Kenny said:
After reading this:
http://news.bbc.co.uk/1/hi/technology/4566504.stm
tried to turn this off using this:
http://www.annoyances.org/exec/foru...w.annoyances.org/exec/forum/winxp/t1048734823
There are 2 registry entries there to delete but I don't seem to have
an "HKEY_CLASSES_ROOT / SystemFileAssociations"
at all!
Anyone know why and what can I do about it?
Incidentally why if I have Regedit open then go to something else
Regedit appears to close itself and I have to reopen it?
Using XP Pro with SP2.
http://www.updatexp.com/wmf-exploit.html
This is copied and pasted from the virus newsgroup,if you are running one of
the AV programs listed unregistering the picture and fax viewer may not be
needed.
From: "PA Bear said:
X-post to Security, Security.Homeusers, IE6 & WinXP General newsgroups.
Followup set to microsoft.public.security.
Microsoft Security Advisory (912840): Vulnerability in Graphics
Rendering Engine Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/912840.mspx
Welcome to the Microsoft Security Response Center Blog!
New Security Advisory for Possible Windows Vulnerability
http://blogs.technet.com/msrc/archive/2005/12/29/416569.aspx
I received a a sample. the following is a report.
Note that Microsoft's AV solution ( is it really one ? ) doesn't recognize
this as a threat.
AntiVir 6.33.0.70 12.29.2005 TR/Dldr.WMF.Agent.D
Avast 4.6.695.0 12.29.2005 Win32:Exdown
AVG 718 12.29.2005 Downloader.Agent.13.AI
Avira 6.33.0.70 12.29.2005 TR/Dldr.WMF.Agent.D
BitDefender 7.2 12.29.2005 Exploit.Win32.WMF-PFV.C
CAT-QuickHeal 8.00 12.29.2005 WMF.Exploit
ClamAV devel-20051123 12.29.2005 Exploit.WMF.A
DrWeb 4.33 12.29.2005 Exploit.MS05-053
eTrust-Iris 7.1.194.0 12.29.2005 Win32/Worfo.C!Trojan
eTrust-Vet 12.4.1.0 12.29.2005 Win32/Worfo
Ewido 3.5 12.29.2005 Downloader.Agent.acd
Fortinet 2.54.0.0 12.29.2005 W32/WMF-exploit
F-Prot 3.16c 12.29.2005 security risk or a "backdoor" program
Ikarus 0.2.59.0 12.29.2005 Trojan-Downloader.Win32.Agent.ACD
Kaspersky 4.0.2.24 12.29.2005 Trojan-Downloader.Win32.Agent.acd
McAfee 4662 12.29.2005 Exploit-WMF
Microsoft ?? 12.29.2005 no virus found
NOD32v2 1.1343 12.28.2005 Win32/TrojanDownloader.Wmfex
Norman 5.70.10 12.29.2005 no virus found
Panda 9.0.0.4 12.28.2005 Exploit/Metafile
Sophos 4.01.0 12.29.2005 Troj/DownLdr-NK
Symantec 8.0 12.29.2005 Download.Trojan
TheHacker 5.9.1.064 12.28.2005 Exploit/WMF
Trend Micro 135 12.29.2005 TROJ_NASCENE.D
UNA 1.83 12.29.2005 no virus found
VBA32 3.10.5 12.28.2005 no virus found
