Today I read an article in a tech newspaper about malicious hackers
exploiting a Windows XP vulnerability, called "zero day" as the exploit is so
new, that no fixes exist (as of 12/29/05). In the article, I was instructed
in a temporary workaround, that was to disable .WMF file handling by going to
the "run" command and typing the following: regsvr32 /u shimgvw.dll.
Unfortunately, this did exactly what it was supposed to do and I cannot view
my photos in Windows XP. I tried to do a system restore, but my computer
would not restore to a previous checkpoint. I need to know how to enable .wmf
file handling on my computer.

From: "Bruce H." <BruceH@discussions.microsoft.com>

| Today I read an article in a tech newspaper about malicious hackers
| exploiting a Windows XP vulnerability, called "zero day" as the exploit is so
| new, that no fixes exist (as of 12/29/05). In the article, I was instructed
| in a temporary workaround, that was to disable .WMF file handling by going to
| the "run" command and typing the following: regsvr32 /u shimgvw.dll.
| Unfortunately, this did exactly what it was supposed to do and I cannot view
| my photos in Windows XP. I tried to do a system restore, but my computer
| would not restore to a previous checkpoint. I need to know how to enable .wmf
| file handling on my computer.

Use a third party graphics program such as Paint Shop Pro or IRFANView
http://www.irfanview.com/

Once Microsoft releases the patch and it is installed you can again register the shimgvw.dll
DLL.
Example:
regsvr32 shimgvw.dll

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Start, Run and enter REGSVR32 SHIMGVW.DLL

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Bruce H." <BruceH@discussions.microsoft.com> wrote in message news:151C5198-BB0E-4E9A-B317-391FC200304D@microsoft.com...
> Today I read an article in a tech newspaper about malicious hackers
> exploiting a Windows XP vulnerability, called "zero day" as the exploit is so
> new, that no fixes exist (as of 12/29/05). In the article, I was instructed
> in a temporary workaround, that was to disable .WMF file handling by going to
> the "run" command and typing the following: regsvr32 /u shimgvw.dll.
> Unfortunately, this did exactly what it was supposed to do and I cannot view
> my photos in Windows XP. I tried to do a system restore, but my computer
> would not restore to a previous checkpoint. I need to know how to enable .wmf
> file handling on my computer.

For me it is the other way round...

I did the recommended fix: regsvr32 /u shimgvw.dll
but I notice e.g. I can *STILL* view .wmf files from IE.

Does it mean the fix doesn't work, or am I protected anyway?
I have Win XP Pro SP2.

Regards,
----------------------------------------------------- grz01

My guess is, its half-baked protection. It will prevent you from opening WMF files in Picture and Fax Viewer, but since the article states that it can also happen from a web page......... Well, if you can see it in IE, I would expect you could still be exploited.

Also, turning on DEP protection, should also mitigate this attack.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

<grz01@spray.se> wrote in message news:1135966605.937164.123080@g14g2000cwa.googlegr oups.com...
> For me it is the other way round...
>
> I did the recommended fix: regsvr32 /u shimgvw.dll
> but I notice e.g. I can *STILL* view .wmf files from IE.
>
> Does it mean the fix doesn't work, or am I protected anyway?
> I have Win XP Pro SP2.
>
> Regards,
> ----------------------------------------------------- grz01
>

In reading some info in the security newsgroup, and going to a recommended
blog, it appears software dep blocking does not work, only hardware.

Tom
"Doug Knox MS-MVP" <dknox@mvps.org> wrote in message
news:eZBFfRXDGHA.1676@TK2MSFTNGP09.phx.gbl...
My guess is, its half-baked protection. It will prevent you from opening
WMF files in Picture and Fax Viewer, but since the article states that it
can also happen from a web page......... Well, if you can see it in IE, I
would expect you could still be exploited.

Also, turning on DEP protection, should also mitigate this attack.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart
Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

<grz01@spray.se> wrote in message
news:1135966605.937164.123080@g14g2000cwa.googlegr oups.com...
> For me it is the other way round...
>
> I did the recommended fix: regsvr32 /u shimgvw.dll
> but I notice e.g. I can *STILL* view .wmf files from IE.
>
> Does it mean the fix doesn't work, or am I protected anyway?
> I have Win XP Pro SP2.
>
> Regards,
> ----------------------------------------------------- grz01
>

Doug: Here's the link: http://sunbeltblog.blogspot.com/

Tom
"Tom [Pepper] Willett" <tompepper@mvps.invalid> wrote in message
news:%23REcTUXDGHA.740@TK2MSFTNGP12.phx.gbl...
| In reading some info in the security newsgroup, and going to a recommended
| blog, it appears software dep blocking does not work, only hardware.
|
| Tom
| "Doug Knox MS-MVP" <dknox@mvps.org> wrote in message
| news:eZBFfRXDGHA.1676@TK2MSFTNGP09.phx.gbl...
| My guess is, its half-baked protection. It will prevent you from opening
| WMF files in Picture and Fax Viewer, but since the article states that it
| can also happen from a web page......... Well, if you can see it in IE, I
| would expect you could still be exploited.
|
| Also, turning on DEP protection, should also mitigate this attack.
|
| --
| Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart
| Display\Security
| Win 95/98/Me/XP Tweaks and Fixes
| http://www.dougknox.com
| --------------------------------
| Per user Group Policy Restrictions for XP Home and XP Pro
| http://www.dougknox.com/xp/utils/xp_securityconsole.htm
| --------------------------------
| Please reply only to the newsgroup so all may benefit.
| Unsolicited e-mail is not answered.
|
| <grz01@spray.se> wrote in message
| news:1135966605.937164.123080@g14g2000cwa.googlegr oups.com...
| > For me it is the other way round...
| >
| > I did the recommended fix: regsvr32 /u shimgvw.dll
| > but I notice e.g. I can *STILL* view .wmf files from IE.
| >
| > Does it mean the fix doesn't work, or am I protected anyway?
| > I have Win XP Pro SP2.
| >
| > Regards,
| > ----------------------------------------------------- grz01
| >
|
|

Thanks for passing that along, Tom. Much appreciated!

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Tom [Pepper] Willett" <tompepper@mvps.invalid> wrote in message news:ecCQ6VXDGHA.312@TK2MSFTNGP09.phx.gbl...
> Doug: Here's the link: http://sunbeltblog.blogspot.com/
>
> Tom
> "Tom [Pepper] Willett" <tompepper@mvps.invalid> wrote in message
> news:%23REcTUXDGHA.740@TK2MSFTNGP12.phx.gbl...
> | In reading some info in the security newsgroup, and going to a recommended
> | blog, it appears software dep blocking does not work, only hardware.
> |
> | Tom
> | "Doug Knox MS-MVP" <dknox@mvps.org> wrote in message
> | news:eZBFfRXDGHA.1676@TK2MSFTNGP09.phx.gbl...
> | My guess is, its half-baked protection. It will prevent you from opening
> | WMF files in Picture and Fax Viewer, but since the article states that it
> | can also happen from a web page......... Well, if you can see it in IE, I
> | would expect you could still be exploited.
> |
> | Also, turning on DEP protection, should also mitigate this attack.
> |
> | --
> | Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart
> | Display\Security
> | Win 95/98/Me/XP Tweaks and Fixes
> | http://www.dougknox.com
> | --------------------------------
> | Per user Group Policy Restrictions for XP Home and XP Pro
> | http://www.dougknox.com/xp/utils/xp_securityconsole.htm
> | --------------------------------
> | Please reply only to the newsgroup so all may benefit.
> | Unsolicited e-mail is not answered.
> |
> | <grz01@spray.se> wrote in message
> | news:1135966605.937164.123080@g14g2000cwa.googlegr oups.com...
> | > For me it is the other way round...
> | >
> | > I did the recommended fix: regsvr32 /u shimgvw.dll
> | > but I notice e.g. I can *STILL* view .wmf files from IE.
> | >
> | > Does it mean the fix doesn't work, or am I protected anyway?
> | > I have Win XP Pro SP2.
> | >
> | > Regards,
> | > ----------------------------------------------------- grz01
> | >
> |
> |
>
>