# Windows PCs face ‘huge’ virus threat - How can viewing an image file infect your PC? **URL:** \ **Category:** Factual Questions\ **Created:** [January 3, 2006, 1:53am UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169 "2006-01-03T01:53:40Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [January 3, 2006, 9:48pm UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/21 "2006-01-03T21:48:31Z")
> [@chappachula](#): > > I always thought that messing with the Register is way beyond the abilities of mere mortals like me who dont know nuthin’ 'bout the innards of their computers. Using regsvr32 is a whole lot safer than editing the registry directly. It really doesn’t fall into the “messing with” category. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [January 5, 2006, 8:57am UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/22 "2006-01-05T08:57:33Z")
> [@AHunter3](#): > > I am not a PC user and therefore my consciousness of what’s going on with PC architecture is far from dead-on accurate, but aren’t the later chips of the Pentium family set up so as to reduce the likelihood of executing code in buffer overflows? This isn’t a buffer overflow. This is one of the relatively few times you’ll ever see a major Microsoft security flaw that is _ **not a buffer overflow** _. There are no overflowing buffers relevant to the security hole malicious WMF files are exploiting. Here is what’s happening: A WMF file isn’t just data. It can contain a callback function as well, which is a bit of executable code that a certain DLL will pull out of the file and run whenever the file is opened. I have no idea what the Microsoft programmers were smoking when they thought of this horrible, horrible idea, but they were smoking it years ago and now we’re stuck with one of the worst ideas since ActiveX. The simplest way around the gaping security hole is to stop the DLL from doing its job, which is the nutshell explanation of what regsvr32 is capable of doing. Typing regsvr32 /u shimgvw.dll into a command prompt will ‘unregister’ the DLL responsible for executing WMF files. No DLL, no hole. There is no hardware on Earth equal to the task of defending us against software designed by morons. ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [January 5, 2006, 10:29am UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/23 "2006-01-05T10:29:02Z")
> [@Derleth](#): > > Typing regsvr32 /u shimgvw.dll into a command prompt will ‘unregister’ the DLL responsible for executing WMF files. No DLL, no hole. Although that is enough to protect a Windows PC from current threats, it’s only a workaround because the vulnerability is actually in the GDI (GDI32.DLL). Probably not a good idea to unregister that. The unofficial (not from Microsoft) patch that is available patches GDI32.DLL. The official patch should be released next Tuesday. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [January 5, 2006, 3:56pm UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/24 "2006-01-05T15:56:20Z")
> [@Usram](#): > > Although that is enough to protect a Windows PC from current threats, it’s only a workaround because the vulnerability is actually in the GDI (GDI32.DLL). Probably not a good idea to unregister that. The unofficial (not from Microsoft) patch that is available patches GDI32.DLL. The official patch should be released next Tuesday. I did not know that. (BTW, what is the GDI? I am not really a Windows programmer.) ---
**Author:** ![Taran](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@Taran](https://boards.straightdope.com/u/Taran)\ **Post date:** [January 5, 2006, 8:53pm UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/25 "2006-01-05T20:53:40Z")
“Graphics Device Interface”, an (old) API for graphical output to monitors and printers. **Derleth** : From following **docandjean** ’s link, it seems that they were thinking “image files need the ability to stop the printer from spooling”. Seriously. ---
**Author:** ![Crowbar\_of\_Irony\_3](https://avatars.discourse-cdn.com/v4/letter/c/f08c70/32.png) [@Crowbar\_of\_Irony\_3](https://boards.straightdope.com/u/Crowbar_of_Irony_3)\ **Post date:** [January 6, 2006, 12:34am UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/26 "2006-01-06T00:34:45Z")
It seems that the patch are already out. [http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx](http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx) ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [January 6, 2006, 7:36pm UTC](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169/27 "2006-01-06T19:36:52Z")
> [@Taran](#): > > **Derleth** : From following **docandjean** ’s link, it seems that they were thinking “image files need the ability to stop the printer from spooling”. Seriously. Wonderful. Next I suppose they’ll decide that Word files need the ability to blast ad jingles out of the speakers. [Previous page](https://boards.straightdope.com/t/windows-pcs-face-huge-virus-threat-how-can-viewing-an-image-file-infect-your-pc/338169.md?page=1)