Exploit-WMF trojan exploits vulnerability found in Windows Picture and Fax Viewer feature, which results in buffer overflow and execution of arbitary code. Computer running with Windows XP (with service pack2), Windows NT, Windows 2000 are vulnerable to this exploit.

The malicious WMF file is downloaded from any one of the following website.

http://cr[blocked].ws
http://Ifr[blocked].biz
http://bee[blocked].biz
http://www.tf[blocked].com
http://uni[blocked].com

Once the malicious WMF file is viewed using any image viewer or Internet Explorer, this trojan downloads many other trojans from remote websites and executes the same.

This trojan first appeared on December 28, 2005.

 Other names of Exploit-WMF Trojan:

This trojan is also known as Exploit-WMF.