Virus Info

[byronkincaid]

I got this from the motley fool forum

http://boards.fool.co.uk/Message.asp?mid=9740717

I trust the poster enough to have downloaded the patch and so have lots of other people. I don't expect you to, but perhaps one of the computer wizzes on here can confirm if this is genuine or not?

Hi all. I'm a computing professional by training and trade, 1 computing degree under my belt already and hopefully a PhD in the subject in a month's time, and around 12 years experience of de-virusing computers.

So please take this post *very seriously* and don't delay doing something about it. I'm posting an email here that I've just written to send out to all my friends, family and colleagues.

If you are another computing professional thinking of verifying the content of this message, please disable image viewing in your web browser before you go looking around on google. Thanks.

---
Short story: If you use windows, run this unofficial patch file as soon as physically possible, particularly if you use your computer for anything critical (banking, stockmarket, etc). Please pass this information on to your friends.
FILE : http://handlers.sans.org/tliston/wmffix_hexblog13.exe
---

Long Story:

Hello all,

A new Windows exploit is spreading rather fast and by design is rather difficult to prevent. Since it spreads through graphics files (WMF data structures within files labelled .wmf,.jpg,.png,.gif,.bmp), you can be affected by email,web or MSN. Exploit code has been in the wild since Dec 27th 2005.

In particular it can affect even up to date windows XP SP2 systems or
Windows 2K SP4 systems. When you view a particular type of picture,
arbitary code can be executed without your knowledge.

Info here:
(http://isc.sans.org/diary.php?storyid=994)
http://www.microsoft.com/technet/security/advisory/912840.mspx
http://www.theregister.co.uk/2005/12/29/wmf_trojan_alert/

Microsoft have not yet issued a official patch.
However, an unofficial patch is available here:
http://handlers.sans.org/tliston/wmffix_hexblog13.exe

I recommend downloading and running the "wmffix_hexblog13.exe" program as soon as possible, particularly if you use your computer for internet
banking or similar. The content of the wmffix program has been verified by several large security firms as being safe.

http://www.f-secure.com/weblog/archives/archive-122005.html
http://isc.sans.org/diary.php?date=2005-12-31

Please pass this email onto your friends ASAP. I appreciate that is the
opposite of the advice I normally give about passing on emails warning
about viruses! However I fear this will be 'the big one' of 2005/2006 given how many vectors for this exploit already exist within days.

comp.

[ifm]

Yep, you are advised to disable google desktop if you use it.

http://www.axcessnews.com/modules/wfsection/article.php?articleid=7372

[ifm]

1 thing i would say is that i wouldn't install 3rd party patches.
Best thing is to wait a few hours and Microsoft will decide if it is true and patch it themselves, also google will stop it at their end and your antivirus will update a fix for it (you do update your antivirus software don't you?)

So, enable autoupdate in windows and stay off google till tomorrow.

[ifm]

Patch for this will be released next Tuesday, in the meantime update your antivirus software and go to the link below and click on the scan button (you need to do it thru Iexplorer, firefox won't work).

http://safety.live.com/site/en-US/default.htm

[mikkyT]

Agree  with ifm.

Appriceate what original poster is warning about but dont install his patch

[Bream]

I agree.

Though I've not had the time to look into the original claim, even if it is true, to unofficially patch your OS with unaccredited code is risky to the point of carelessness. I would suggest avoiding the situations described as high risk if you're concerned and waiting for the appropriate accredited patch(es). Also, ensure your anti-virus software and firewalls are well configured.

as an aside, I'm automatically suspicious about anyone suggesting I forward things to 'all my friends' etc. as a rule I never mass send anything. It's at best impersonal and impolite and at worse, malicious, virus spreading, network clogging vandalism.

[RED-DOG]

Will windows download the new patch automaticaly?

[bundle]

My understanding is that window will make you aware that there is a new patch that you need to download, once this is done it should do the rest on its own

[byronkincaid]

I don't know anything about computers, all I know is that people with 4000 posts all helping people with computer problems on the motley fool are saying that they strongly advise people to download this patch. People have used the same arguements not to that have been used here and the arguements have been answered to my satisfaction but I am not trying to give advice on something about which I know nothing. I am just saying this may be important so maybe you should look into it.

MS patch comes out on the 10th I believe Red

[ifm]

Will windows download the new patch automaticaly?

If you have automatic updates enabled it will do it for you (you only have to agree to install when downloaded.
To enable:- START>CONTROL PANEL>AUTOMATIC UPDATES and make sure automatic is ticked.

Byron, not saying there is anything wrong with the update but it could interfere with an official patch when released.
Nice one for posting it.

[RED-DOG]

Thanks, I do have automatic updates 

[tikay]

Yeah - like "Red Dog is OUT".

[RED-DOG]

Yeah - like "Red Dog is OUT".

It's a new year, I'm playing my new game, and so far I'm only $700 down

[RED-DOG]

Make that $742