Norton Personal Firewall and jucheck.exe

[omp199]

Hello,

Norton Personal Firewall has just popped up a Security Alert which it describes as "High Risk". The message is, "jucheck.exe is attempting to connect to a DNS server", and the firewall software recommends that I block the program on all ports. The program is located here:

C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe

It is attempting to connect to a computer at 192.168.1.254:53 on port 0. It says that this is a high risk based on the following information:

Threat Type: No Virus
Digitally Signed: No
Traffic Direction: Outbound

Now, I've Googled "jucheck.exe", and apparently "jucheck.exe is produced by Sun, and checks for Java updates." In other words, it sounds like an utterly standard program that loads of computers must run all the time. I can't imagine that it is unknown to the makers of Norton Personal Firewall.

This leaves me utterly perplexed. If jucheck.exe is a standard program, provided by a reputable company, that loads of people must have, why would Norton Personal Firewall be recommending that I block it? It doesn't make any sense to me! Have I missed something? Can anyone help?

[pip22]

It's important to realise that a malware file can be called anything, and often they are given legitimate names simply to fool people into thinking it's the genuine article.

When such a file gets onto someone's PC it's programmed to go into a different folder so the infection isn't spotted by the user when Windows asks "A file with that name already exists, do you want to overwrite it" or "access denied" which would set alarm bells ringing in your head.

However, in your case the file is where it should be (it's in my Java folder too) so it's genuine and harmless. Norton is flagging up a false alarm, not an unusual occurence by any means. It did the same with my Java folder so I ran ZoneAlarm Pro & ZoneAlarm AV on it ---- nothing.

[Untouchable]

Also worth noticing, although most good Personal Firewalls will give some false alarms from time to time, Norton is probably the worst solution available. Get Outpost or Sygate instead. More effective and takes up significantly less system resources!

Good luck!

[omp199]

pip22 and Untouchable - thanks for the replies. To be honest, I decided to just let the program do what it wanted to before I got any feedback. But thanks for replying anyway. pip22, you've set my mind at rest. Untouchable, you haven't. ;) But thanks for the advice. I will take it on board.

[TMorse]

According to Norton Firewall, jucheck just spontaneously tried to connect to n3.mindspring.com. Earthlink, which owns Mindspring, is my ISP, but I don't use Mindspring and have neve downloaded its software. So why would Java Update be trying to connect to Mindspring, rather than Sun Microsystems?

Terry

[oddjob]

omp199 .... as the others gave said is the the "java update checker" so all is well.

However, make sure you get the latest version on your system (version3) AND that you delete all older version of java. Out of date java has holes that malware can exploit.


OJ

[DaveC2003]

Remove Norton completely, it causes nothing but trouble.