said by matunga :

DEP enabled for all programs has blocked this [LINK REMOVED]

said by jbob :

since even if the default viewer is changed the infection still occurs.

said by jbob :

with InfranView set as the default viewer...the infection still occured but that was before the affected .dll file was unregistered.

said by gracie :

WAIT---please someone answer this: if we do the unregistration of windows picture viewer thing (which has totally broken any quick previewing of ALL graphic files, not just .wmf; now i have to wait for psp or photoshop to load just to check a .jpg), that still doesn't protect us?

said by gracie :

and would just changing the default for .wmf from picture viewer to, say, photoshop protect us without the unregistration?

said by gracie :

this is VERY murky to me. i am not happy not being able to quickly preview my jpgs and gifs, and never view wmfs so just making it impossible to view wmfs would be a good solution for me. but there seems to be differing opinions about what's needed (besides a good patch from ms.)

said by SUMware :

So, pardon my confusion, are the following conclusions accurate?

From SecurityFocus:
If the exploit file is named with another graphics extension (i.e. .gif, .jpg, .png, .tif), the GDI library will still read it correctly as a WMF file and execute the exploit. As a result, all common graphics files can carry the exploit.
-David Byrne

From SecurityFocus:
The thumbnail view in Windows Explorer will parse the graphics files in a folder, even if the file is never explicitly opened. This is enough to trigger the exploit. Even more frightening is that you don't have to use the thumbnail view for a thumbnail to be generated. Under some circumstances, just single-clicking on the file will cause it to be parsed.
-David Byrne

said by jbob :

What is it you are using that blocked the xxx.exe. I don't recognize the gui dialog.
------
And this today from Kapersky Labs viruslist weblog:

"This shows that although HW DEP can help, it's by no means a solution."

said by mysec :

The program is Anti-Executable. I'm not sure how DEP anti-execution is supposed to work, but AE creates a white list of all installed executables and blocks any others from running. So, as the ioo.exe dropper attempted to execute, it was blocked, as shown in the screen shot.

said by Schouw :

Btw, the blogpost was edited with info as to why for instance irfanview and xnview go 'undetected' for HW DEP.

said by trparky :

Where is that?

said by Schouw :

That is interesting indeed and contrary to what most others are saying. Perhaps it was reregistered when adding InfranView as the default wmf viewer. Perhaps it doesn't need to be registered for InfranView to use it. Can you try renaming the .dll and see what happens? Make sure you get any multiples as well.