Windows zero day nightmare exploited

[acedriver]

On December 31st, a new and improved version of the WMF exploit had been published. The new exploit generated WMF files that were different enough to bypass nearly all Anti-Virus and IDS signatures. Different methods of distributing the virus, such as e-mails and instant messenger chats have already been seen in the wild, as more and more worms and trojans have been utilising the exploit to gain access to computers running the Windows operating system.

SANS and many other security sites recommend un-registering Shimgvw.dll (Microsoft picture and fax viewer) and using the unofficial patch to protect aginst the virus, until Microsoft can release an official patch. A virus scanner isn't enough to protect against some of the more advanced variants of the exploit.

SANS Internet Storm Center article
F-Secure Weblog
Unofficial patch site

[Adrian Wong]

Originally Posted by acedriver

until Microsoft release a patch, you should unregister the dll..

Unregistering it right away!!

[acedriver]

WMF patch released early.

Security Update for Windows XP (KB912919)

Here's the other platforms also:
Security Update for Windows Server 2003 (KB912919)

Security Update for Windows 2000 (KB912919)

Security Update for Windows XP x64 Edition (KB912919)

Security Update for Windows Server 2003 64-bit Itanium Edition (KB912919)

The Security bulletin ( MS06-001 ) is now available and confirms this covers the WMF vulnerability.

Graphics Rendering Engine Vulnerability - CVE-2005-4560:

A remote code execution vulnerability exists in the Graphics Rendering Engine because of the way that it handles Windows Metafile (WMF) images. An attacker could exploit the vulnerability by constructing a specially crafted WMF image that could potentially allow remote code execution if a user visited a malicious Web site or opened a specially crafted attachment in e-mail. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Recommendation for updating:

1. Reboot your system to clear any vulnerable files from memory
2. Download and apply the new patch
3. Reboot
4. Uninstall the unofficial patch, by using Add/Remove Programs on single systems. If you used msi to install the patch on multiple machines you can uninstall it with this:
msiexec.exe /X{E1CDC5B0-7AFB-11DA-8CD6-0800200C9A66} /qn
5. Re-register the .dll if you previously unregistered it (use the same command but without the "-u"):
regsvr32 %windir%\system32\shimgvw.dll
6. Reboot one more time just for good measure

http://isc.sans.org/

[Adrian Wong]

Argghhh!!! I JUST installed the temporary patch!!!

Thanks for the update!

[Chai]

Cool thanks for the update!

[buildcustompc]

I got this infection on my computer a couple times and it wasn't pretty. It contiually pops up that infested box in the bottom right and doesn't let you change you backround. Ad-aware detects some of it and removes it but it reinstalls itself. I have to do a complete reformat/reinstall to get rid of it. Thanks for the info about what this was!

Will

[1031982]

I use ACDsee, because it's not made fomr MS.