Windows Metafile zeroday exploit
There’s more on the WMF 0-day exploit… According to f-secure it’s being used to distribute the following nasties….
Trojan-Downloader.Win32.Agent.abs
Trojan-Dropper.Win32.Small.zp
Trojan.Win32.Small.ga
Trojan.Win32.Small.ev.
It’s also installing the wolf in sheeps clothing… Avgold.
Sunbeltblog is reporting that the exploit is now on 50 sites…. Here is a list to block….
m.cpa4 [dot] org
008k [dot] com
mscracks [dot] com
keygen [dot] us
dailyfreepics [dot] us
pornsites-reviews [dot] com
mmxo.megaman-network [dot]
com
600pics [dot] com
Crackz [dot] ws
unionseek [dot] com
www.tfcco
[dot] com
Iframeurl [dot] biz
beehappyy [dot] biz
Buytoolbar [dot] biz
teens7 [dot] com
They also speculate on potential vectors in web-based mail accounts spam (hotmail) and trackback blog links. It sounds as though after getting bit by this one, reinstalling the operating system is the best way back to running normally.
Popularity: 1% [?]
Similar Posts
- Windows Live Mail (Next generation Hotmail) get’s an update
- More on the Windows WMF zero-day exploit
- Enabling logging in Microsoft Outlook
- Update on the WMF exploit - more sites to block
- More on the virus/trojan front
December 30th, 2005 at 9:15 pm
The Zero-Day Exploit
The new WMF exploit been all over the news lately. Why shouldn’t it be? It’s a huge security risk! How so? For one, it exploits a feature that almost every Windows PC has: a graphics rendering engine. I’m sure that many of you know what this is and …
January 1st, 2006 at 5:51 pm
Urgent WMF exploit
What Microsoft should do about the WMF exploit: · Use automatic update to immediately unregister the shimgvw DLL. When they’ve fixed the problem, they can turn it back on. · Negotiate to use the current fix of Ilfak Guilfanov’s. Pay