Windows WMF vulerability affects Fx users?. What can we do?

satsuma · Post by **satsuma** » January 5th, 2006, 2:16 pm

monkeyman wrote:Also available at MS TechNet for you Admin types:
http://www.microsoft.com/technet/securi ... 6-001.mspx

Is this the update that was scheduled for Jan. 10?

Is it best to uninstall Windows WMF Metafile Vulnerability HotFix 1.4 and re-register shimvgw.dll first before updating the MS patch?

thanks,
maggie

WDGC · Post by **WDGC** » January 5th, 2006, 2:31 pm

satsuma wrote:
Is this the update that was scheduled for Jan. 10?

Yes.

.

monkeyman · Post by **monkeyman** » January 5th, 2006, 2:41 pm

satsuma wrote:
monkeyman wrote:Also available at MS TechNet for you Admin types:
http://www.microsoft.com/technet/securi ... 6-001.mspx

Is this the update that was scheduled for Jan. 10?

Is it best to uninstall Windows WMF Metafile Vulnerability HotFix 1.4 and re-register shimvgw.dll first before updating the MS patch?

thanks,
maggie

You don't need to reregister the .dll. Install the MS fix and then uninstall the "Windows WMF Metafile Vulnerability Hotfix" from Control Panel\Add/Remove programs.

satsuma · Post by **satsuma** » January 5th, 2006, 2:41 pm

Thanks WDGC - I just checked over at Castlecops. In their WMF Exploit FAQ here http://castlecops.com/a6445-WMF_Exploit_FAQ.html they say shimvgw.dll can be re-registered after the MS update (#11). IN #22, they're saying that the WMF fix from Guilfanov

"...is written in such a way that it won't interfere with the official Microsoft patch, claims the author. However, you can un-install it either before or after the Microsoft patch is installed on your system".

aragorn_499 · Post by **aragorn_499** » January 5th, 2006, 3:21 pm

It's good to know, though, that there is at least an unofficial patch for us who are still using Windows 98SE! :-)

Guest · Post by **Guest** » January 5th, 2006, 4:34 pm

the update did nothing to stop the exploit in my machine. my AV stopped it before and it hasn't changed.....

Post by **trolly** » January 5th, 2006, 4:49 pm

The MS update? You can not know that because AV got it first. If you are feeling lucky disable AV and try again.

Alice · Post by **Alice** » January 5th, 2006, 7:11 pm

Windows Auto-Update notification told me about a Windows XP update to the Graphics Rendering Engine today, which turned out to be the patch I wasn't expecting until Jan 10th (to my surprise) after I checked the asociated link.

After installing the update and rerebooting, since I only did the shimgvw.dll workaround and NOT the unofficial patch all I had to do was re-register shimgvw.dll using Start > Run and typing:
regsvr32 %windir%\system32\shimgvw.dll

Then I found a *.wmf file (in C:\Program Files\Microsoft Office\media\cagcat10) and it opened just fine in the Windows Picture and Fax Viewer (which I had left associated with .WMF). Thumbnails are also working.

satsuma · Post by **satsuma** » January 5th, 2006, 7:22 pm

After doing the MS update & uninstalling the Windows WMF Metafile Vulnerability Hotfix 1.4, I left the .dll un-registered.

I went to change my desktop background back to one that came with XP, since I'd been using a BBC Dr. Who background after Canada got the Xmas special last week. Several that worked before no longer did. I re-registered "regsvr32 %windir%\system32\shimgvw.dll" (no quotes) and now they all work again.

the best · Post by **the best** » January 5th, 2006, 8:10 pm

Norton caught it for me and FF kept it from executing. No problem.