"regsvr32 /u shimgvw.dll" as a workaround for the 0-day .wmf exploit not a good idea

http://www.wilderssecurity.com/showthread.php?t=113293

There may be other Security software that it impacts as well. All the major AV/AT companies have updated against this threat anyway by now.

Regards - Charles

 

charlesvar--Thought it might be helpful to link this thread to the earlier thread
http://www.windowsbbs.com/showthread.php?t=50519
and vice versa

 

It is suggested to place the following in your host, adblock or adfilter files.

Update to Advisory AV05-038 / PSEPC

 

Both IESpyAds
https://netfiles.uiuc.edu/ehowes/www/resource.htm
and MVPS HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm
have added sites to their lists which will assist in avoiding sites known to cause the problem.
Interestingly, and disturbingly, they are different from most of the sites posted by Whiskeyman.

 

Here is more regarding this from F-Secure. It suggests to block those sites I posted within your router if it is capable. There is also a third party patch available until MS gets a patch together.

Weblog : News from the Lab

I use Opera 8.51 and IrfanView. I decided to visit some bad sites to test a few things. At a few sites IrfanView opened along with a download permission window. I have now disabled IrfanView from working with .wmf files. It is also suggested not to use MSPaint to open images until MS patches the problem. Versions of Firefox previous to 1.5 will attempt to open the files in Windows Picture and Fax Viewer while 1.5 will try to open them by default in WMP which doesn't handle .wmf files.

 

It also appears that Microsoft's Data Execution Protection (about which I posted in http://www.windowsbbs.com/showthread.php?t=50519 ) may be of some value, though also with possible downsides.
http://blogs.zdnet.com/Ou/?p=143
Think I will try it.