Over the past couple a weeks, a new vulnerability in the Windows Shell was discovered which exploits shortcut (LNK and PIF) files in Windows XP and higher.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the icon of a specially crafted shortcut is displayed. This vulnerability can be exploited locally through a malicious USB drive, or remotely via network shares and WebDAV. An exploit can also be included in specific document types that support embedded shortcuts.

Microsoft has recently released a hotfix to address this vulnerability. This hotfix is not published through Windows Update and is only available as a manual download and install. However, before you install this pay close attention to the note:

NOTE: Applying the fixit will remove the graphical representation of icons on the Task bar and Start menu bar and replace them with white icons without the graphical representation of the icon.

Because the exploit uses a specially crafted icon, this hotfix essentially disables pretty icons in shortcuts and replaces them with the blank white page. While no known security issue should be overlooked, due to the obvious impact this hotfix will have on how your system looks, you should definitely weigh the pros and cons before installing this hotfix.

Like what you read?

If so, please join over 28,000 people who receive our exclusive weekly newsletter and computer tips, and get FREE COPIES of 5 eBooks we created, as our gift to you for subscribing. Just enter your name and email below: