We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Trojan:JS/BlacoleRef
Aliases: Blackhole (other) Blacole (other) Black hole (other) Blachole (other)
Summary
Windows Defender detects and removes this threat.
You should also update your software to be fully protected.
BlacoleRef is a type of malware which tries to infect your PC with other malware, such as trojans and viruses.
It belongs to the Blacole family of malware, which together are known as the Blacole (or "Blackhole") exploit kit.
See our page about exploits and learn how to update common software.
When you visit a malicious or compromised website, BlacoleRef scans your PC for vulnerabilities or weaknesses in your software.
You might visit the website from a link or attachment in an email, or from a previously safe website that has been hacked.
The threat uses those vulnerabilities it has found on your PC to download malware onto your PC:
Typically, the Blacole exploit kit attempts to exploit vulnerabilities in applications such as Oracle Java, Sun Java, Adobe Acrobat and Adobe Reader.
The following Microsoft software detects and removes this threat:
- Microsoft Security Essentials or, for Windows 8, Windows Defender
- Microsoft Safety Scanner
Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.
You can read more about this vulnerability and download software updates from these links:
You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:
If you continue to get alerted about this threat, deleting your temporary Java files can help:
It's also important to keep your other software up to date; the more up-to-date your software, the better your chances at preventing Blacole from infecting your PC with more malware:
