I installed the version 1.4 fix and rebooted my machine. After reboot I ran the wfm_checker and it said that my system was still vulnerable. What could be the problem?

I am running Win XP Pro.

Please check question #5:

http://www.hexblog.com/security/wmffix_faq.html

How to check that the hotfix is working on my computer?

Use the checker to verify that the hotfix works. If should report that your system is invulnerable. In it reports that your system is still vulnerable, check the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs registry key. It should contain a reference to c:\windows\system32\wmfhotfix.dll. There are some programs known to clean up this registry key. The fix will not work in this case. You should find and disable the program which cleans the registry key or uninstall the hotfix.

If you use a Real-Time Monitoring program like Lavasoft's Ad-Watch that blocks changes to your registry, you need to accept the Ad-Watch prompt when installing the WMF_Hotfix.

Further, with regard to Ad-Watch, if you have it set to "Automatic", you must turn that off first:

1. Right click on the Ad-Watch icon in the system tray.
   
2. At the bottom of the screen there will be two checkable items called "Active" and "Automatic".
   
   
   • Automatic: Suspicious activity will be blocked automatically
   
   
3. Uncheck "Automatic"
   
4. Install the WMF_Hotfix
   
5. Accept the Ad-Watch prompt
   
6. Shutdown/Restart the computer
   
7. Run the WMF_Checker

_________________
- "Security Garden" -

Hi,

First of all, many thanks Ilfak for all your efforts !!

Now, for my problem, I installed the patch on my W2K SP4 with all the latest updates. I have residents:

BitDefender Standard9
WinPatrol Plus (latest ver.)
ZoneAlam 4.5.594
CounterSpy 1.5.82

I installed your 1.4 fix, (no warnings from any of the residensts) and proceeded to check after a PC re-boot:
Still vulnerable.

BTW in all of this process, I NEVER received a single warning from any of the aforemntioned programs when they were active.

Uninstalled the fix, disabled all residents and prevented them to start with windows, re-boot and re-installed the fix, re-boot again and checked and I was still Vulnerable-

I checked for c:\windows\system32\wmfhotfix.dll and it is there !

Any clues?

Thanks again

Diazruanova

Hi'ya Diazruanova, iDEFENSE is claiming Win2k is not susceptible.

I'm writing an FAQ on the front page now.

/a6445-WMF_Exploit_FAQ.html

I'll have the links in there.

New information has come in on Win2k:

/a6446-DEP_not_a_total_solution_to_WMF.html

Also an FAQ on WMF:
/a6445-WMF_Exploit_FAQ.html