Microsoft security software detects and removes this threat.

This threat uses a software vulnerability to download and run other files on your PC, including malware.

It runs when you visit a hacked website and you have a vulnerable version of Java. A number of legitimate websites could be hacked to unwillingly host this threat.

The following versions of Java are vulnerable:

• Oracle Java JDK and JRE 7 Update 5 and earlier
• JRE 6 Update 34 and earlier

To check if you're running a vulnerable version of Java:

1. Go to the control panel (Select Start then Control Panel)
2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
3. On the General tab, click About to see which version of Java you have installed.

You might get a detection for this threat when you visit a website that has the malicious code, even if you're not using a vulnerable version of Java. This doesn't mean that you have been compromised; it means an attempt to hack into your PC has been made.

The vulnerability that this threat exploits is described in CVE-2012-4681.

Exploit:Java/CVE-2012-1723.FW is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:SWF/CVE-2012-0754.B is a detection for a PDF file which exploits a vulnerability in Adobe Flash Player. If you view the file in Adobe Acrobat Reader, it passes a file to Adobe Flash Player; if this occurs in a vulnerable version of Adobe Flash Player, it will drop and execute malicious files on your computer.

Exploit:Win32/CVE-2012-4969.D is a special crafted JavaScript, which takes advantage of a vulnerability in Internet Explorer versions 6 to 9. The vulnerability is described in detail in CVE-2012-4969. A Fixit has been released to resolve the issue. More information is available in Microsoft Security Advisory 2757760.

Windows Defender detects and removes this threat.

This threat uses maliciously crafted JavaScript to exploit an Internet Explorer vulnerability.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Internet Explorer.

The following Internet Explorer versions are vulnerable:

• Internet Explorer 6
• Internet Explorer 7
• Internet Explorer 8

Exploit:Java/CVE-2012-1723 is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 4 and earlier Java SE
• JDK and JRE 6 Update 32 and earlier Java SE
• JDK and JRE 5.0 Update 35 and earlier Java SE
• SDK and JRE 1.4.2_37 and earlier Java SE

Exploit:Java/CVE-2012-1723.A allows an attacker to gain access to and run arbitrary files on your computer.

Make sure you install all available updates from Java to avoid this exploit. For more information on updating Java please see the Additional information section in this entry.

Exploit:Java/CVE-2012-1723.A is the detection for malicious JavaScript code that attempts to exploit a vulnerability in the Java Runtime Environment (JRE) up to and including version 7, update 4 (described in CVE-2012-1723). 

Windows Defender detects and removes this threat.

This threat uses a Microsoft Office vulnerability to download and run files on your PC, including other malware.

It runs if you visit a website, use an Microsoft Office document or .rtf file (Word document), and have a vulnerable version of one of the following applications on your PC:

• Microsoft Word 2003 SP3
• Microsoft Word 2007 SP2 and SP3
• Microsoft Office 2008 for Mac
• Microsoft Office 2011 for Mac
• Microsoft Compatibility Pack SP2 and SP3

It is most often distributed through emails, but it might also be hosted on a website or distributed on network shares.

You might get an alert about this threat even if you're not using a vulnerable version of the application. This is because we detect when a website or file tries to use the vulnerability, even if it isn't successful.

Exploit:Java/CVE-2012-0507.A is the detection for a malicious Java applet stored within a Java archive (.JAR) that attempts to exploit a vulnerability in the Java Runtime Environment (JRE) up to and including versions 7 update 2, versions 6 update 30 and versions 5 update 33. The vulnerability is described in CVE-2012-0507.

Exploit:Java/CVE-2012-4681.GJ is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.GJ is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Exploit:Java/CVE-2012-4681.QN is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.QN is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.