You're clearly not sufficiently paranoid. :) Here's one using the WMF image format: http://technet.microsoft.com/en-us/security/bulletin/ms09-062 http://tech

You're clearly not sufficiently paranoid. :) Here's one using the WMF image format: http://technet.microsoft.com/en-us/security/bulletin/ms09-062 http://technet.microsoft.com/en-us/security/bulletin/ms09-06... Seeing as how modern web browsers are basically designed to download and execute code from random third parties at a second party's prompting, wouldn't you think it reasonable that the first party want a little control over the process? After all, us infosec folks always tell people to be cautious of what they download, turn off things like autorun, etc. The web browser is autorun for the Internet! (Never mind all of the bandwidth wasted on loading all of the third-party crap. Not all of us have high-speed/low-latency network links. Many of my users operate in very out-of-the-way places. Disabling the extra crap seems to significantly improve things like page load times.)