BleepingComputer.com: Wmf Exploit Is Being Used To Install Malware Via Web Site

Microsoft has recently released an advisory stating that specially crafted WMF (Windows MetaFiles)images can be created to install malware or run arbitrary code on your computer when you open them.

We have been experimenting with various sites that use this exploit to install malware on your computer. Currently the malware that is being installed tends to be fake antispyware programs or spyware/adware.

To help mitigate this exploit you can unregister the Shimgvw.dll. This will stop WMF files, and any other image type for that matter, from being opened using the Windows Picture and Fax Viewer. A link to instructions and a tool that automates the registering and unregistering of this DLL can be found below.

It has also been found that other 3rd party software like Irfanview, Lotus Notes, and other image viewers that open WMF files can be used to trigger the installation of malware when you open these exploiting WMF files.

Until a patch is released, please be careful when opening any type of image files as you can rename a WMF to a jpg and still get exploited.

Lawrence Abrams
Circle BleepingComputer on Google+!
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
How to detect vulnerable programs using Secunia Personal Software Inspector <- Everyone should do this!