(no subject)

[theweaselking]

New critical exploit on all Windows machines Win98 and newer - runs through the obsolete-but-still-there WMF file viewer.

This is not limited to IE. It will also infect Opera and Firefox users - one source says "older versions of Firefox", the other just says Firefox. It's done by surfing to a web page containing an infected JPEG or GIF file, and installs and runs a bogus anti-spyware tool that tries to steal your credit card information while installing more stuff on your machine, even on up-to-date patched XP SP2 machines.

There's a half-assed fix so far:

According to iDefense, Windows users can disable the rendering of WMF files using the following hack:

1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32 /u shimgvw.dll" to disable.
4. Click ok when the change dialog appears.

iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven't had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command "regsvr32 shimgvw.dll" in step three above.

Comments

[texas-tiger.livejournal.com]

When I tried that, I got the error:

LoadLibrary("shimgvw.dll") failed.
GetLastError returns 0x00000485.

Any ideas?

[theweaselking.livejournal.com]

Not really. regsvr32 is not exactly something meant to be used manually like this, so I don't know why it's not working.

[zenten.livejournal.com]

Sounds like that bit of your computer is screwed up, so that the vulnerability wouldn't work on it anyway (but don't quote me on that).

[sivi-volk.livejournal.com]

Seems to have worked.

[ed-dirt.livejournal.com]

Thanks, Weasey.

[wyatt1048.livejournal.com]

Seems to have worked - thanks!

[ryusen.livejournal.com]

Yeah, i was just thinking i needed to post that. The notironic thing is, i was planning on running that command line cause i was having trouble with thumbnail rendering on legitimate files .p

[zenten.livejournal.com]

I refuse to run such a command on my computer.

[theweaselking.livejournal.com]

I somehow doubt your machine is likely to be vulnerable to a Windows rendering exploit.

[kali-kali.livejournal.com]

My computer can't find that file....

[jerril]

Ran it on my moms computer. Success. Also on work computer. WMF are stupid anyways.