Microsoft security software detects and removes this threat.

This threat uses a vulnerability in your software to download other malware.

It runs when you visit a hacked website and you have a vulnerable version of Java installed on your PC. A number of legitimate websites could be hacked or unwillingly host this threat.

The following versions of Java are vulnerable:

  • Oracle Java SE and Java for Business 6 Update 18 and earlier

To check if you're running a vulnerable version of Java:

  1. Go to the control panel (Select Start then Control Panel)
  2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You might get a detection for this threat if you visit a website that has the malicious code, even if you're not using a vulnerable version of Java. This doesn't mean that you have been hacked; it means someone has tried to hack into your PC.

The vulnerability that this threat exploits is described in CVE-2010-0840.

Find out ways that malware can get on your PC.

What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Clearing your temporary Internet files

You should delete your temporary Internet files so your security software doesn't continue to detect this threat:

Get more help

You can also see our advanced troubleshooting page for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (CVE) gives each vulnerability a unique number, in this case "CVE-2010-0840". The portion "2010" refers to the year the vulnerability was discovered, and "0840" is a unique ID for this specific vulnerability. You can find more information on the CVE website.


Downloads and installs files

This threat can download and run files, including other malware, under your security context.

The malware is contained in a .class file or multiple .class files, depending on the variant. It may download and run malicious programs from a specified URL.

Usually the files are downloaded in the temporary folder (%TEMP%) with a random name, and run from there.

Additional technical details

Exploit:Java/CVE-2010-0840 uses a problem in java.beans.Expression class to run privileged code from untrusted Java code like Java applets. The problem is related to how Java trusted code checks for the privilege of current context when it is called. It checks the call stack to make sure the caller is from trusted code when it is running sensitive code which requires additional privileges.

The exploit abuses the java.util.Map interface and javax.swing.JList class in a way that a subclass of java.beans.Expression is called with additional privilege. Java.util.Map is an interface that defines data interface that deal with map entries. The exploit declares a class that implements the java.util.Map interface. That malicious class is also declared as a subclass of java.beans.Expression.

The java.beans.Expression class can do reflection operations. You can define what method from which class is called when the class is instantiated. The actual method call is done when the getValue method from this class is called.

GetValue is also defined with the java.util.Map interface. If the inherited class doesn’t implement this method, the getValue method from the java.beans.Expression class is regarded as an implementation of the java.util.Map interface.

The problem happens when this malicious class is passed to javax.swing.JList class and the JList UI is added to current Java applet main UI. The JRE system will try to render the JList interface and will instantiate the user-supplied malicious java.beans.Expression subclass. After the exploit succeeds, privileged code will be run with trusted privilege and the payload will be dropped and run.

Exploit:Java/CVE-2010-0840 attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU type and operating system, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).

Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on, for example Windows, MacOS, Linux, etc.

Usually exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.

The following are some examples of files that exploit the vulnerability described in CVE-2010-0840:

  • 29c7430b8501eea07c56a0d6476d141a62e16a47
    • Dot.class
    • ll.class
    • lz.class
    • ra.class
    • rb.class
    • rc.class
    • rd.class
  • cb8b76d1ca4bce532563e01abae54c511356e8d1
    • k.class
    • pak\g.class
    • pak\j.class
    • pak\k.class
    • pak\n.class
    • pak\o.class
    • pak\r.class
    • pak\u.class
    • pak\wall.class
  • 0af9c001d2f1710937c4bca40b0842db790e6873
    • hfoakzwaeckdtaxhb
    • hfoakzwaeckdtaxhb\gsfuhfudix.class
    • hfoakzwaeckdtaxhb\opzzvdcuivyoh.class
    • hfoakzwaeckdtaxhb\rsvgabavifqllqqcuotuvlaq.class
    • hfoakzwaeckdtaxhb\uvgfvcfafqdyq.class
    • hfoakzwaeckdtaxhb\yqztllubezlaot.class
  • 306d9f8f393891397231572dd52306015f3d701b
    • cale\calecalea1.class
    • cale\calecalea.class
    • cale\CLEA.class
  • 311d6347da67dbc6e10237eff73e03a67d248a5d
    • datas\Jocker.class
    • datas\Joz7.class
    • datas\SquarePants.class
    • datas\wall1.class
    • datas\wallzordo.class
    • datas\wall.class
    • datas\Zom.class
    • datas\Zonkeys.class
  • 61e664065d5695d26accd4392030b10c58a2a159
    • a.class
    • asa.class
    • b.class
    • c.class
    • d.class

Once the exploit has full privileges on your PC, it may:

  • Run an executable file (that may be detected as malware) included in the JAR
  • Run an executable file from (that may be detected as malware) a URL hardcoded in the exploit's file
  • Take instructions from the HTML file (like a URL to the malware executable) that loaded them

Analysis by Andrei Florin Saygo and Jeong Wook Oh


Alerts from your security software may be the only symptom.


Alert level: Severe
First detected by definition: 1.97.1814.0
Latest detected by definition: 1.191.4746.0 and higher
First detected on: Feb 15, 2011
This entry was first published on: Sep 28, 2011
This entry was updated on: Aug 22, 2014

This threat is also detected as:
  • EXP/CVE-2010-0094.F.67 (Avira)
  • Exploit.CVE2010-0840.2 (Dr.Web)
  • Exploit.Java.Agent.fd (Kaspersky)
  • Java/Agent.CU (Norman)
  • Mal/JavaHel-B (Sophos)