Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
1504 entries found. Displaying page 19 of 76.
Updated on Apr 28, 2008
TrojanDownloader:Win32/Cutwail.S is a trojan that drops malicious files onto an affected machine and contacts a remote IP address.
Alert level: severe
Updated on Jul 27, 2009
PWS:Win32/Paymilon.A is a trojan password stealer. The trojan captures e-mail configuration details and stores them as a file locally and may attempt to connect to the domain 'pay.militarypayonline.net'. The domain is registered to a user located in Asia.
Alert level: severe
Updated on Dec 21, 2009
Worm:Win32/Ambler.A is a worm that spreads via networked and removable drives, and attempts to steal sensitive information, such as passwords, from an affected computer.
Alert level: severe
Updated on Aug 16, 2011
Backdoor:Win32/Canoswei.A is a trojan that allows unauthorized access and control of an affected computer.
Alert level: severe
Updated on Oct 03, 2011

Exploit:Java/CVE-2009-3869.R is the detection for malicious Java applets that exploits a stack overflow vulnerability in the Java Runtime Environment (JRE) versions 5 and 6 and described in CVE-2009-3869.

Alert level: severe
Updated on Jan 05, 2012

Exploit:Java/CVE-2011-3544.N is a malicious Java applet stored within a Java Archive (.JAR) file. It attempts to exploit a vulnerability in the Java Runtime Environment (JRE) component in Oracle JAVA SE JDK and JRE 7, 6 Update 27 and earlier. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to run arbitrary Java code outside of the "sandbox" environment.

Alert level: severe
Updated on Mar 22, 2012

TrojanDownloader:Java/Rexec.H is a Java-based trojan that is generated by the "Blackhole" exploit kit, and may download and execute other malware.

Alert level: severe
Updated on Jun 20, 2012

Virus:Win64/Sirefef.B is the 64-bit user-mode component of Win32/Sirefef - a multi-component family of malware that moderates your Internet experience by changing search results and generating pay-per-click advertising revenue for its controllers. The family consists of multiple parts that perform different functions, such as downloading updates and additional components, hiding existing components, or performing a payload.

Caution: Win32/Sirefef is a dangerous threat that uses advanced stealth techniques in order to hinder its detection and removal. If you are infected with Sirefef, we recommend you take the following steps to remove this threat from your computer:

Before you begin you will need:

- A computer that is not infected and is connected to the Internet. You will use this computer to download a copy of the Microsoft Safety Scanner
- A blank CD, DVD or USB drive. You will use this CD, DVD or USB drive to run the Scanner on your infected computer 

  1. Download a copy of the Microsoft Safety Scanner from a clean, uninfected computer
  2. Save a copy of the Scanner on a blank CD, DVD, or USB drive
  3. Restart the infected computer
  4. Insert the CD, DVD, or USB drive into your infected computer and run the Scanner
  5. Let the Scanner clean your computer and remove any infections it finds

After running the Scanner, ensure that your antivirus product is up-to-date. You can update Microsoft security products by downloading the latest definitions at this link: Get the latest definitions.

As a consequence of being infected with this threat, you may need to repair and reconfigure some Windows security features. Please see Additional remediation steps in this entry for more information.

Alert level: severe
Updated on Jun 20, 2012

Virus:Win32/Sirefef.R is a detection for Windows system drivers that are modified to perform certain behaviors, such as downloading and executing arbitrary files. This malware is a component of Win32/Sirefef - a multi-component family of malware that moderates an affected user's Internet experience by modifying search results, and generates pay-per-click advertising revenue for its controllers. The family consists of multiple parts that perform different functions, such as downloading updates and additional components, hiding existing components or performing the payload.

Caution: Win32/Sirefef is a dangerous threat that uses advanced stealth techniques in order to hinder its detection and removal. If you are infected with Sirefef, we recommend you take the following steps to remove this threat from your computer:

Before you begin you will need:

- A computer that is not infected and is connected to the Internet. You will use this computer to download a copy of the Microsoft Safety Scanner
- A blank CD, DVD or USB drive. You will use this CD, DVD or USB drive to run the Scanner on your infected computer 

  1. Download a copy of the Microsoft Safety Scanner from a clean, uninfected computer
  2. Save a copy of the Scanner on a blank CD, DVD, or USB drive
  3. Restart the infected computer
  4. Insert the CD, DVD, or USB drive into your infected computer and run the Scanner
  5. Let the Scanner clean your computer and remove any infections it finds

After running the Scanner, ensure that your antivirus product is up-to-date. You can update Microsoft security products by downloading the latest definitions at this link: Get the latest definitions.

As a consequence of being infected with this threat, you may need to repair and reconfigure some Windows security features. Please see Additional remediation steps in this entry for more information.

Alert level: severe
Updated on Jun 26, 2012

Exploit:Java/CVE-2012-0507.CG is a variant of the Exploit:Java/CVE-2012-0507 family - a family of malicious Java applets that exploit a vulnerability in the Java Runtime Environment (JRE) up to and including version 7, update 2 (described in CVE-2012-0507).

The Java applet, detected as Exploit:Java/CVE-2012-0507.CG, will attempt to trigger the CVE-2012-0507 vulnerability, which allows the Java applet to run with elevated privileges so that it can download and run files from a remote host.

The files that are downloaded and run could be any of the attacker's choice and could include additional malware.

For an explanation of Java applets, Java classes and elevated privileges, please see the Additional information section in this entry.

Alert level: severe
Updated on May 19, 2015

Windows Defender detects and removes this threat.

This threat can give a malicious hacker unauthorized access and control of your PC.

Find out ways that malware can get on your PC.

Alert level: severe
Updated on Nov 29, 2004
TrojanDownloader:Java/OpenConnection.F is a malicious Java applet that downloads and runs other malicious files from a remote Web site. The downloader often works with Java/Classloader and Java/Bytverify, which exploit the vulnerability addressed in Microsoft Security Update MS03-011.
Alert level: severe
Updated on Jul 14, 2005
TrojanDownloader:Java/OpenConnection.L is a  Java applet that attempts to download and execute files from a malicious web site. It often works in conjunction with Java/Classloader and Java/Bytverify that exploit a vulnerability in the ByteCode verifier component of the Microsoft VM, as described and fixed in MS03-011.
Alert level: severe
Updated on Oct 12, 2005
TrojanProxy:Win32/Mitglieder.AA is a backdoor Trojan that targets computers running certain versions of Microsoft Windows. The Trojan injects its code into the Windows Explorer process explorer.exe. The Trojan monitors a randomly chosen TCP port for commands from attackers. Attackers can use the computer as a Web and SMTP proxy. 
Alert level: severe
Updated on Nov 08, 2006
Exploit:HTML/Meloits.A is an HTML exploit of a vulnerability found in Visual Studio 2005 which could allow an attacker to remotely execute arbitrary code on impacted systems. Details on this vulnerability can be found in Microsoft Security Advisory (927709) at  http://www.microsoft.com/technet/security/advisory/927709.mspx
Alert level: severe
Updated on Mar 29, 2007
TrojanDownloader:Java/OpenConnection.M is a  Java applet that attempts to download and execute files from a malicious web site. It often works in conjunction with Java/Classloader and Java/Bytverify that exploit a vulnerability in the ByteCode verifier component of the Microsoft VM, as described and fixed in MS03-011.
Alert level: severe
Updated on Mar 29, 2007
TrojanDownloader:Java/OpenConnection.P is a  Java applet that attempts to download and execute files from a malicious web site. It often works in conjunction with Java/Classloader and Java/Bytverify that exploit a vulnerability in the ByteCode verifier component of the Microsoft VM, as described and fixed in MS03-011.
Alert level: severe
Updated on Mar 29, 2007
TrojanDownloader:Java/OpenConnection.Q is a  Java applet that attempts to download and execute files from a malicious web site. It often works in conjunction with Java/Classloader and Java/Bytverify that exploit a vulnerability in the ByteCode verifier component of the Microsoft VM, as described and fixed in MS03-011.
Alert level: severe
Updated on Jul 09, 2007
Win32/Nuwar is a family of Trojan droppers that installs a distributed peer-to-peer (P2P) downloader Trojan. This downloader Trojan in turn downloads a copy of a mass-spamming Trojan which further distributes the malware.
 
On July 8, 2007, large numbers of Win32/Nuwar were mass-spammed in email masquerading as a virus warning from the recipient's ISP. The email included a link pointing to a remote Web site which, when clicked, attempted to download and run the Trojan on recipients' systems. The downloaded Trojan is detected by Microsoft as Worm:Win32/Nuwar.JT.
Alert level: severe
Updated on Aug 08, 2007
Trojan:JS/Agent.FA is malicious Javascript embedded in a Web page. The Javascript is designed to circumvent popup blocking by security applications.
Alert level: high