Workaround for zeroday WMF exploit
It’s worth repeating a few things here. There is a nasty exploit in the way that WMF images are parsed in Windows. This means that WITHOUT user intervention a system can be remotely exploited and through that exploit various software (spyware, viruses, other malware) can be installed. There is no patch at this moment, I don’t know of my AV vendors that detect it (f-prot seems to according to their blog posts.) There is a workaround TO PREVENT INFECTION. If the system is already infected, reinstallation may be the only solution.
The workaround is posted various places, including the Sunbelt blog and basically disables the Windows picture and fax viewer. To workaround
From the command prompt, type REGSVR32 /U SHIMGVW.DLL.
The above can be copied/pasted directly into Start…Run…
This will also impact your ability to preview some images natively within windows. It’s a fair tradeoff to secure the system against this exploit. You DON’T want it and all the baggage it brings. It sounds like it’s already been bundled into metasploit. (An exploit detection program that has good uses or bad uses… Security auditing/vulnerability exploiting can be a fine line.)
It sounds as though the number of sites utilizing this are multiplying quickly. Webmail junk messages (and probably html formatted emails in traditional mail clients may also be a vector of attack.)