|Detected||Dec 09 2010 07:44 GMT|
|Released||Dec 09 2010 12:40 GMT|
|Published||Mar 25 2011 09:46 GMT|
This malware is a component of a Trojan, which downloads files from the Internet without the user's knowledge. It is a Java class file. It is 672 bytes in size.
The malware is a Java class file named "KAVS" and it is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family. This class file is designed to exploit a vulnerability (CVE-2010-0840). JDK and JRE up to version 6, 18th update, are vulnerable. The vulnerability appears due to improper verification when executing privileged methods in Java Runtime Environment; this enables the malicious user to execute a random code with a specially modified object, which is a subclass file of the trusted class file. In this case the "KAVS" class file inherits the "getValue()" method of the "Expression" class file. Such inheritance cannot be executed directly from the malicious class file, which is a subclass file of non-privileged "Applet" class file. This way the Trojan is able to use the "getValue()" method to execute its malicious activity.
If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.