r/jdownloader

▲ 441 r/jdownloader+1 crossposts

Is the website hacked?

Update 3: I never thought this post would blow up the way it did, I was skeptical and decided to reach out just incase even though I was hesitant. I didn’t realize the positive impact it would have in protecting thousands of people’s computers and data. Thank you to everyone for all the nice comments and big thank you to the developer for working with me and others to get to the bottom of this and solving the issue.

Jdownloader was my childhood software so it was kind of surreal to see this post blow up and it was quite overwhelming getting so many notifications. It was stressful managing and guiding the comments, but I’m glad I was able to help out I hope everyone is safe and have a lovely day my friends, and special thank you to whoever gave me the Reddit award, and the really cool people who diagnosed the malware and viruses. The website is back up and checked the pinned developer comment for their updates still.

Update 2: Please read pinned developer comment thread before asking questions

Update: Confirmed hacked DO NOT download until update from Devs.

I been using Jdownloader and switched to a new PC a few weeks ago. Luckily I had the installer in a usb drive but decided to download the latest version. The website is official but all the Exes for windows are being reported as malicious software by windows and the developer is being listed as “Zipline LLC.” And other times it’s saying “The Water Team” The software is obviously by Appwork and I have to manually unblock it from windows to run it which I will not do. I ended up plugging in my flash drive and the setup file on that flash drive has the Jdownloader logo along with AppWork being listed as the developer…

Are the servers hacked? Whether I download the no ads version or the offer free version it’s being flagged by windows on both ends and the exe has no logo either. This is getting draining as if the offer adware side wasn’t bad enough. Please be careful. At this point just charge for the software rather than potentially destroying people’s computers for ad revenue ffs I’m sick of it.

reddit.com
u/PrinceOfNightSky — 7 days ago

Proper JDownloader malware remediation

According to https://www.reddit.com/r/jdownloader/comments/1t6goqe/is_the_website_hacked/, the JDownloader site delivered malware on 20:12 - 07.05.2026 GMT+2.

u/Takia_Gecko did a very well technical analysis in this comment so I would like to focus on the proper steps to remediate this infection.

Execution chain:

To clarify, the installer was replaced with a malicious signature-less version that delivered the official JDownloader and exactly 8 minutes after the initial setup start, it decrypted and executed the malicious payload that consisted of installing the Python interpreter, PyArmor runtime for code obfuscation and then starting a Python remote access malware.

When the malware is executed, Windows Defender is fully disabled, Windows Updates are also disabled and a root certificate is installed

I have also discovered several strings that may indicate manipulating with:

  • Manual malware removal software such as FRST
  • Antivirus scanners such as HitmanPro, Kaspersky Virus Removal Tool
  • Antivirus software such as Avira, Avast, Windows Defender

Remote access malware (RAT):

  • You can remove the visible signs of this infection, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. A backdoor or RAT gives the attacker complete access to your system, allowing them to steal data, install additional malware, or monitor your activity.
  • This means that at some point the attacker was able to interact with your PC (see your desktop, view files, open programs) just like you are able to do so. For this reason, we do not recommend manual malware removal, because the malware could be embedded deeper in the system or able to manipulate with the removal process and making it ineffective.
  • If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, email, eBay, PayPal, online forums, etc). Consider these accounts already compromised.
  • I suggest you read and follow this guide on how to properly change your passwords after a stealer infection: https://rifteyy.org/report/the-ultimate-guide-to-infostealers - specifically the section "How to properly secure my accounts"

Proper steps to take now:

If you have executed the file, you can not guarantee a 100% clean system because of the malware's natures and because of how many changes it had already done on execution (disabling antivirus, manipulating with antivirus scanners, disabling Windows Updates, installing a root certificate) so please follow one of these steps to ensure your device is clean from the malware:

u/rifteyy_ — 6 days ago

Was affected by the rat

I already wiped the drive and reinstalled w10 properly, I’m just more concerned about in knowing that did it spread to other drives and files or stayed contained within the OS?

reddit.com
u/crystalspalt — 1 day ago

Is it safe to download now?

Hello everyone. I was following the hacking of the JDownloader website. I just logged in again and the site says it's secure. Is this correct? I'm a little worried. I haven't used JDownloader for years and I'd like to reinstall it. Thank you very much.

reddit.com
u/Beerandasado — 5 days ago

Hey everyone, I downloaded Jdownloader2 from the jdownloader dot org site, accidentally downloaded the one ‘with optional software offers to support the project’ and it fucking downloaded a virus onto my system.

It literally disabled windows security entirely, I cannot access windows security, SecurityHealthSetup wont run, nothing works.

What the fuck?

edit: The devs and community have been super helpful in trying to help me fix this, thank you everyone!
edit: I downloaded the file from the mega nz link, im assuming that was the one without adware, which is why i was never asked for adware in the installer anyways. Sorry for providing wrong information initially, I assumed that I must have downloaded the adware version considering i got a virus, but on second look, I'm pretty sure I downloaded the alternative installer

edit: my chrome still says 'your browser is managed by your organization' after multiple system restores to older versions. I would HAVE to perform a clean windows reinstall for the malware to completely go away.
for anyone facing issues/have faced issues with the recent jdownloader website compromise, i would highly recommend doing a fresh windows install, and backing up your files before you do so

reddit.com
u/Beneficial_Power_564 — 7 days ago

I unfortunately installed and ran the malicious .exe while the site was compromised. Can anyone help with information, tips, peace of mind?

I had the extreme bad luck of installing and running the malicious .exe on May 7 while my antivirus was off. I saw the news about it just recently, so I took immediate action.

I checked the .exe, and sure enough, no digital signatures. I tried Windows Defender, it was blocked. So what I did was the following:

  1. System Restore back to the earliest point (this was a mistake since it said Python installed for the event)

  2. System Restore again to an earlier point

  3. Windows Defender full and offline scans (nothing found), weird that the .exe is now gone.

  4. Malwarebytes full scan (nothing found)

  5. In the middle of figuring out what files I need to replace and passwords to change (I assume safe mode + offline is safe enough to open my browser to check them?) before nuking my PC and doing a fresh install

While I used my computer the past days, here's what I noticed:

  1. MSI Afterburner always gave a popup upon startup and said it couldn't connect to the server to check for updates (I thought it might be a bug).

  2. No suspicious activity on my accounts, no security emails.

  3. Windows Defender was blocked until after System Restore.

  4. I could still otherwise use my PC normally.

I'm really scared about this right now, I didn't know I was compromised until I saw a Reddit post on this.

I checked my Microsoft Account, no recent activity. My social media too, no recent activity. Browser as well. I'm in the middle of figuring out what passwords to change right now. I don't really have much payment info on my PC, so no transactions done.

It's both relieving and scary at the same time that I can't find anything weird or compromised with my accounts or files after days of having my PC infected.

Can anyone offer advice, information, or help with this? I know the most surefire way is to just reset my PC, but that's obviously my last resort.

Any help would be greatly appreciated.

reddit.com
u/mbo750 — 4 days ago

Can we give an appreciation post to u/ jdownloader_dev and the team in general

Dude's been constantly actively replying to people in good faith, even with repetitive questions, easing peoples anxiety (if they didn't get infected...)

He and the Dev Team have been really transparent about this, constantly updating info etc; something you really need in a bad situation like this.

So I just wanted to give a quick thank you post.

That's all :)

reddit.com
u/Zeltron3000_ — 6 days ago
▲ 1 r/jdownloader+1 crossposts

Avast detecting jdownloader as a threat

ETA: SOLVED, see link provided by jdownloader_dev. Thanks!

Hi all,

I think I've done everything I should, but just to be on the safe side.

I use Jdownloader 2. the app was sent to Avast quarantine.

I am aware that the some installers on jdownloader were compromised a few days ago (see here), but I did not download them, as jdownloader has been installed for a while. Jdownloader states that updates are not affected, so even if the app updated, I should not be affected by the breach.

Yesterday, the app was sent into quarantine by Avast (see screenshot), but it does not name the threat. The app was running at the time, downloading PDF files. They've all been scanned with Malwarebytes, Avast and Windows defender, and have come back clean. .
I restored the file and uploaded it to virustotal, it came back clean (BitDefenderFalx and Trustlook being unable to process the file type). See https://www.virustotal.com/gui/file/d1f60da77015914a8e3af47ab8ab2e4d865db5fa3e7138f26796f60f0fe3949a
I scanned it again with Avast, which shows it as clean now, same with Malwarebytes.

Quick scans by Malwarebytes, Avast and Windows Defender turn up clean.

I have two questions:

  • this would be a false positive? I have sent the file to Avast for analysis...
  • to be on the safe side, are there any scans that I can do to check for potential traces of the malware linked to jdownloader - even if I should be safe, considering the info on Jdownloader.

Thanks in advance for any help.

https://preview.redd.it/hcu0kumeyu0h1.png?width=831&format=png&auto=webp&s=ee8e64b39d89611db16e6b04fc5b7465f2967298

reddit.com
u/LakeSpear — 1 day ago

[ Message to the team ] A simple fix for a huge problem

Hello,

I want to report a specific issue to your team. If fixed, it would permanently resolve the download blocks on Twitter and Instagram when processing a large number of links (up to 500).

The issue lies in how your system handles Twitter links. Currently, the crawling or link searching process happens sequentially for the entire list at once. This triggers an immediate block from Twitter and stops the download process.

I’d like to suggest a solution that was successfully implemented in WFDownloader: Merging the download process with the crawling or link searching process.

Instead of crawling all 400+ links at once, the app should crawl them in small batches (e.g., 5 links at a time). After the crawling or link searching for the first 5 links is done, the process should pause, and the app should automatically start downloading the media from those links. This creates a rest period for the crawler. Once those 5 downloads are finished, the app resumes the crawling or link searching for the next batch.

This "batch-crawling" with rest periods effectively bypasses rate limit blocks on Twitter and Instagram. It's a smart workaround, and I wanted to share it with your great team.

Thank you and best regards.

reddit.com
u/man_is_the_dream — 23 hours ago

iOS App

Do you think they will ever develop a iOS Jdownloaded I know they have one as a remote access to the downloads on your PC but I am talking about a full version of the program downloading to your iPad or external drive not a pc elsewhere.

reddit.com
u/Main_Top_3782 — 18 hours ago

Sorry, i know this is the 100th post about it but im not very computer savvy. I JUST downloaded for the first time a hour or two ago. I understand that the issue is fixed but what programs can/should I run just for peace of mind? Thank you dev for your hard work fixing this.

I have ran rkill, malwarebytes, avast, and hitmanpro, avast caught something but it seems to not be the amd file name I saw posted on here and it was old.

Also, is there any activity I should keep an eye out for? unusual sign in or anything like that?

reddit.com
u/polarfang21 — 3 days ago

Rename files & auto-detecting translated name?

How to rename files all at once.
The file i am downloading has the Folder, Audio FIle, Video File.
How can i rename and change a portion of the name in all of them?
Portion because i want to keep the audio details in the file name (video Hz, pixel, etc)
Problem when i select the entire folder and rename, only the folder gets it name changed. Then i have to select the files inside the folder and changing them replaces the entire name string with my given name. Also trying to download them after the changes giving error.

Is there any convient way also when the translated name will be detected and used as folder and file names?

Side question if anyone can answer. How can i see the original words as well and not see [][][][][]?

reddit.com
u/Internal-Ad-6740 — 2 days ago

What adjustments do i need to avoid Twitter blocking me

As you can see on the title... Every time i put my 500 twitter posts links inside j downloader i got blocked by Twitter and i believe that this is bcz j downloader check links so quickly !! And faster than tan it should be

So how can i put delays ?

u/man_is_the_dream — 3 days ago

Chrome Extenstion for Click´n´Load

Hey guys,

I was sick of copying links into JDownloader manually because the Chrome extension hadn't been updated since ManifestV3 was introduced.

So I took a little time and used Claude Code to make my own.

The extension is currently not available in the Chrome Web Store as it's still too early and a bit rough around the edges — but the functionality is there.

You can clone the repo and load it in Chrome via developer mode as an unpacked extension.

https://github.com/reptil1990/CnLCloudBridge

I avoided naming it anything JDownloader-related because of trademark reasons.

Also localizations are missing! I will work on that if there is some intrest in the current functions.

Feedback would be appreciated!

EDIT: Currently there is NO CAPTCHA forwarding support. Right now it just ADDS Links to your myJdownloader,

Thanks and have fun.

PS: Some Screenshots:

Flyout

Send To Connected Device

reddit.com
u/Sharp-Concentrate858 — 6 days ago

Compromised Installer Found Prior to May 5th

Hey all, I’ve got an installer that I downloaded on April 14th. Upon checking the signature, it’s signed by ZIPLINE TECH LLC., and the details cite the Copyright to 2010-2024 Water Team. The file is named JDownloader_739510.exe and is 29,397,392 bytes.

This is outside of the reported compromise window, but the signature and copyright lines up with what is being reported as compromised. Can anyone else confirm this? I have the URL it was downloaded from as well, it’s an Amazonaws.com server, but I can provide the full link if necessary. Can I get verification that this installer is safe? As of now my machine is off the network until I can verify.

Thanks!!

ETA: The SHA256 hash is 650894b47e1b46a74d4de9d7574fb19b032541e3

E2: I found this comment with a similar experience to mine that occurred on April 28th, icon for my installer shows the 7Z logo as well. https://www.reddit.com/r/jdownloader/s/N7luXx36km

E3: This may be a false alarm, this post from February raises the same questions. https://www.reddit.com/r/jdownloader/s/kpf5SNcAsa

If that’s the case, unfortunately BleepingComputer quoted the original Reddit post which contained misinformation, which in turn caused other news outlets to report the same. (Ctrl-F “Zip” or “Water” to find the respective section, though it’s just a direct quote of the original Reddit thread) https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/

Going to sleep now, 4:30 am and I’ve been scrambling to fix my pc for two hours now. Hoping to wake up to good news!

u/Moth3r_1n_l4w — 4 days ago

How can i improve the crawling with X/twitter?

Unfortunately but i came across an account with 5k posts and j downloader 2 only grabbed 400 videos/ pics

That's very sad ... I mean was happy the 5 days ago and posted about it here

I would like to improve the crawling or scraping. Help me my god bless you

reddit.com
u/man_is_the_dream — 6 days ago