An email message containing an Exploit-WMF sample built from this new code has been spammed. The message appears as follows:

Subject: Happy New Year
Body: picture of 2006
Attachment: HappyNewYear.jpg (actually a WMF file with a .JPG extension)

The attachment causes a new BackDoor-CEP variant to be downloaded and run from www.ritz/tours.com.

http://vil.mcafeesecurity.com/vil/content/v_137760.htm