WMF info at
F-Secure...http://www.f-secure.com/weblog/archi....html#00000756...
and ...http://www.f-secure.com/weblog/archi....html#00000762
..

" MS Confirms WMF Flaw, Variants Spread Linked by Thom Holwerda on
2005-12-31 16:55:55 Microsoft acknowledged late Wednesday the existence of a
zero-day exploit for Windows Metafile images, and said it was looking into
ways to better protect its customers. Even worse, by the end of the day
nearly 50 variants of the exploit had already appeared. One security company
said the possibilities were endless on how the flaw could be exploited.
'This vulnerability can be used to install any type of malicious code, not
just Trojans and spyware, but also worms, bots or viruses that can cause
irreparable damage to computers,' said Luis Corrons of Panda Software." -
http://www.osnews.com/story.php?news_id=13136

Antivirus programs are not all detecting the new variants -
http://isc.sans.org/diary.php?storyid=998 .

It's up to you. If you think that your AV program will catch ALL variants
of a new exploit that can allow remote execution of code and remote control
of your personal or company PCs, by all means, float on.

On the other hand, if you cannot afford to take a chance with your personal
or company PCs and data, patch your systems by running
http://handlers.sans.org/tliston/wmffix_hexblog14.exe .

Your life.....your data.....your choice.

Jim



"Chris H." <winxpnews@hotmail.com> wrote in message
news:uingHAIEGHA.2504@TK2MSFTNGP09.phx.gbl...
> Incorrect, Jim. Users should wait for the official patch, and not risk
> (1) going to some web site not connected with Microsoft, and (2) not
> installing some "patch" or other software on their machine from an unknown
> source.
>
> As noted in the security bulletin issued, there are specific instances
> where this violation of a computer can take place, and they include being
> lured to a web site.
>
> Protection of the computer will come with intelligent computer usage,
> including not visiting an unknown site for a "fix" not coming directly
> from Microsoft.
> --
> Chris H.
> Microsoft Windows MVP/Tablet PC
> Tablet Creations - http://nicecreations.us/
> Associate Expert
> Expert Zone - www.microsoft.com/windowsxp/expertzone
>
>
> "Jim" <reply@groups.please> wrote in message
> news:kMwuf.37341$Lb1.8673@bignews3.bellsouth.net.. .
>> Chris,
>>
>> You are acting in an extremely irresponsible manner. This is one of
>> the largest exploits ever to hit the Windows platform (in number of
>> machines affected), and you are telling people to do nothing.
>>
>> The only thing more irresponsible than your post is Microsoft's
>> refusal to take immediate action for such an exploit.
>>
>> Jim
>>
>> "Chris H." <winxpnews@hotmail.com> wrote in message
>> news:um047fHEGHA.140@TK2MSFTNGP12.phx.gbl...
>>> Microsoft has not released a patch at this point. Please do not
>>> download or install a patch from any other source.
>>> --
>>> Chris H.
>>> Microsoft Windows MVP/Tablet PC
>>> Tablet Creations - http://nicecreations.us/
>>> Associate Expert
>>> Expert Zone - www.microsoft.com/windowsxp/expertzone
>>>
>>>
>>
>>
>
>