Omid Farhang
Table of Contents
Early 2006 delivered a rude reminder: a picture was not always safe. A flaw in how Windows handles WMF (Windows Metafile) images allows attackers to run code through crafted files — sometimes simply by viewing them in a browser, image viewer, or Explorer preview pane.
It is a classic zero-day moment: exploit code is circulating while users wait for an official fix.
Why This Feels Different
Previous worms often needed obvious .exe attachments. The WMF issue blurs the line:
- Malicious images embedded in web pages
- Infected files shared on instant messaging
- Drive-by scenarios where the user does not consciously “install” anything
- Thumbnail and preview panes in Explorer triggering the flaw without a double-click
That changes the conversation from “don’t run unknown programs” to “patch now, reduce exposure, and be careful where you browse.”
What Happened This Week
Microsoft released an out-of-band security bulletin (MS06-001) on January 5, ahead of the normal Patch Tuesday cycle. Attackers had already weaponized the flaw. Security mailing lists and forums circulated sample exploits within days.
Researcher Ilfak Guilfanov also published an unofficial hotfix while administrators waited for Microsoft’s patch to propagate through WSUS and manual update channels. That kind of community response was unusual and controversial — but it reflected how urgent the situation felt on production networks.
Practical Mitigation Steps
While ensuring the official patch is installed:
- Verify MS06-001 is applied — check Windows Update or your WSUS console
- Consider the
shimgvw.dllunregister workaround only if you understand the trade-offs — thumbnail preview breaks, but exposure drops - Keep antivirus signatures current — vendors added detection quickly
- Avoid random image links in chat and forums
- Use a secondary browser for risky surfing — not perfect, but reduces one attack path
Document any workaround you apply. Unregistering DLLs causes confusion six months later when someone asks why thumbnails stopped working.
Lessons for Support People
If you fix family PCs or small-office networks, WMF is a teaching moment:
- Patch Tuesday is not the only patch day — subscribe to vendor alerts
- Back up before experimental fixes
- Test patches on one machine before rolling to twenty
- Explain to users why “just looking at a picture” was enough to infect a PC
The preview pane is convenient. It is also an attack surface nobody thought about until this week.
What Administrators Are Doing
Enterprise shops with WSUS are pushing MS06-001 as a critical deployment. Smaller offices without central patching are visiting Windows Update manually — or calling the one person who knows how.
Home users on dial-up face a long download. Tell them to start the update and leave it running. An half-patched network is worse than none — some machines protected, others still vulnerable.
The Unofficial Patch Debate
Guilfanov’s hotfix sparked argument on mailing lists: was it safe to deploy vendor code outside Microsoft’s chain? Many admins waited for MS06-001 anyway. The discussion itself was useful — it forced teams to decide who owns emergency patching policy before the next zero-day, not during it.
What Changes After WMF
The WMF exploit changes how support people talk about safety. It is no longer enough to say, “Do not run unknown programs.” A malicious image can be the program.
From here on, staying current is not optional. It is maintenance, like disk cleanup used to be.