Description
Win32/Worfo is a generic detection of malformed Windows Meta File (.WMF) files which attempt to exploit the "Microsoft Windows Meta File processing vulnerability".
This exploit can be used in a malicious web page to execute code of the attacker's choice on the user's machine. Any program that renders WMF images on affected systems could be vulnerable to this attack.
For more information, please visit our Vulnerability encyclopedia:
Microsoft Windows Meta File processing vulnerability
Microsoft have also issued an advisory here (Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution):
http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx
Note: this detection may be triggered by merely visiting a web page that contains malicious code. It does not necessarily mean your machine has been compromised, nor that your machine is vulnerable to this particular exploit.
CA has received reports from the wild that this vulnerability has been exploited to install the following malware on affected systems:
Analysis by Scott Molenkamp