 Wmf Exploit Is Being Used To Install Malware Via Web Site |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.| Important Announcement: The winners of the BC Million Post contest have been announced. You can read who the winners are at this post. - BleepingComputer Management |
  |
 Dec 31 2005, 05:47 PM
Post
#1
|
|
 Bleep Bleep!  Group: Admin Posts: 29,367 Joined: 24-January 04 From: USA Member No.: 3  |
 Microsoft has recently released an advisory stating that specially crafted WMF (Windows MetaFiles)images can be created to install malware or run arbitrary code on your computer when you open them.We have been experimenting with various sites that use this exploit to install malware on your computer. Currently the malware that is being installed tends to be fake antispyware programs or spyware/adware. To help mitigate this exploit you can unregister the Shimgvw.dll. This will stop WMF files, and any other image type for that matter, from being opened using the Windows Picture and Fax Viewer. A link to instructions and a tool that automates the registering and unregistering of this DLL can be found below. It has also been found that other 3rd party software like Irfanview, Lotus Notes, and other image viewers that open WMF files can be used to trigger the installation of malware when you open these exploiting WMF files. Until a patch is released, please be careful when opening any type of image files as you can rename a WMF to a jpg and still get exploited.  Link: Windows Metafile Exploit Mitigation By Unregistering Shimgvw.dll Link: Microsoft WMF Exploit Advisory-------------------- Lawrence
|
 |
 
|
|
Jan 1 2006, 10:41 PM
Post
#2
|
|
|
Bleep Bleep! Group: Admin Posts: 29,367 Joined: 24-January 04 From: USA Member No.: 3 |
The guide has been updated to incorporate information and instructions on using an unofficial patch for this vulnerability and to check to see if your computer is vulnerable.
-------------------- Lawrence
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 22nd November 2008 - 07:58 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.