# Malware detected on download

**URL:** <https://discuss.elastic.co/t/malware-detected-on-download/103442>\
**Category:** Logstash\
**Created:** [October 10, 2017, 9:37pm UTC](https://discuss.elastic.co/t/malware-detected-on-download/103442 "2017-10-10T21:37:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ra.girard](https://avatars.discourse-cdn.com/v4/letter/r/848f3c/32.png) [@ra.girard](https://discuss.elastic.co/u/ra.girard)\
**Post date:** [October 10, 2017, 9:37pm UTC](https://discuss.elastic.co/t/malware-detected-on-download/103442/1 "2017-10-10T21:37:19Z")

</div>

I can't download logstash, I always have a malware detection error from our internal security tool

URL: [https://artifacts.elastic.co/downloads/logstash/logstash-5.6.3.zip](https://artifacts.elastic.co/downloads/logstash/logstash-5.6.3.zip)  
Categories URL: Internet Services  
Reputation: Minimal Risk (0)  
File name: logstash-5.6.3.zip|logstash-5.6.3/vendor/jruby/lib/ruby/shared/org/bouncycastle/bcprov-jdk15on/1.55/bcprov-jdk15on-1.55.jar|org/bouncycastle/crypto/agreement/DHStandardGroups.class  
Type of support (Header): application/zip  
Type of support (Ensured): application/java-vm  
virus name: BehavesLike.Java.Obfuscated.lvMcAfee Threat Center (95%)  
MD5: 315dd0865ef7cc251ec7aacec5036204

Any Ideas ?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 11, 2017, 4:50pm UTC](https://discuss.elastic.co/t/malware-detected-on-download/103442/2 "2017-10-11T16:50:23Z")

</div>

In all likelihood, this is a false positive. The class file identified is open source and can be inspected by anyone. As its purpose is cryptography (DHStandardGroups == Diffie-Hellman encryption), the virus the scanner thinks is related here may have borrowed code from this class for its own cryptography, hence the similarity.

Feel free to look up the bouncycastle project and jars and ask them if they've had a security breach or strange code merged into their branch. I'm confident you'll find that is not the case.

Also, please read carefully the words, `BehavesLike`. In other words, the malware scanner thinks it is behaving like something it has seen before, but it doesn't actually _know_ if it's a virus.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2017, 4:51pm UTC](https://discuss.elastic.co/t/malware-detected-on-download/103442/3 "2017-11-08T16:51:03Z")

</div>

Closed on November 8, 2017, 4:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.