Java/CVE-2010-0094 is a family of malicious Java applets stored within a Java Archive (.JAR) that attempts to exploit a vulnerability in the Java Runtime Environment (JRE) up to and including version 6 update 18. The vulnerability allows an unsigned Java applet to gain elevated privileges and potentially have unrestricted access to a host system outside its "sandbox" environment. It is discussed in CVE-2010-0094.

Windows Defender detects and removes this threat.

This threat uses a Microsoft vulnerability to download and run files on your PC, including other malware. It is also called the "Sandworm" vulnerability or the "Windows OLE Remote Code Execution Vulnerability".

You can read more and apply updates to prevent exploiting this vulnerability in Microsoft Security Bulletin MS14-060.

It runs if you try to open an Office document and have one of the following vulnerable versions Windows:

• Windows 8.1
• Windows 8
• Windows 7 SP1
• Windows Vista SP2
• Windows RT 8.1
• Windows RT
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2008 SP2
• Windows Server 2008 R2 SP1

You may get an alert about this threat even if you're not using a vulnerable version of the application. This is because we detect when a website or file tries to use the vulnerability, even if it isn't successful.

Exploit:Java/CVE-2011-3544 is a family of malicious Java applets that attempt to exploit a vulnerability in the Java Runtime Environment (JRE) in order to download and install files of an attacker's choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2011-3544 is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier are all vulnerable to this exploit.

Windows Defender detects and removes this threat.

This threat uses a Java vulnerability to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.

The following versions of Java are vulnerable:

• Java Runtime Environment of Oracle Java SE 7 Update 17 and earlier
• OpenJDK version 6 and version 7

To check if you're running a vulnerable version of Java:

1. In Control Panel, double-click Programs.
2. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
3. On the General tab, click About to see which version of Java you have installed.

You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

Exploit:Java/CVE-2013-0422 is a malicious Java applet that attempts to exploit a vulnerability (CVE-2013-0422) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. Note, however, that a number of legitimate websites could be compromised or unwillingly host a malicious applet through advertising frames which could redirect to or host a malicious Java applet.

Update vulnerable Java applications

This threat exploits a known vulnerability in Java. After removing this threat, make sure that you install the updates available from the vendor. You can read more about this vulnerability in Java, as well as where to download the software update from the following links:

• CVE-2013-0422
• Java Download

It may be necessary to remove older versions of Java that are still present. Keeping old and unsupported versions of Java on your system presents a serious security risk. To read more about why you should remove older versions of Java, see the following information.

• Remove older versions of Java

Exploit:Java/CVE-2012-4681.F is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.F is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Exploit:Java/CVE-2012-4681.SQ is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.SQ is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Exploit:SWF/CVE-2012-1535.A is malicious code that attempts to exploit a vulnerability in Adobe Flash Player by using a Microsoft Word document, in order to download and install files of an attacker's choice onto your computer, and perform denial of service attacks.

Note: There is no Microsoft Word vulnerability involved with this exploitation process.

Exploit:Win32/CVE-2012-1889.A allows an attacker to download and run arbitrary files on your computer.

Make sure you install all available updates from Microsoft to avoid this exploit. For more information on updating Microsoft products please see the Additional information section in this entry.

More details on the vulnerability, including a list of affected Microsoft software, can be found in Microsoft Security Bulletin MS12-043.

Exploit:Win32/CVE-2012-1889.A is the detection for JavaScript code that attempts to exploit a vulnerability in Microsoft XML Core Services versions 3.0, 4.0, 5.0 and 6.0 (described in CVE-2012-1889).

Exploit:Win32/CVE-2012-0002.A is the detection for Proof-of-Concept code that exploits a vulnerability in the Remote Desktop Protocol (RDP). The vulnerability, discussed in CVE-2012-0002, could allow remote code execution and was resolved with the release of Microsoft Security Bulletin MS12-002.

Exploit:Win32/CVE-2012-0002.A is the detection for a utility that exploits a vulnerability in the Remote Desktop Protocol (RDP). The vulnerability, discussed in CVE-2012-0002, could allow remote code execution and was resolved with the release of Microsoft Security Bulletin MS12-002.

Exploit:Java/CVE-2012-0507.ZR is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-0507) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

The following versions of Java are vulnerable to this exploit:

• JDK and JRE 7 Update 2 and earlier Java SE
• JDK and JRE 6 Update 30 and earlier Java SE
• JDK and JRE 5.0 Update 33 and earlier Java SE
• SDK and JRE 1.4.2_35 and earlier Java SE
• JavaFX 2.0.2 and earlier JavaFX

Windows Defender Antivirus detects and removes this threat. 

This threat uses a Java vulnerability to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.

The following versions of Java are vulnerable:

• JDK and JRE 7 Update 2 and earlier Java SE
• JDK and JRE 6 Update 30 and earlier Java SE
• JDK and JRE 5.0 Update 33 and earlier Java SE
• SDK and JRE 1.4.2_35 and earlier Java SE
• JavaFX 2.0.2 and earlier JavaFX

To check if you're running a vulnerable version of Java:

1. In Control Panel, double-click Programs.
2. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
3. On the General tab, click About to see which version of Java you have installed.

You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

Find out ways that malware can get on your PC.

Windows Defender detects and removes this threat.

This threat uses a Microsoft vulnerability to download and run files on your PC, including other malware. It is also called the "MSCOMCTL.OCX RCE Vulnerability".

It runs if you visit a website, use an Office document or .rtf file (Word document), and have a vulnerable version of the following applications on your PC:

• Microsoft Office 2003 SP3
• Microsoft Office 2003 Web Components SP3
• Microsoft Office 2007 SP2 and SP3
• Microsoft Office 2010 Gold and SP1

It is most often distributed through emails.

You might get an alert about this threat even if you're not using a vulnerable version of the application. This is because we detect when a website or file tries to use the vulnerability, even if it isn't successful.

Exploit:Java/CVE-2012-4681.SU is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.SU is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.

Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.

Microsoft security software detects and removes this threat.

This threat uses a software vulnerability to download and run other files on your PC, including malware.

It runs when you visit a hacked website and you have a vulnerable version of Java. A number of legitimate websites could be hacked to unwillingly host this threat.

The following versions of Java are vulnerable:

• Oracle Java JDK and JRE 7 Update 5 and earlier
• JRE 6 Update 34 and earlier

To check if you're running a vulnerable version of Java:

1. Go to the control panel (Select Start then Control Panel)
2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
3. On the General tab, click About to see which version of Java you have installed.

You might get a detection for this threat when you visit a website that has the malicious code, even if you're not using a vulnerable version of Java. This doesn't mean that you have been compromised; it means an attempt to hack into your PC has been made.

The vulnerability that this threat exploits is described in CVE-2012-4681.