running slower than normal and seems like it has something running in the background that is really bogging it down. I had to take the battery out and unplug the computer to shut it down… I attached a screenshot where I got a Comodo warning about Packed.Win32.MUPX.Gen@129019204 when I was preparing to download the second JRE file with FlashGet 3.
@ EricJH Can you recommend a safe place to run or download the scans you suggested?
TDSS Killer
Hitman Pro
Super Antispyware Free
Malwarebytes Antimalware Free
Norton Power Eraser
Thank you for your help!!!
Blessings,
Brenda
[attachment deleted by admin]
I am not familiar with Flashget but may be it tries to download from various sources like Download Accelarator Plus used to do. May be it got a source that added an adware or so.
I added download links in the quoted area for you.
All the scans came back clean, so I’m a happy camper!
Blessings and thanks for the help @EricJH!!!
Brenda
Glad the scans came up clean. One last request that just popped in my head. Could you also scan with adwcleaner? It does a good job with findings adwares.