|
|
Exploit.WMF Trojan Information
| Name: |
Exploit.WMF |
| Category: |
Trojan |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
Exploit.WMF is a Windows Meta File, a graphics file format, that has been altered to contain malicious code in order to infect the victim's computer though an exploit.
The exploit takes place through a vulnerability in all unpatched versions of Windows XP, Windows 2000, and Windows 2003. Older versions of Windows may be affected under certain circumstances. The infected WMF files are being distributed by various websites, by email, Instant Messaging links and possibly by infected banner ads. An unprotected user will be infected by visiting a web page or clicking on an email attachment with the infected files.
Once on the victim's computer, the infected WMF file spawns other malware files that contact the internet and download spyware, adware, and potentially unwanted anti-spyware programs that falsely report malware found on the computer and demand payment to remove it. Other malware including backdoors, password stealers, keyloggers and spam bots may be installed during the exploit. The victim's computer may become under the control of a remote attacker.
Microsoft issued a critical update for this vulnerability on January 5, 2006. The patch is for all versions of Windows XP, Windows 2000 and Windows 2003. The patch will not remove infected files from a victim's computer.
|
| Type: |
Trojan - A Trojan software is any software on a user's computer that the user is not aware or intentionally installed. Most Trojan software is designed to perform some sort of actions that could jeopardize the user's security or privacy. |
Top Trojan Visited Pages:
Tro.Downloader.loadadv - 408 visits
Enable Regedit - 191 visits
Java.ClassLoader.Dummy.d - 182 visits
Trojan.BankerSpy - 176 visits
RBot.steam - 85 visits
Startup.NameShifter.Xgtray - 76 visits
Tro.Bagle.SP - 58 visits
Trojan.BHO.NameShifter.EZ - 54 visits
LRPatch Trojan - 54 visits
Tro.YourStartingPage - 53 visits
Random Trojan Pages:
Little Pink Prank
Trojan.phqghu - Alias: VID INTERNET WEB DRIVERS FOR WIN32
RBot.msupdate32
Trojan.Spooner.D - Alias: Trojan:Win32/Spooner.D
RBot.mswkst32 - Alias: Microsoft Updat3
Trojan.BHO.NameShifter.DC
Trojan.BHO.NameShifter.JU
Startup.NameShifter.OL
MASM32 Trojan
PS2 Emulator
|
|
