Hans is quick, as usual.
It's quite recent, even though it seems like the vulnerability is of last year; could be because of variants of the same exploit. As you know
when we see variants of, for example Blacole (in this case Java/Blacole), Blacole.AB, Blacole.AC etc. they usually don't write much about it. And thus it is often no use trying to track down information about a specific variant, even though I understand that that's what users are most likely to do when they get an AV alert. There could of course be important differences between the variants, so I wouldn't say it's no use.
As mentioned by Hans, and as you have found, it seems to be related to CVE-2011-3544.
When an exploit is found it's usually added to different packages that hackers use. When people are using un-patched versions of software it's then very easy to exploit such vulnerabilities. As mentioned at one page below (quoting MSFT), between 2010 and 2011 "between one-third and one-half of all exploits observed [by MSFT] in each quarter were Java exploits".
That's quite many...
The Blackhole exploit pack is one such package, which attempts to exploit different vulnerabilities. It's used, installed, on servers and exploits vulnerabilities in clients. Could be the Flash Player or Java etc.
Here is
what MSFT's MPC has to say about Blackhole, though not that important in this specific case it helps understanding what Blacole.EM is. (There is a screen shot from the Blackhole exploit control panel at the page at F-Secure below.)
Back to this particular exploit, I don't know which pages you have looked at (since you didn't mention
), but for example
the US National Vulnerability Database says:
"Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service".
For most of these exploits I wouldn't limit the damage to compromising other sites using Java, since they, if successful, many times can download other malware, as we shall see. It's just used to open the door.
Here are some pages from Brian Krebs' blog, with a little more reading, perhaps explaining the background a bit better than short entries in different virus encyclopaedias etc.:
http://krebsonsecurity.com/2011/11/new- ... loit-kits/
http://krebsonsecurity.com/2011/11/publ ... eat-level/
The CVE-2011-3544 vulnerability was also used in the hack of Amnesty International‘s homepage in the UK December last year.
http://krebsonsecurity.com/2011/12/amne ... a-exploit/
Apparently it went on and downloaded a key logger and who knows what.
F-Secure, in their "News from the Lab" blog, mentioned the CVE-2011-3544/Java Rhino vulnerability, around the same time as above, and also commented on the need and use of Java. As mentioned above by Krebs and MSFT, Java is under constant attack. (I mentioned the F-Secure post earlier
here.)
For quite some time it seems like the OS or software such as Word or Excel isn't the main target; instead it's software such as Java, Flash and Adobe Reader. Thus it's important to keep these updated, but I'm sure you do that. And I see you already got that advice at MSFT.
Byelingual When you speak two languages but start losing vocabulary in both of them.
I have also run Malwarebytes which shows a clean pc. 
So, what does this Blacole do if it gets established ... can it compromise banking where for example, the bank utilise Java in their security account proceedures.
But how could we manage without our 'cuddly toys' in this modern age ... even old folk like me. So, I for one, will continue looking at the world on a screen but being very sure that I have all programmes etc as up-to-date as I can based on advice from MS and the various vendors. Secunia is also a good way of getting advice.
its back!