Quantcast
PCWorld.com is upgrading some back-end systems. Some site features, such as user registration, may be temporarily unavailable.
Subscribe to magazine

Blogs

    Bugs and Fixes

  • Contributing Editor Stuart J. Johnston advises you on how to fix the latest problems affecting your operating system, your browser, your other software, and your hardware.
  • Subscribe to this blog

Windows, IE Animations Run Amok

Stuart J. Johnston

Windows, IE Animations Run Amok

Illustration: Headcase Design
Microsoft's "cute" animations, like the infamous Office Clippy, have aroused more ire than grateful praise, but they didn't actually do any harm--until now. The part of Windows behind the animated yellow dog helper in Windows search, called Microsoft Agent, gives malicious hackers a route into your PC for spyware or viruses transmitted via a drive-by download.

Agent can also be used by third-party programs for their own help functions. Clippy himself isn't a risk, but a flaw in the Agent ActiveX control that Internet Explorer 6 uses under Windows XP SP2 and Windows 2000 SP4 means the browser can be overwhelmed by a booby-trapped Agent file (.acf). If you browse a poisoned site that hosts such a file, the ActiveX control will crash, thereby opening the door to an attack program--and you don't need to click on any of the page's content.

IE 7 isn't vulnerable to this flaw; to protect yourself, upgrade your browser or download the critical patch from Microsoft through Automatic Updates. Or get the patch and more info at Microsoft Technet. At press time we had not seen any reports of active attacks using this hole.

Clippy's cousins aren't the only pieces of old-school animation coming back to haunt users. Two dangerous IE 6 flaws in Microsoft DirectAnimation were hit with zero-day attacks before Microsoft released a patch. Although DirectAnimation has been superseded by DirectX for showing animations in the browser, it remains in IE--a little like people's tailbones.

Again, if you just view a doctored Web page, you'll be hit by a drive-by download. An attack crashes the DirectAnimation ActiveX controls, and can let a bad guy do anything on your PC that you can do.

If you don't already have it, you can now get the patch for IE 6, a fix that basically shuts down the unnecessary DirectAnimation for good.

  • Recommend this story?
  • 0 Yes
    0 No

"Windows, IE Animations Run Amok" Comments

 

Featured APC Accessories

  • APC Back-UPS ES Safeguards your equipment from damaging surges and spikes that travel along your utility & data lines.
  • APC SurgeArrest Performance Highest level of protection for your professional computers, electronics and connected devices, as well as provides surge protection.

People who read this also read:

Bugs and Fixes

All PC World Blogs

  • 15 Minutes to a Secure Business Get the Secure in 15 toolkit starting with the "15 Minutes Month-at-a-Glance" calendar. McAfee will send you additional tools and tricks to stay protected around the clock.
  • A Buyer's Guide to Data Protection Implementing data protection products and processes can be daunting. Make the right decisions by exploring what is available and what makes sense for your organization. Use this simple guide to evaluate different vendor offerings.

Sponsored Links