If you've ever tried to download or install JDownloader (aka JDownloader2), you might have been surprised to find that your web browser blocked the download or your antivirus software quarantined the installation file. In fact, that's exactly what happened to me, and I was concerned that the software might harm my computer. I've scoured the web and asked on data guzzler forums whether JDownloader is dangerous and got mixed responses, so I decided to do my own research.
That is the good newsJDownloader is safeTo use it however, there are a few caveats I should point out. You should be very careful where you download software from. Of course, if you download JDownloader from a dubious source, you risk infecting your computer with a virus. For several years, this official installer has contained adware and for this reason it is sometimes flagged by antivirus software. Some antivirus programs also mark JDownloader as a "potentially unwanted program". Luckily for us, JDownloader is a Java program, so we can only download and run the ".jar" version without installing it.
Where to download the safe/clean version of JDownloader
As JDownloader is written in Java, you should first ensure that you have a proper "JRE" or Java Runtime Environment installed on your system. For security reasons, you should always ensure that you are running the latest version of Java available for your platform. Older versions of Java are notorious for security threats due to their numerous vulnerabilities. Oracle recently announced that it is also changing its licensing model, effectively moving it away from the free version. Many people have switched from Oracle Java to an open source version of Java, myself included. I chose AdoptOpenJDK, so I'll use it in this example.
Step One: Check/Install Java
Since JDownloader requires Java, you need to verify that it is installed on your computer. On Windows, simply start a command prompt and enter the command "java -version" (without the quotation marks). If Java is already installed, the version should be returned as follows:
If you get an error message like "Java is not recognized as an internal or external command" instead, you know you don't have Java and need to install it. As mentioned above, I recommend the AdoptOpenJDK variant, so follow these steps:
- Go tohttps://adoptopenjdk.net/.
- Make sure you select "Latest" under "Select Version".
- Under "Choose JVM" make sure you select "Hotspot" (Hotspot is the most popular Java Virtual Machine, it's open source and suitable for all workloads, even with JDownloader!)
- Run the installer and follow the wizard's instructions, leaving everything in the default state.
Step Two: Download the JDownloader2 JAR file
Do NOT download the installer from JDownloader homepage (http://jdownloader.org) as it contains adware/malware as mentioned above. Download the clean "JAR" insteadHere.
At the time of writing, the link to the "JAR" file was in the "Other" section of the webpage. Also note that the title of the page "JDownloader 2 Ad-Free Setup" reads:
Once the "JAR" file has been downloaded, simply move it to a convenient location. I've decided to move my copy of the file to "C:\Datahoards\Software\JDownloader\jdownloader.jar". After moving, just double click on the file and if everything went as planned, the Java Runtime should launch the JDownloader GUI.
Check if JDownloader2 is virus free with VirusTotal
At this point I was pretty sure that JDownloader was safe and free of viruses. My research led to the discovery that the official installers for Windows came bundled with adware, but since I skipped the installers and manually downloaded the Java and JDownloader JAR, I was pretty sure it was safe. However, one can never be too careful, so I decided to scan jdownloader.jar with VirusTotal. For those who don't know, VirusTotal.com is a reliable website that has been around for years. They allow you to upload any file you suspect is malicious and they scan it with dozens of different antivirus and internet security products and share their results with you. In addition to automatic scanning, VirusTotal also has a community section where others can vote/comment on their experience with the file in question.
One feature of VirusTotal that I find particularly useful is the ability to see when a user first uploaded a copy of the file. I will explain later why this is important in the case of JDownloader. As you can see in this image, VirusTotal does not report any results when scanning jdownloader.jar, indicating that they believe it is safe:
Kaspersky recognizes JDownloader.jar as a pdm:trojan:win32:generic virus
I tend to use Kaspersky Internet Security on most of my systems. Given the current political tensions, Kaspersky is viewed with suspicion by some, much like China's Huawei I suppose. Personally, I find the Russian anti-virus software excellent and have never had any problems with it. I find that it can often detect malware much faster than its competitors. One day after using JDownloader for about two weeks, I opened it and it started updating automatically.
This is not uncommon as premium file hosting services (Mega.nz, Dropbox, etc.) often change their website design and back-end code, which means that JDownloader is constantly updated to support downloading from them to support services. The update started and I was quite surprised when Kaspersky showed up and said they found a potential virus and the system needed to be cleaned.
I did a little research and quickly found that Kaspersky's detection of pdm:trojan:win32:generic is not based on antivirus signatures, but rather on heuristic analysis. This means that Kaspersky has been monitoring what the application was doing (updates from the web in this case) and believes this activity is suspicious. In other words, Kaspersky thinks the software is doing something unusual, something that a virus might try to do. This makes sense when you think about it, since a virus would try to call home, download payloads from the internet, and copy them to different places in the system. After this detection, I ran a full system scan with Kaspersky and another with MalwareBytes. Both scans came back clean and reported no infections, so I believe that in this case the detection of pdm:trojan:win32:generic in JDownloader was actually a false positive (a red herring, so to speak).
Running JDownloader in a virtual machine without antivirus
I'll be honest, after Kaspersky flagged JDownloader during the update process, my confidence in the software took a bit of a hit. I started to wonder what would have happened if Kaspersky hadn't stepped in and blocked the JDownloader update process. Would JDownloader have downloaded malicious payloads after gaining my trust? I decided an experiment was needed to restore my belief that JDownloader was perfectly safe to use.
I booted up VMWare Workstation and quickly got a new Windows 10 VM up and running. In case you didn't know, a VM (or virtual machine) is like a small virtual computer that runs inside your actual physical computer. A VM allows you to install an operating system and other software while remaining completely isolated from your real computer. For example, if a virtual machine is infected with a virus, you can simply delete the virtual machine or restore it to a previous state using a snapshot.
I ran Windows Update on the new Windows 10 VM to fully update it with Microsoft patches and then installed the latest version of Adopt OpenJDK. Most importantly, I didn't knowingly have any internet security or antivirus software installed. Normally I would have installed Kaspersky at this point, but for our experiment I wanted to give JDownloader free reign over the virtual machine without security software blocking or monitoring it.
I then downloaded and launched the clean version of JDownloader as above. Over the next month, I closed and opened JDownloader multiple times, adding downloads and entering my credentials for premium cloud hosting services like Mega. A few times I noticed that JDownloader did an automatic update, this time without being hindered by an antivirus. After a month of intensive use of JDownloader, the day finally came to see the damage it had done to my VM. To be fair, the VM still felt fast and I hadn't noticed any of the telltale signs of a malware infection, so I was pretty sure a virus scan wouldn't find anything malicious.
I installed the latest version of KAV (Kaspersky Anti-Virus), performed a manual update to update the engine and virus definitions, and then ran a full scan. Because the virtual machine was relatively lightweight, the full scan was completed in about twenty minutes and, as expected, no threats were detected.
So, after using JDownloader for a month on an unprotected system, allowing it to update automatically whenever it wanted, no infections were found. Although it's a bit redundant after running a full file system scan, I decided to run a selective scan of the JDownloader folder. Here are the results:
I personally think JDownloader2 is safe to use and doesn't contain any malicious code. However, it is important that you only download/install it using the safe method described above. If you decide to ignore this advice and install JDownloader using the default installation packages, you risk installing adware on your system. I've been collecting data with JDownloader for several months and plan to keep going!