Malwarebytes ioser12.dll False Positive?

[smarteyeball]

I Just ran a malwarebytes scan under Seven and it discovered a 'Trojan.Downloader' - ioser12.dll - on my Vista drive in the Java folder:



ioser12.dll properties:


Is it safe to assume that it's a false positive?

(I know the second entry is)

 

[SqdnGuns]

ioser12.dll - What is ioser12.dll?

 

[SIW2]

Hi smarteye,

Someone else found it via mbam also:

C:\Program Files\Java\jre6\bin\ioser12.dll - Malwarebytes Forum

Virustotal. MD5: a6919e633b6bc98b0b86edd4bc62d4cb Trojan-Downloader.Win32.Tibs!IK Trojan-Downloader.Win32.Tibs

 

[Airbot]

It's a legit java file. I checked it mine with 40 different Av, checks out ok, and Malwarebytes didn't detect anything with a full scan. If you're worried, get rid of your java, re download it form the site, scan again.

 

[smarteyeball]

I think I'll just boot into Vista, uninstall, update and if it shows again I think I'll have a definitive answer.

 

[Jacee]

F/P
ioser12.dll | ThreatExpert statistics

BTW... Java is update 13 now.
This is the best way to install it:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "Java Runtime Environment (JRE) 6u13 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.

 

[Airbot]

Yeah, I didn't notice you got java 6 v12 there SE. Nice catch Jacee.

 

[Jacee]

Ahh, thanks for that Airbot. That's one of the things I try to teach my students .... don't overlook anything
Sometimes we need extra eyeballs, tho'. lol

 

[smarteyeball]

lol, yeah I'm crippled with just the one

I've always been slack about updating Java.

Well, removed all existing Java, updated to 13 offline, scanned again and it wasn't flagged this time. Either way, it's all good now

Odd thing though, java is no longer appearing in add/remove panel :huh:

 

[Airbot]

Hi SE,

That's good news, except about not being in the control panel. You know you can d/l both 32 and 64 bit java on the same OS. Just a little something I thought I'd throw in there.

 

[smarteyeball]

The jre 12 was x64 - I don't think I took too much notice when d/ling 13... click...click...click

 

[Airbot]

But that's why you're the BETA BREAKER though right? click click click till something breaks.

 

[jimbo45]

Hi all
Don't update your JAVA JRE just because it says "Update to the latest version".

Depends on what you need the JAVA JRE for.
For example

To install some SAP programs the SAP site specifically says use Version 1.4.xx of the JRE --later versions won't work.

Now modern AV software will sometimes report false positives on Old legacy files.

The problem with AV software these days that nearly all of them report different false positives so you can't really trust ANY of them.

The only time you can be reasonably certain if 2 or more AV products don't find anything.

If you do get something flagged as a trojan or whatever check it out on at least 1 other product.

(If you were having building work done at home I'd hope you'd always get two or preferably 3 estimates before commissioning any work).

Cheers
jimbo

 

[Airbot]

That's not very good advice. Not updating things like Java can leave you open for vulnerabilities in past versions.

 

[Jacee]

Exactly! Older versions have vulnerabilities that malware can use to infect your system. Don't wait for the malware to infect your computer ... get the latest version so that won't happen.

 

[jimbo45]

Hi guys
I don't think you understood my post

I said sometimes because of the software you are FORCED to run (such as SAP etc in a corporate / business environment - so no user choice normally) you HAVE to have older versions installed in this case it was the JRE 1.4.xx version).

My point was that IF you are forced to use older versions the AV software is not always reliable in doing its reporting - and even with newer stuff you can still get a load of false positives.

So

1) If ANYTHING is reported as a "positive" always check from another "reliable" source (that begs the question as well --what is a "reliable source") what the offending program / module / .dll etc is.

2) Check again with at least one (preferably 2) different AV software systems.


Before even THINKING of installing AV software you should get up to speed on some of the methods of computer protection and how these are implemented so you can make a sensible choice.

Start first by reading some fairly non technical info such as this

AntiVirus Software Review 2009 - TopTenREVIEWS

You'll find NONE will ever be 100% effective but at least know what you are up against.

Cheap or FREE is not necessarilly bad - converse is also true Expensive is not necessarily good either.

Here's a review of the FREE one's

http://antivirus.about.com/od/antivirussoftwarereviews/a/freeav.htm

At the current state of the art I tend to think the disadvantages of AV software far outweigh the advantages of using it -- but that's MY opinion and I don't d/l music / films / multi-media etc from dubious sites and am usually pretty careful in how I use computers -- browsers and web based email tend to be the most common method of infection and then these are transmitted to other machines often by the use of USB devices.

Usually it's people trying to install dubious software or load those HORRIBLE sneakware programs that offer to find drivers, fix your registry etc etc whilst you are online that are the major cause of "contaminants".

I've been using PC's since the late 70's and have NEVER had a virus / trojan on my OWN machines.

Some work machines I've had problems with and these are often large companies who can afford (and do) spend loads and loads of money on this -- and they STILL get problems.

Cheers
jimbo

 

[Jacee]

Before even THINKING of installing AV software you should get up to speed on some of the methods of computer protection and how these are implemented so you can make a sensible choice.

Start first by reading some fairly non technical info such as this

AntiVirus Software Review 2009 - TopTenREVIEWS

I think I know a small bit about AntiVirus software and computer protection

 

[Airbot]

Hi guys
I don't think you understood my post

I said sometimes because of the software you are FORCED to run (such as SAP etc in a corporate / business environment - so no user choice normally) you HAVE to have older versions installed in this case it was the JRE 1.4.xx version).

My point was that IF you are forced to use older versions the AV software is not always reliable in doing its reporting - and even with newer stuff you can still get a load of false positives.

So

1) If ANYTHING is reported as a "positive" always check from another "reliable" source (that begs the question as well --what is a "reliable source") what the offending program / module / .dll etc is.

2) Check again with at least one (preferably 2) different AV software systems.


Before even THINKING of installing AV software you should get up to speed on some of the methods of computer protection and how these are implemented so you can make a sensible choice.

Start first by reading some fairly non technical info such as this

AntiVirus Software Review 2009 - TopTenREVIEWS

You'll find NONE will ever be 100% effective but at least know what you are up against.

Cheap or FREE is not necessarilly bad - converse is also true Expensive is not necessarily good either.

Here's a review of the FREE one's

Antivirus Software Review: Free Antivirus Software

At the current state of the art I tend to think the disadvantages of AV software far outweigh the advantages of using it -- but that's MY opinion and I don't d/l music / films / multi-media etc from dubious sites and am usually pretty careful in how I use computers -- browsers and web based email tend to be the most common method of infection and then these are transmitted to other machines often by the use of USB devices.

Usually it's people trying to install dubious software or load those HORRIBLE sneakware programs that offer to find drivers, fix your registry etc etc whilst you are online that are the major cause of "contaminants".

I've been using PC's since the late 70's and have NEVER had a virus / trojan on my OWN machines.

Some work machines I've had problems with and these are often large companies who can afford (and do) spend loads and loads of money on this -- and they STILL get problems.

Cheers
jimbo

Still not safe anyways. No software that I use requires that, and I probably wouldn't use it, as it would require me to use outdated, insecure practices. Which will end up in you getting infected at some point. :sarc:

 

[jimbo45]

I think I know a small bit about AntiVirus software and computer protection

Hi there

Of course some people do -- but the point of the link on this and other posts is to direct people who don't have the requisite knowlege.

Things like False positives can be quite "Scary" for newbies -- who in some cases will go deleting critical windows files because some AV software reports they have a "non exisitant" trojan etc.

If everybody was 100% expert or had no problems then we wouldn't need Forums (or even search engines like Google etc).

I'm glad people DO post -- if you have the knowledge please correct errors etc -- we all make mistakes but not everybody has the same expertise.

I'm very pleased people DO take trouble --I've learned a lot as well.

Cheers
jimbo