Malware type: Trojan

Aliases: TR/Exploit.emf.A (Avira),

In the wild: Yes

Destructive: Yes

Language: English

Platform: Windows 2000, XP

Encrypted: No

Description: 

This is Trend Micro's detection for a Trojan that exhibits behavior similar to the Enhanced Metafile vulnerability of MS05-053.

Upon execution, this Trojan causes the EXPLORER.EXE of affected machines to crash. It may also cause applications that attempt to load it to crash. An example of an application that can load EMF files is Internet Explorer.

EXPLORER.EXE is usually the Windows Program Manager or Windows Explorer. The mentioned process manages the Windows Graphical Shell including the Start menu, taskbar, desktop, and File Manager.

The Enhanced Metafile vulnerability is discussed in detail on the following Web page:

Microsoft Security Bulletin MS05-053

Users are advised to download the latest Microsoft patches to avoid infection.

This Trojan runs on Windows 2000 Service Pack 4 and XP with no Service Pack.

For additional information about this threat, see:
Solution
Technical Details

Description created: Nov. 9, 2005 11:52:14 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.