blog
annakat
-ben
AkikonomuIf you are using a computer running Windows and haven’t yet heard about this, you really should sit up and pay attention. Due to a design flaw in the Windows operating system, improperly coded graphics files (in a rather obscure format known as WMF) can be designed to trigger malicious code (a catchphrase for any kind of virus, worm, trojan horse, etc. that could eat your files and trash your machine). Read the Microsoft Support article (912840) for more details.
How it works
The Windows Metafile Format (WMF) is a relatively obscure file format that has been supported in Windows since Windows 3.0. Unlike other file formats, WMF is authorized to specify a callback function. In lay terms, WMF is designed to allow certain code to be run when the file is loaded into memory. Initially intended for managing printing of graphics files, this functionality has immense potential for abuse. For example, hackers may try to trick you into loading a deliberately programmed graphics file with a code fragment which could wipe out all your files, for example. Clearly, that is a bad idea.
Why you should care
This virus affects all Windows platforms from Windows 3.0 up to XP and 2003 and everything in between. Read more about the WMF virus at this unofficial website. Microsoft has yet to release an official fix but anyone who is using Windows right now should be very, very concerned. The flaw is programmed into the very core of the OS, and therefore you do not need to even open a WMF file to be affected by it. Read more about why on the F-Secure blog or on Wikipedia.
What you can do about it
If you work with graphics files a lot, you could consider using a different operating system such as MacOS or Linux. But if Windows is your poison and you can’t work around it, you can do a few things about it. Any of these could fix the problem until Microsoft decides to do something about it.
This exploit does not depend on the file extension, i.e. renaming .WMF files to .JPG will not stop the exploit.
Things to do:
- Install Ilfak Guilfanov’s unofficial hotfix [exe]. While not endorsed by M$, leading antivirus groups have given the patch their seals of approval.
- If you are running Windows XP SP2, enable Data Execution Prevention (DEP) for all programs.
- If you are running Google Desktop, turn it off until the problem is resolved. The mere act of asking the operating system to read and process a bad WMF file will set off the vulnerable code.
- Don’t ever use WMF, period.
Update 20050106 1600: Microsoft released an official security patch yesterday. If your computer hasn’t updated itself yet, get it now from Windows Update. End of story. And it still wouldn’t hurt to do that full backup.
If you are affected by this problem, act now, don’t delay. And doing a full backup wouldn’t hurt either.