Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
Workaround for the WMF Vulnerability
Posted on 29-Dec-2005 13:40 by M Freitas | Tags Filed under: Blog



There is a very serious security vulnerability going around right now, and it will infect computers by downloading trojan malware if you visit a malicious website with a specially formed image file (WMF), or show an infected .wmf file on your e-mail or your hard disk.

The exploit is currently being used to distribute the Trojan-Downloader.Win32.Agent.abs, Trojan-Dropper.Win32.Small.zp, Trojan.Win32.Small.ga and Trojan.Win32.Small.ev.

F-Secure has more information here and here. More information is available from Secunia as well.

Some sites with this exploit are crackz [dot] ws, unionseek [dot] com, www.tfcco [dot] com, Iframeurl [dot] biz, beehappyy [dot] biz. These should be blocked at your proxy or DNS Hosts file.

A workaround (while Microsoft does not release a patch) is to un-register the library processing these files by running regsvr32 /u shimgvw.dll from the command line. This will prevent your PC being infected, but it will also remove the ability to show thumbnails in File Explorer. Once Microsoft has released a patch you can restablish this library by running regsvr32 shimgvw.dll.

You should also not open or preview untrusted ".wmf" files and set security level to "High" in Microsoft Internet Explorer.

Systems affected include:

  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows Small Business Server 2003
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows Small Business Server 2003
  • Microsoft Windows Storage Server 2003
  • Microsoft Windows XP Tablet PC
  • Microsoft Windows XP Media Center 2004/2005
  • Microsoft Windows Server 2003 R2 Enterprise Edition
  • Microsoft Windows Server 2003 R2 Standard Edition







  • comments powered by Disqus


    Trending now »

    Hot discussions in our forums right now:

    Driving an automatic - do you use one foot or both?
    Created by geekIT, last reply by Geektastic on 22-Sep-2017 23:25 (134 replies)
    Pages... 7 8 9


    iPhone 8/iPhone X, impressions?
    Created by surfisup1000, last reply by mattwnz on 23-Sep-2017 00:08 (401 replies)
    Pages... 25 26 27


    Auckland Airport fuel supply obliterated by digger
    Created by Batman, last reply by k1wi on 23-Sep-2017 03:12 (220 replies)
    Pages... 13 14 15


    How to backup/copy an iphone app?
    Created by Batman, last reply by scuwp on 19-Sep-2017 19:37 (24 replies)
    Pages... 2


    Mighty Ape Birthday hunt 2017
    Created by ThePlague, last reply by joshhill96 on 21-Sep-2017 23:11 (22 replies)
    Pages... 2


    IOS 11 email client and Office 365 - heads up people
    Created by gjm, last reply by mattwnz on 20-Sep-2017 17:15 (18 replies)
    Pages... 2


    When did we become America
    Created by BTR, last reply by Fred99 on 22-Sep-2017 12:12 (66 replies)
    Pages... 3 4 5


    Sky blames piracy for lost customers. Sky: it's time to wake up and smell the coffee.
    Created by kingdragonfly, last reply by Rikkitic on 21-Sep-2017 11:10 (482 replies)
    Pages... 31 32 33