Hi, yes, it seems to be a new exploit. More details about the problem can be found here: http://www.f-secure.com/weblog/archives/archive-122005.html#00000752 http://isc.sans.org/diary.php?storyid=972 http://www.heise.de/newsticker/meldung/67794 Some AV companies have created signatures for the latest critter already: AntiVir TR/Dldr.WMF.Small Dr Web Exploit.MS05-053 F-Secure Exploit.Win32.Agent.r Fortinet W32/WMF-exploit Kaspersky Exploit.Win32.Agent.r McAfee (BETA) Exploit-WMF trojan Symantec (BETA) Download.Trojan cheers, Andreas Marx http://www.av-test.org Warning the following URL successfully exploited a fully patched windows xp system with a freshly updated norton anti virus. unio[removeme]nseek.com/d[removeme]/t1/wm[removeme]f_exp.htm The url runs a .wmf and executes the virus, f-secure will pick up the virus norton will not. ______________________________________________________________________ XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club! Jetzt gratis testen! http://freemail.web.de/home/landingpad/?mc=021130
