Disabled .wmf - now I can't view pictures in Windows XP - HELP!

[Guest]

Today I read an article in a tech newspaper about malicious hackers
exploiting a Windows XP vulnerability, called "zero day" as the exploit is so
new, that no fixes exist (as of 12/29/05). In the article, I was instructed
in a temporary workaround, that was to disable .WMF file handling by going to
the "run" command and typing the following: regsvr32 /u shimgvw.dll.
Unfortunately, this did exactly what it was supposed to do and I cannot view
my photos in Windows XP. I tried to do a system restore, but my computer
would not restore to a previous checkpoint. I need to know how to enable .wmf
file handling on my computer.

 

[David H. Lipman]

From: "Bruce H." <[email protected]>

| Today I read an article in a tech newspaper about malicious hackers
| exploiting a Windows XP vulnerability, called "zero day" as the exploit is so
| new, that no fixes exist (as of 12/29/05). In the article, I was instructed
| in a temporary workaround, that was to disable .WMF file handling by going to
| the "run" command and typing the following: regsvr32 /u shimgvw.dll.
| Unfortunately, this did exactly what it was supposed to do and I cannot view
| my photos in Windows XP. I tried to do a system restore, but my computer
| would not restore to a previous checkpoint. I need to know how to enable .wmf
| file handling on my computer.

Use a third party graphics program such as Paint Shop Pro or IRFANView
http://www.irfanview.com/

Once Microsoft releases the patch and it is installed you can again register the shimgvw.dll
DLL.
Example:
regsvr32 shimgvw.dll

 

[Doug Knox MS-MVP]

Start, Run and enter REGSVR32 SHIMGVW.DLL

 

[grz01]

For me it is the other way round...

I did the recommended fix: regsvr32 /u shimgvw.dll
but I notice e.g. I can *STILL* view .wmf files from IE.

Does it mean the fix doesn't work, or am I protected anyway?
I have Win XP Pro SP2.

Regards,
----------------------------------------------------- grz01

 

[Doug Knox MS-MVP]

My guess is, its half-baked protection. It will prevent you from opening WMF files in Picture and Fax Viewer, but since the article states that it can also happen from a web page......... Well, if you can see it in IE, I would expect you could still be exploited.

Also, turning on DEP protection, should also mitigate this attack.

 

[Tom [Pepper] Willett]

In reading some info in the security newsgroup, and going to a recommended
blog, it appears software dep blocking does not work, only hardware.

Tom
My guess is, its half-baked protection. It will prevent you from opening
WMF files in Picture and Fax Viewer, but since the article states that it
can also happen from a web page......... Well, if you can see it in IE, I
would expect you could still be exploited.

Also, turning on DEP protection, should also mitigate this attack.

 

[Tom [Pepper] Willett]

Doug: Here's the link: http://sunbeltblog.blogspot.com/

Tom
| In reading some info in the security newsgroup, and going to a recommended
| blog, it appears software dep blocking does not work, only hardware.
|
| Tom
| | My guess is, its half-baked protection. It will prevent you from opening
| WMF files in Picture and Fax Viewer, but since the article states that it
| can also happen from a web page......... Well, if you can see it in IE, I
| would expect you could still be exploited.
|
| Also, turning on DEP protection, should also mitigate this attack.
|
| --
| Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart
| Display\Security
| Win 95/98/Me/XP Tweaks and Fixes
| http://www.dougknox.com
| --------------------------------
| Per user Group Policy Restrictions for XP Home and XP Pro
| http://www.dougknox.com/xp/utils/xp_securityconsole.htm
| --------------------------------
| Please reply only to the newsgroup so all may benefit.
| Unsolicited e-mail is not answered.
|
| | > For me it is the other way round...
| >
| > I did the recommended fix: regsvr32 /u shimgvw.dll
| > but I notice e.g. I can *STILL* view .wmf files from IE.
| >
| > Does it mean the fix doesn't work, or am I protected anyway?
| > I have Win XP Pro SP2.
| >
| > Regards,
| > ----------------------------------------------------- grz01
| >
|
|

 

[Doug Knox MS-MVP]

Thanks for passing that along, Tom. Much appreciated!