Re: A Very Dangerous Worm in Windows Metafile Images (WMF)

On 2 Jan 2006 07:24:05 -0800, Winfield Hill
<Winfield_member@xxxxxxxxxxx> wrote:

>Frank Bemelman wrote...
>>
>>> I've finally installed Opera ...
>
> Doesn't matter, it's picture links that get you, and Opera will
> show a picture if asked to.

Opera can be set to automatically download application/x-msmetafile
and .wmf file types. I've set mine to dump any that it comes across
into c:/null. As nearly as I can tell from testing here with self-made
wmf files, this works correctly as a quarantine measure.

The display of wmf images by Opera can also be affected by whether the
user has installed file viewers beyond the vanilla MS handlers. I use
IrfanView aka IView as a general-purpose viewer and it is the registered
system wmf viewer. I *do not* know whether IView passes wmf images to a
lower-level system DLL for decoding, though.

Quarantine seems to be the safest route. The wmf file types are (were)
very rare either as web images or in e-mail; mostly used to embed
graphic images in Word and such.

--
Rich Webb Norfolk, VA
.

Relevant Pages

  • Re: A Very Dangerous Worm in Windows Metafile Images (WMF)
    ... >> Doesn't matter, it's picture links that get you, and Opera will ... >Opera can be set to automatically download application/x-msmetafile ... >The display of wmf images by Opera can also be affected by whether the ... The wmf file types are ...
    (sci.electronics.design)
  • Re: MS (in)security warning
    ... You have to use IE for the test since all you see with Firefox and Opera is the text TEST WMF FILE. ... With IE you see the graphic image rendered, and when you click on it, you see a small popup offering some options, such as to Save or Print the image file. ... Has anyone seen this exploit with an email client such as Outlook, OE, Opera, Thunderbird, Netscape, etc.? ...
    (alt.comp.anti-virus)
  • Re: A Very Dangerous Worm in Windows Metafile Images (WMF)
    ... The display of wmf images by Opera can also be affected by whether the ... IrfanView aka IView as a general-purpose viewer and it is the registered ... The wmf file types are ...
    (sci.electronics.design)