Zero-day flaw. EVERYBODY PANIC! (Well, if you use Windows.)
Simply browsing a USB drive, Windows file share or WebDav directory can potentially infect you via a rootkit inside a .lnk file. All current versions of Windows said to be vulnerable.
Ebooks To Understand Fibromyalgia And Other Diseases com/technet/security/advisory/2286198.mspx”>Microsoft advisory: Vulnerability in Windows Shell Could Allow Remote Code Execution — no fix yet, but they do list a workaround.
Sophos’s Chester Wisniewski’s blog: Windows zero-day attack works on all Windows systems — Chester notes a good workaround:
Today, a colleague suggested the best mitigation I have heard so far: deploying a GPO disallowing the use of executable files that are not on the C: drive. This will work for most environments, and you really shouldn’t be running executables from USB drives and network shares anyway. We tested this solution against the vulnerability and it does in fact provide protection.
…which would be nice, but I’m buggered if I can find it in gpedit.msc.
From the looks of it, most of the big anti-virus vendors are onto it, and will detect it as long as your definition files are up to date.