Install Microsoft’s WMF patch

Microsoft released on Jan. 5 an emergency patch, named MS06-001, which corrects Windows’ so-called WMF (Windows metafile) vulnerability. A WMF exploit can silently infect a PC when it merely displays an image in any browser, instant messaging, P2P, e-mail, or in a directory listing in Windows Explorer; when desktop-search applications index an infected image file; and in other ways.

I published a special news update earlier in the week urging readers to install an unofficial patch for this problem. This workaround was also strongly recommended by F-Secure, the SANS Institute’s Internet Storm Center (ISC), and several other security sites.

Readers should now install the official patch instead, following the steps I describe below.

Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

PC Drive Maintenance (Excerpt)

Subscribe and get our monthly bonuses - free!

Your hard drives store photos, books, music and film libraries, letters, financial documents and so on. This ebook is aimed at helping you understand your hard drives, expand their capacities and length of life, and recover what you can from them when they fail. We're offering you a FREE Excerpt! Get this excerpt and other 4 bonuses if you subscribe FREE now!



It’s highly unusual for Microsoft to release a patch on a date other than the 2nd Tuesday of each month. In fact, Microsoft had originally announced that it would not release a solution for the WMF hole, which was being actively exploited on the Internet, until Jan. 10.

Microsoft’s decision to reverse itself and release the patch out-of-cycle is to be commended. This action reinforces my belief that the WMF hole was so serious that Windows users needed to protect themselves immediately and not wait a week or more for an official Microsoft patch.

The unofficial patch, by Belgian developer Ilfak Guilfanov, was not the only workaround that became available to Windows users in recent days. Microsoft itself suggested in its Dec. 28 security advisory 912840 (which has now been mostly deleted) that users deregister Shimgvw.dll, a vulnerable file. In addition, an unauthorized version of the MS06-001 patch was leaked on some Web sites.

I recommend that individual PC users take the following steps. The procedure I describe below helps you install the official Microsoft patch without problems, regardless of which of the above workarounds, if any, you used. (Information for corporations on scripting patches to install them across a network is available from the ISC.)

Step 1. Reboot your PC. This will remove any infected images that may remain in your PC’s memory.

Step 2. Uninstall the leaked MS06-001 patch, if you installed it. The leaked patch is detected by Windows Update and may interfere with installing the official patch.

Step 3. Run Microsoft Update. Install MS06-001 and any other critical patches you may need. If you haven’t yet upgraded from Windows Update (WU) to the newer Microsoft Update (MU), you may use WU. But I recommend that you upgrade to MU when WU suggests you do so. MU updates Microsoft Office and other apps as well as Windows.

Step 4. Re-register Shimgvw.dll, if you deregistered it. Complete information on deregistering this file is contained in Microsoft security bulletin MS06-001, in the Workarounds portion of the Vulnerability Details section. To re-register the file, run the same command but leave out the -u and the space after it.

Step 5. Uninstall the unofficial Guilfanov patch, if you installed it. The developer himself and several other experts have confirmed that his patch does not need to be removed before installing Microsoft’s official patch, which rewrites files on disk. After installing MS06-001, there is no need for the Guilfanov patch. It fixes the DLL in memory, which is no longer necessary, and his patch should be removed.

Printing problems were reported with some older Windows programs; these issues appear to be related to the DLL file being deregistered. The problems will probably by cured (but not necessarily) by installing MS06-001 and re-registering the DLL, as explained by the ISC.

For more information about the WMF situation, the ISC has published a detailed FAQ. Some details are now out of date due to the release of Microsoft’s official patch. Also, a useful interview with developer Guilfanov has been published by Securiteam.

We’ll have extensive information on the WMF problem, the various fixes, and any negative side-effects in the paid version of our regular Jan. 12 newsletter. How to upgrade to the paid version

Please update your postal code

The Windows Secrets Newsletter will begin to include local information, based on each subscriber’s ZIP or postal code, within the next few issues. After we announced this in our Jan. 4 news update, more than 14,000 of our readers updated their preferences page to enter the correct code. We’ll have a report on the general location of our readers around the world in an upcoming issue.

We’ll have complete information about the kinds of location-specific features that will be in the newsletter as soon as we’re able to release these details.

If you saw an error page when you tried to update your postal code on Jan. 4, please try again. This error was caught and fixed. Thanks for your help. —Brian Livingston, Editor

Next regular issue will be Jan. 12

Today’s e-mail message is a short news update. Our next regular issue will be published according to our usual twice-a-month schedule on Jan. 12. That’s two days after Microsoft Patch Tuesday, when new Windows patches are usually released.

News updates don’t include our usual columnists, our Wacky Web Week feature, or other sections. A news update also has no free version and no paid version; it’s all the same message.
= Paid content

All Windows Secrets articles posted on 2006-01-06: