Note: The official Microsoft patch is out, use Windows Update to get it. 

I’ve blogged about this virus before, I’m doing it again as the situation is getting worse, not better. This is a major virus and Microsoft hasn’t patched it. An unofficial patch can be found here:

www.hexblog.com/security/files/wmffix_hexblog14.exe

It should work for Windows 2000, XP 32-bit, XP 64-bit, and Windows Server 2003.

If you are on Windows apply this patch, it can be uninstalled when Microsoft eventually releases an official patch but until then install this.

SANS is also reccommending this patch — isc.sans.org/diary.php?storyid=996

This is a bad situation that will only get worse. The very best response that our collective wisdom can create is contained in this advice - unregister shimgvw.dll and use the unofficial patch. You need to trust us.

After you have applied the patch, unregister the dangerous DLL file: isc.sans.org/diary.php?storyid=994

# Click Start, click Run, type “regsvr32 -u %windir%/system32/shimgvw.dll” (without the quotation marks… our editor keeps swallowing the backslashes… its %windir%(backslash)system32(backslash)shimgvw.dll), and then click OK.
# A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.
linkfilter.net - fresh links daily
www.hexblog.com/2005/12/wmf_vuln.html

Related Posts: