Saturday, December 31, 2005

Security Alert: Windows WMF exploits

F-Secure team discovered a serious windows exploit that can be triggered by simply browsing a melicious website with WMF image format. Please note that this is a zero-day exploit, meaning that this exploit affects anyone and everyone using windows, regardless of their choice of browser. It's also safe to assume that this would work on every version of windows, from old systems like Windows ME to the latest Windows XP with patch SP2.

Solution
1. Go to Start menu, click on "Run"


2. type in the command “regsvr32 -u c:\windows\system32\shimgvw.dll"


3. After clicking ok, you'll see a dialog box indicating that the process is successful



Please note that after this operation, you won't be able to see previews of images. This is definitely a small price to avoid someone taking over your computer and using it to send spam. :)

Links:
http://www.f-secure.com/weblog/

P.S.: My apologies for the screenshots. At the moment of the post I have with me Chinese version of Windows XP. The images should convey currectly steps you need to take in unregistering the said dll, since all windows look alike.

No comments: