Ken Dunham, director of the rapid response team at iDefense, said today that WMF exploitation "has started to take off in the wild". He said that "dozens, if not hundreds" of sites exploiting the hole are likely to be reported in the coming days and weeks. Don't think, as some do, that this problem is just confined to Windows metafiles. Dunham said that iDefense analysed a live sample of a WMF attack spread via email and disguised as a JPG file. He said it was fully functional and downloaded and installed a variant of a trojan called Bifrose. Idefense says that enabling Windows Data Execution Prevention software and/or disabling SHIMGVW.DLL successfully blocks WMF attacks so far.