[SpamCop-List] Re: Anyone come across those nasty WMFs?

[Frank Ellermann]

Redstone wrote:
 
> I've heard that spammers are beginning to employ them,
> but haven't seen it personally.

I've read that the new "Google redirection greeting card"
crap tries this, but the one I got was already a dead
link.  The link in my case ended with ".exe", so maybe
it wasn't a WMF.  

If it was, then cutting the association for *.wmf won't
get it.  

MS offers a hard way to deregister the broken DLL:

http://www.microsoft.com/technet/security/advisory/912840.mspx

US-CERT mumbled something about a "file magic" (like MZ
for executable files or PK for ZIP), but apparently WMF
has no such magic, or I didn't get their idea.

http://www.kb.cert.org/vuls/id/181038
http://en.wikipedia.org/wiki/Windows_Metafile

                        Frank