Internet Explorer Needs A Patch
By now you must have heard of the latest exploit to Windows. If you have not, read the following:
Please note that this exploit is a serious one and if you do nothing about it your computer will be infected!
Install Microsoft's WMF patchBy Brian LivingstonMicrosoft released on Jan. 5 an emergency patch, named MS06-001, which corrects Windows' so-called WMF (Windows metafile) vulnerability. A WMF exploit can silently infect a PC when it merely displays an image in any browser, instant messaging, P2P, e-mail, or in a directory listing in Windows Explorer; when desktop-search applications index an infected image file; and in other ways. I published a special news update earlier in the week urging readers to install an unofficial patch for this problem. This workaround was also strongly recommended by F-Secure, the SANS Institute's Internet Storm Center (ISC), and several other security sites. Readers should now install the official patch instead, following the steps I describe below. It's highly unusual for Microsoft to release a patch on a date other than the 2nd Tuesday of each month. In fact, Microsoft had originally announced that it would not release a solution for the WMF hole, which was being actively exploited on the Internet, until Jan. 10. Microsoft's decision to reverse itself and release the patch out-of-cycle is to be commended. This action reinforces my belief that the WMF hole was so serious that Windows users needed to protect themselves immediately and not wait a week or more for an official Microsoft patch. The unofficial patch, by Belgian developer Ilfak Guilfanov, was not the only workaround that became available to Windows users in recent days. Microsoft itself suggested in its Dec. 28 security advisory 912840 (which has now been mostly deleted) that users deregister Shimgvw.dll, a vulnerable file. In addition, an unauthorized version of the MS06-001 patch was leaked on some Web sites. I recommend that individual PC users take the following steps. The procedure I describe below helps you install the official Microsoft patch without problems, regardless of which of the above workarounds, if any, you used. (Information for corporations on scripting patches to install them across a network is available from the ISC.) Step 1. Reboot your PC. This will remove any infected images that may remain in your PC's memory. Step 2. Uninstall the leaked MS06-001 patch, if you installed it. The leaked patch is detected by Windows Update and may interfere with installing the official patch. Step 3. Run Microsoft Update. Install MS06-001 and any other critical patches you may need. If you haven't yet upgraded from Windows Update (WU) to the newer Microsoft Update (MU), you may use WU. But I recommend that you upgrade to MU when WU suggests you do so. MU updates Microsoft Office and other apps as well as Windows. Step 4. Re-register Shimgvw.dll, if you deregistered it. Complete information on deregistering this file is contained in Microsoft security bulletin MS06-001, in the Workarounds portion of the Vunerability Details section. To re-register the file, run the same command but leave out the -u and the space after it. Step 5. Uninstall the unofficial Guilfanov patch, if you installed it. The developer himself and several other experts have confirmed that his patch does not need to be removed before installing Microsoft's official patch, which rewrites files on disk. After installing MS06-001, there is no need for the Guilfanov patch. It fixes the DLL in memory, which is no longer necessary, and his patch should be removed. |