Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Wmf Exploit Is Being Used To Install Malware Via Web Site


  • Please log in to reply
1 reply to this topic

#1 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,395 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:56 AM

Posted 31 December 2005 - 05:47 PM

Microsoft has recently released an advisory stating that specially crafted WMF (Windows MetaFiles)images can be created to install malware or run arbitrary code on your computer when you open them.We have been experimenting with various sites that use this exploit to install malware on your computer. Currently the malware that is being installed tends to be fake antispyware programs or spyware/adware. To help mitigate this exploit you can unregister the Shimgvw.dll. This will stop WMF files, and any other image type for that matter, from being opened using the Windows Picture and Fax Viewer. A link to instructions and a tool that automates the registering and unregistering of this DLL can be found below. It has also been found that other 3rd party software like Irfanview, Lotus Notes, and other image viewers that open WMF files can be used to trigger the installation of malware when you open these exploiting WMF files. Until a patch is released, please be careful when opening any type of image files as you can rename a WMF to a jpg and still get exploited.

BC AdBot (Login to Remove)

 


m

#2 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 43,395 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:56 AM

Posted 01 January 2006 - 10:41 PM

The guide has been updated to incorporate information and instructions on using an unofficial patch for this vulnerability and to check to see if your computer is vulnerable.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users