Exploit:SWF/CVE-2011-0609

(?)

Encyclopedia entry
Updated: Apr 17, 2011 | Published: Mar 16, 2011

Aliases

CVE-2011-0609

other

APSA11-01 (other)

Alert Level (?)
Severe

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.

Detection initially created:
Definition: 1.99.1311.0
Released: Mar 16, 2011

Summary

Exploit:SWF/CVE-2011-0609 is a detection for specially crafted Adobe Shockwave flash (.SWF) files that attempt to exploit vulnerabilities in Adobe Flash discussed in CVE-2011-0609 and Adobe Security Advisory APSA11-01.

Top

Symptoms

Alert notifications or detections of this malware from installed antivirus or security software may be the only other symptoms.

Top

Technical Information (Analysis)

In the wild, this exploit has been observed to be decrypted and loaded at runtime by flash files detected as Exploit:Win32/Shellcode.G or Exploit:Win32/Shellcode.H. The embedded shellcode, once executed, will drop and execute an executable as its main payload. At the time of this writing, the payload drops and executes malware detected as Backdoor:Win32/Poison.M.

Additional Information

Exploit:Win32/Shellcode.G and Exploit:Win32/Shellcode.H were found embedded within Microsoft Excel and Word data files and distributed as an attachment detected as Trojan:Win32/Malfws.A or Trojan:Win32/Malfws.B.

Analysis by Marian Radu

Top

Prevention

Take these steps to help prevent infection on your computer.

Top

Recovery

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Top


	Provide feedback Please note: While your feedback is very important to us, we do not respond to individual submissions through this channel. Feedback, requests, or questions submitted through this form are monitored, however responses are not generated. If you require support, please visit the Safety & Security Center.