 How To Protect Yourself From The Windows Metafile Vulnerability |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. How to use the self-help guides
This forum contains self-help guides on removing common malware and viruses. These guides can be advanced so please use them at your own risk.
If after following the self-help guide, or you can not find an appropriate guide, then you can receive step-by-step instructions directly from one of our experts by following the instructions in this topic: Preparation Guide For Use Before Posting A Hijackthis Log
  |
 Dec 29 2005, 04:34 PM
Post
#1
|
|||||||||
 Bleep Bleep!  Group: Admin Posts: 31,597 Joined: 24-January 04 From: USA Member No.: 3  |
How to protect yourself from the Windows Metafile Vulnerability Note: Microsoft has released their WMF vulnerability update today, January 5th. Please make sure to read the instructions here. Table of Contents
What is the WMF Vulnerability A recent vulnerability has been found in the Windows MetaFile image type. A specifically crafted Windows MetaFile can be used to run code on your computer that will allow the exploiter to install programs or change settings on your computer. One known application that can be exploited is the Windows Picture and Fax Viewer (SHIMGVW.DLL) or other Windows applications that can handle Windows MetaFiles. If you visit a web site that contains one of these types of image files or open one of these image files, then your computer will be exploited as per the instructions in the MetaFile. As of now, there is no patch for this exploit, while there is a steadily increasing amount of sites that are using this exploit. Protection Methods There are currently two methods of reducing your chances of getting infected with this exploit. We recommend that you use both methods to add extra protection until an official Microsoft patch is released. Once the Microsoft patch is released you can uninstall The first method is to install an unofficial patch created by Ilfak Guilfanov. This patch has been extensively tested and has been found to block the WMF exploit. It does this by patching the Escape() function in the gdi32.dll file so that it ignores that SETABORTPROC parameter that the exploit uses. This patch actually patches the vulnerable function, so that you do not need to disable any image viewer programs if that is your wish. Instructions for installing this patch can be found below. The second method is to unregister the shimgvw.dll file so that Windows Picture and Fax Viewer does not open these files when you visit a web site that contains this type of image. To do that you need to unregister the DLL using the instructions below. I have created a simple script that will unregister or register this .DLL in the event that you do not feel comfortable running these commands on your own. Once you unregister this DLL, the Windows Picture and Fax Viewer will no longer work. To enable it you will be able to run the script again to register the DLL so that the program works once again. I advise that you only do this when Microsoft releases the official patch. Please note, that unregistering the DLL does not fix the vulnerability. It only decreases your chance of getting exploited. Steps to take before installing the Microsoft Update Now that Microsoft has released their WMF vulnerability update there are some steps that need to be taken before you install it so that your computer is back to normal operation. The first step is to uninstall the unofficial hotfix. Instructions on how to do this can be found here: HotFix uninstallation instructions After that has been completed you should register the Shimgvw.dll file. Instructions on how to do this can be found here: Register Shimgvw.dll with script Register Shimgvw.dll manually Once this has been completed, reboot your computer and visit http://www.windowsupdate.com and install the update. How to tell if your vulnerable Not only has Ilfak Guilfanov released a patch for this vulnerability, but he has also released a tool to check to see if you are vulnerable. To check to see if your computer is vulnerable download the WMF Vulnerability Checker and run the program. When the program starts, simply press the OK button and it will will tell you whether or not you are vulnerable. The WMF Vulnerability Checker will check to see if the Escape() function ignores the SETABORTPROC parameter. If it does ignore this parameter, it will state that you are not vulnerable, otherwise it will state that you are. If you are vulnerable, then you need to install the patch described above. Please note, that only unregistering the shimgvw.dll will still show you as vulnerable with the checker. In order to be seen as not vulnerable, you need to install the patch. Downloads Both fixes are for use on Windows XP, 2000, and 2003. If you are using Windows ME, then you should follow the manual instructions given below. Windows 95 and 98 users do not have the shimgvw.dll file. MD5
References http://www.microsoft.com/technet/security/advisory/912840.mspx http://www.kb.cert.org/vuls/id/181038 http://www.hexblog.com Method 1 - Install the WMF Patch
When the official Microsoft patch is released you can uninstall this program by doing the following:
Method 2 - Unregister shimgvw.dll Unregister shimgvw.dll instructions (This will disable the use of Windows Picture and Fax Viewer and help protect you):
Register shimgvw.dll instructions (This will enable the use of Windows Picture and Fax Viewer one the Microsoft patch is released):
To manually unregister the DLL you would do the following (This will disable the use of Windows Picture and Fax Viewer and help protect you):
To manually register the DLL you would do the following (This will enable the use of Windows Picture and Fax Viewer one the Microsoft patch is released:
This is a self-help guide. Use at your own risk. If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you. This post has been edited by Grinler: Jul 13 2006, 03:41 PM -------------------- |
||||||||
 |
 
|
||||||||
|
Dec 31 2005, 09:50 PM
Post
#2
|
|
 To INSANITY and BEYOND !! Group: Moderator Posts: 21,860 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Thanks Grin and especially for the script,as it makes life easier. Good man and good work!
Happy New Year to you all Pete -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jan 1 2006, 10:40 PM
Post
#3
|
|
|
Bleep Bleep! Group: Admin Posts: 31,597 Joined: 24-January 04 From: USA Member No.: 3 |
This prevention guide has been updated to also incoporate the use of an unofficial patch for this vulnerability and how to check if your computer is vulnerable.
-------------------- |
|
|
|
|
Jan 4 2006, 10:48 AM
Post
#4
|
|
|
Bleep Bleep! Group: Admin Posts: 31,597 Joined: 24-January 04 From: USA Member No.: 3 |
This guide has been updated to include local mirrored copes of the files.
-------------------- |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 21st November 2009 - 01:29 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.