New Microsoft Virus Threat

[98SS]

I searched and didn't find anything. We got this in an email at work.


"On Tuesday, December 27, 2005, Microsoft became aware of public reports of malicious attacks on some customers involving a previously unknown security vulnerability in the Windows Meta File (WMF) code area in the Windows platform.

Microsoft confirmed the technical details of the attack on December 28, 2005 and immediately began developing a security update for WMF vulnerability on an expedited track. Microsoft's goal is to release the update on Tuesday, January 10, 2006 as part of its monthly release of security bulletins. This release is predicated on successful completion of quality testing.

What makes this threat particularly vicious is that unwitting victims can infect their computers simply by viewing a web page, e-mail, or instant message that includes a contaminated image. That differs from most virus attacks, which require a user to actually download an infected file.

Please make sure your Symantec Anti-virus is up to date -- version 9 or 10 and the virus definitions file needs to be at least 1/3/2006 rev.21.

Users should take care not to visit unfamiliar or untrusted Web sites that could potentially host the malicious code.

Microsoft also encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources."

[Speedy2222]

my avast detected one in my email yesterday

[xJuice]

i've got Symantec Corporate Edition with everyhting up to date so i'm good to go. . . w00t

[bigblackone]

shutoff .wmf till ms comes out with a patch:

1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32 /u shimgvw.dll" to disable.
4. Click ok when the change dialog appears.

iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven't had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command "regsvr32 shimgvw.dll" in step three above


(I haven't had issue with viewing anything yet)