False positive for javaw.exe

Question

Hello, 
 I am trying to install application from OpenSTM32 Community Site | HomePage (install_sw4stm32_win_64bits-v2.9.zip from download area) 
 I have been using this application for years.without issues. 
 But the SOPHOS is indicating and blocking javaw.exe as a Ransomware! Here is the message: 
 "Ransomware blocked in \Desktop\__sw4stm32_tmp\jre\bin\javaw.exe" 
 I belive this is a false positive. Please check your virus database. 
 
 regards, 
 Reinaldo.

Qoosh · Answer

Hi Reinaldo , 
 Thanks for reaching out to the Sophos Community Forum. 
 When a ransomware detection is generated, it typically isn&rsquo;t due to the file or application itself. It&rsquo;s typically due to the series of operations which take place. One example is if an app were to launch a second app, then proceed to unpack many files. The operations themselves may not be malicious, but the behaviour which is taking place does resemble that of ransomware. 
 Can you share the event details from Event ID 911 in the Windows Application Event log related to this detection? You can also find this information from Sophos Central by selecting "Details" on the detection event. 
 If you'd like to create an exclusion, the following documentation may help. - Ransomware Protection Exclusions 
 If the issue only occurs on application install and you are deploying a trusted app, it may be easiest to create a temporary exclusion or to temporarily disable some of the scanning features using the Tamper Protection passcode and policy override. Seeing as the detection names "javaw.exe", you can also consider disabling the "Protect Java applications" option in the Threat Protection Policy. This will also depend on the security within the version of Java you're using.

False positive for javaw.exe

Top Replies