Exploit:HTML/AdoStream is a generic detection for malicious JavaScript or VBScripts embedded inside HTML pages. These scripts takes advantage of the ADODB.Stream functionality in ActiveX, combined with known security vulnerabilities in Microsoft Internet Explorer, in order to download and install other malwares onto a computer.

Exploit:SWF/CVE-2011-0611.C is the detection for specially crafted Shockwave Flash (SWF) files that attempt to exploit a vulnerability in Adobe Flash Player that could lead to the execution of arbitrary code. The vulnerability is described in CVE-2011-0611 and Adobe Security Advisory APSA11-02.

Exploit:Java/CVE-2012-1723.BPE is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:Java/CVE-2012-1723.GA is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:Win32/Pdfjsc.ADY is a malicious PDF file that exploits a vulnerability in Adobe Acrobat and Adobe Reader.

The vulnerabilities, discussed in CVE-2010-0188, allow this malware to download and run arbitrary files, including malware from the following families:

• Trojan:Win32/Simda
• Win32/Zegost (for example, Backdoor:Win32/Zegost.F)
• Win32/Carberp
• Win32/Fareit
• Trojan:Win32/Lockscreen
• Trojan:Win32/Ransom
• Trojan:Win32/Reveton
• Win32/Winwebsec
• Win32/Zbot

The following versions of Adobe Acrobat and Adobe Reader are vulnerable to this exploit:

• Adobe Acrobat and Adobe Reader earlier than 8.2.1
• Adobe Acrobat and Adobe Reader earlier than 9.3.1

Install updates to prevent infection

This malware exploits known vulnerabilities.

You should always install the latest updates available from Adobe to prevent reinfection from this threat, and possible infection from other threats.

Download updates for Adobe products from the following link:

• Updating Software

Exploit:Java/CVE-2012-4681.AET is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.AET is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Exploit:Java/CVE-2012-1723.ZVC is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:Java/CVE-2012-1723.BVP is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:Win32/Pdfjsc.AEW is a malicious PDF file that exploits a vulnerability in Adobe Acrobat and Adobe Reader.

The vulnerabilities, discussed in CVE-2010-0188, allow this malware to download and run arbitrary files.

The following versions of Adobe Acrobat and Adobe Reader are vulnerable to this exploit:

• Adobe Acrobat and Adobe Reader earlier than 8.2.1
• Adobe Acrobat and Adobe Reader earlier than 9.3.1

Install updates to prevent infection

This malware exploits known vulnerabilities.

You should always install the latest updates available from the software vendor to prevent reinfection from this threat, and possible infection from other threats.

Download updates for Adobe products from the following link:

• Updating Software

Exploit:Java/CVE-2012-4681.SS is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.SS is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Exploit:JS/ShellCode.J is a generic detection for JavaScript objects that construct shellcode. These scripts may be embedded within other document files such as specially-crafted .PDF files, for example.

 

This detection also includes malicious JavaScript that attempts to exploit an uninitialized memory corruption vulnerability (CVE-2010-0806) that allows the execution of arbitrary code. Microsoft released Microsoft Security Bulletin MS10-018 to mitigate this vulnerability.

Exploit:Win32/CVE-2010-0817 is the detection for a file that may try to exploit a cross-site scripting (XSS) vulnerability in the file "help.aspx" in Microsoft SharePoint Server 2007.

Exploit:Java/CVE-2008-5353.EQ is based on a vulnerability which affects Java Virtual Machine (JVM) up to and including version 6 update 10. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to a host system, outside its "sand box" environment.

Exploit:Win32/CVE-2010-2883.A is a generic detection for specially-crafted PDF files that attempt to exploit the Acrobat SING Table Handling vulnerability CVE-2010-2883. Successful exploitation may lead to denial of service or execution of arbitrary code.

Exploit:Win32/Owapwn.B exploits a vulnerability discussed in CVE-2010-3213 affecting Outlook Web Access 2007. This vulnerability was resolved in Outlook Web Access 2010, and Outlook Web Access 2007 Service Pack 3. 

Exploit:Java/CVE-2008-5353.QZ is a detection for an exploit that is based on a vulnerability which affects Java Virtual Machine (JVM) version 5 up to and including update 22, as well as version 6 up to and including update 10. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to a host system, outside its "sand box" environment.

Exploit:Win32/Pdfjsc.FM is the detection for a specially crafted PDF file that exploits a vulnerability in Adobe Acrobat and Adobe Reader. This file only successfully exploits computer that are affected by the Adobe Acrobat and Adobe Reader vulnerability discussed in CVE-2009-1492.

Exploit:Win32/CVE-2010-1885.gen is a generic detection for a cross-site scripting method that exploits a vulnerability (CVE-2010-1885) in Windows Help and Support Center that could allow an attacker to run arbitrary code on the local computer.

Exploit:Java/CVE-2008-5353.SV is a detection for an exploit that is based on a vulnerability which affects Java Virtual Machine (JVM) version 5 up to and including update 22, as well as version 6 up to and including update 10. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to a host system, outside its "sand box" environment.