2

I recently did a clean install of Java about a week or two ago. It asked whether I wanted the Amazon button app installed. I opted NO. It still installed anyway. I removed it from Control Panel -> Programs list and restarted, but Amazon1ButtonService64.Exe is still running as a system process and has 2 .DLLs located in C:\Program Files (x86)\Amazon\Amazon1ButtonApp.

I've tried several virus/malware scanners etc. None of them pick this up.

The issue I have is:

  • At no stage did I provide consent to have this installed.
  • Program is still running as system process, despite being removed and no longer showing up on browser or programs list.

As far as I'm concerned, this is malware.

Failing safe mode removal, what other options do I have other than an OS reinstall?

EDIT: Java installer from here: http://java.com/en/download/windows_xpi.jsp

Images from the above installer:

image

14
-1

The official Java installer does not come bundled with any 3rd party software at all.

If you are getting the Amazon software as part of the payload, the only explanation is that either the installer you received wasn't genuine (possibly a browser hijack), or your machine is already infected with malware from another source.

You can check the validity of the Java installer .EXE file by right-clicking it and getting Properties for it. On the digital signatures tab, it should say Oracle America, Inc. If it says anything different, or does not have a signatures tab, then the file is not signed and is not a genuine Oracle file.

4
  • Sorry but I respectfully disagree about the installer. I've done all this, I even uploaded the file to virustotal.com & all checks out ok & digital signature is from "Oracle America, Inc". As for my PC already being infected; ok maybe, & I'll dig deeper. I'll update my OP regarding java installer shortly.
    – ReturnVoid
    Apr 1 '16 at 22:28
  • 1
    Apparently it does install the Amazon Assistant; see the newly added screenshots.
    – Arjan
    Apr 1 '16 at 22:49
  • Yes it did even though I deselected them.
    – ReturnVoid
    Apr 1 '16 at 22:55
  • The developer installers formerly at sun.com now oracle.com/technetwork/java/javase never offer 3rd-party crud, but the end-user ones on java.com do -- although (1) when I use them (rarely) I've never had them ignore a deselect and (2) since about a year there is an option (on Java ControlPanel / Advanced at the bottom) that should suppress them. Apr 3 '16 at 6:48
-2

Actually java does come bundled with third party software as you can see here: https://www.java.com/en/download/faq/amazon.xml, but it should not be installed without your permission so i do not know why it uninstalled even though you unchecked the box

2
  • This should be a comment, as it is not an answer to the question posted.
    – HaydnWVN
    Jan 18 '17 at 12:47
  • @Haydn Give the guy a break. As you can see, he's a noob and doesn't have enough rep to leave a comment. A mod can come by and convert his answer to a comment if need be.
    – RobH
    Mar 7 '17 at 18:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.