Windows Defender detects and removes this threat.

Exploit:JS/Coolex.D is script contained within an exploit pack known as the "Cool exploit kit". It can install arbitrary malware on your computer through exploiting software vulnerabilities in Java version 7, update 17 and earlier.

As the Cool exploit kit and the Blacole exploit kit share malicious web page patterns and exploits, in some instances you might see Exploit:JS/Blacole detected on your computer alongside Exploit:JS/Coolex.D. 

Exploit:Java/Blacole.D is a Java Class module that is included in a JAR file. It is part of the 'Blackhole' exploit kit, described in CVE-2010-0840.

Exploit:Java/Blacole.W is the detection for the Java class module included in "worms.jar" that is part of the "Blackhole" exploit pack. The file "worms.jar" is an applet that exploits the vulnerability in Java Runtime Environment described in CVE-2010-0840.

Windows Defender detects and removes this threat.

This threat uses a software vulnerability to download and run other files on your PC, including malware.

It runs when you visit a hacked website and you have a vulnerable version of Java. Legitimate websites can also be hacked to unwillingly host this threat.

Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier are all vulnerable to this threat.

To check if you're running a vulnerable version of Java:

1. Go to the control panel (Select Start then Control Panel)
2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
3. On the General tab, click About to see which version of Java you have installed.

You may get a detection for this threat when you visit a website that has the malicious code, even if you're not using a vulnerable version of Java. This doesn't mean that you have been compromised, it means an try to compromise your PC has been made.

The vulnerability that this threat exploits is described in CVE-2011-3544.

Windows Defender detects and removes this threat.

This threat uses specially-crafted Shockwave Flash (.swf) files to exploit an Adobe vulnerability to download and run files on your PC, including malware.

It runs when you visit a malicious or hacked website and you have a vulnerable version of Adobe Flash Player.

The following versions of Adobe Flash Player are vulnerable:

• Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64
• Adobe AIR before 2.0.2.12610
• Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X

If you visit a webpage containing this threat and your PC has a vulnerable version of Flash installed, this threat can download and run other malware.

Find out ways that malware can get on your PC.

Windows Defender detects and removes this threat.

This threat uses a JavaScript vulnerability to check your PC for security software. It then looks for certain information about your computer that might be used in a future attack. It uses the vulnerability described in CVE-2013-7331 to exploit your PC.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Internet Explorer.

You might get an alert about this threat even if you're not using vulnerable software. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

Exploit:JS/Sakra.A is file that is part of the Sakura exploit kit. This kit is used to infect your computer with different malware. It acts as a malware distributing platform by compromising websites; if you visit those websites, your computer may become infected with malware. It exploits vulnerabilities in different software to maximize the possibility of infection.

Java/Blacole.GN is a detection for a component of the Blackhole exploit kit - a kit used by attackers to distribute malware. Attackers install the kit onto a server, and then when you visit the compromised server, the kit attempts to exploit various, multiple vulnerabilities on your computer in order to install malware. For example, if you browsed a compromised website containing the exploit pack using a vulnerable computer, malware could be downloaded and installed onto your computer.

Typically, the Blackhole exploit kit attempts to exploit vulnerabilities in applications such as Oracle Java, Sun Java, Adobe Acrobat and Adobe Reader.

For more information on this exploit kit, and steps you can take to avoid being compromised, please see the detailed Blacole description, elsewhere in our encyclopedia.

Exploit:Java/CVE-2012-0507.ANG is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-0507) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 2 and earlier Java SE
• JDK and JRE 6 Update 30 and earlier Java SE
• JDK and JRE 5.0 Update 33 and earlier Java SE
• SDK and JRE 1.4.2_35 and earlier Java SE
• JavaFX 2.0.2 and earlier JavaFX

Exploit:JS/BlacoleJQ is a detection for a component of the Blackhole exploit kit - a kit used by attackers to distribute malware. Attackers install the kit onto a server, and then when you visit the compromised server, the kit attempts to exploit various, multiple vulnerabilities on your computer in order to install malware. For example, if you browsed a compromised website containing the exploit pack using a vulnerable computer, malware could be downloaded and installed onto your computer.

Typically, the Blackhole exploit kit attempts to exploit vulnerabilities in applications such as Oracle Java, Sun Java, Adobe Acrobat and Adobe Reader.

For more information on this exploit kit, and steps you can take to avoid being compromised, please see the detailed Blacole description, elsewhere in our encyclopedia.

Exploit:Java/CVE-2012-5076.GAA is a malicious Java applet that attempt to exploit a vulnerability (CVE-2012-5076) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-5076.GAA is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

JDK and JRE 7 Update 7 and earlier

Steps you can take

The nature of this threat means that you may need to take some steps to prevent being vulnerable from this, and similar exploits. We suggest you:

1. Clear the Java cache
2. Update Java
3. Remove older versions of Java

For detailed information about these steps, please see the Additional removal instructions below.

Exploit:Java/CVE-2011-3544.A is a malicious Java applet stored within a Java Archive (.JAR) file. It attempts to exploit a vulnerability in the Java Runtime Environment (JRE) component in Oracle JAVA SE JDK and JRE 7, 6 Update 27 and earlier. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to run arbitrary Java code outside of the "sandbox" environment.

More information about the vulnerability is available in the following articles:

• CVE-2011-3544
• Oracle Java SE Critical Patch Update Advisory - October 2011

Exploit:JS/Blacole.AD is a malicious JavaScript that attempts to exploit several vulnerabilities in Adobe Acrobat and Reader. If the exploit is successful in compromising a vulnerable host, it could result in downloading and executing other malware. Exploit:JS/Blacole.AD is a component of an exploit kit that is distributed as the "Blackhole exploit pack".

Microsoft security software detects and removes this threat.

This malicious JavaScript code can use vulnerable versions of Java, Adobe Reader, and Adobe Flash to load other malware onto your computer.

You can be infected with this threat if you visit a malicious or compromised webpage.

Windows Defender detects and removes this threat.

This is a maliciously-constructed Open Type font which is used to exploit the OpenType Font Driver Vulnerability - CVE-2015-2426.

It affects the following Windows versions:

• Windows Vista SP2
• Windows Server 2008 SP2 and R2 SP1
• Windows 7 SP1
• Windows 8
• Windows 8.1
• Windows Server 2012 and R2
• Windows RT 8.1
• Windows 10

Find out ways that malware can get on your PC.

Exploit:SWF/CVE-2011-2110.A is a detection for specially-crafted Shockwave Flash (.SWF) files that attempt to exploit software vulnerabilities in Adobe Flash Player and Adobe Reader and Acrobat X.

Exploit:HTML/Bankfraud is generic detection for e-mail that contains malicious links or other characteristics indicative of a phishing attack.