MS06-047: MDROPPER variants manipulate Office vulnerabilities patched in August
Corporate and home users should first ensure they are on the latest service packs for Office and then apply Office Update so that they are as up-to-date as possible. The new Microsoft Update facility combines Office and Windows update into a single step and works well on all my PCs. Finally, never click on ANY attachment or URL in a spam email message as they could introduce malicious spyware or viruses into the Windows environment.
MS06-047: New MDROPPER.BI - Spammed as malformed Excel document
http://secunia.com/virus_information/31362/trojmdropper.bi/
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FMDROPPER%2EBI
MS06-047: New MDROPPER.BI - Behavior Diagram
http://www.trendmicro.com/vinfo/images/TROJ_MDROPPER_BI_BD_img2.gif
QUOTE: This Trojan arrives on a system either downloaded from the Internet or dropped by other malware. It may also arrive as an attachment to a spammed email message. When executed, it exploits a vulnerability in MS Office 2000 and MS Office XP wherein a specially crafted .XLS file can cause the application to drop and execute an embedded .EXE file on the affected system. Once it successfully exploits the mentioned vulnerability, this Trojan executes a shell code which, in turn, runs an embedded .EXE file. This .EXE file is detected by Trend Micro as BKDR_AGENT.DNX.
MS06-047: New MDROPPER.BI - Spammed as malformed Word document
http://secunia.com/virus_information/31363/trojmdropper.bj/
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FMDROPPER%2EBJ
MS06-047: New MDROPPER.BJ -Behavior Diagram
http://www.trendmicro.com/vinfo/images/TROJ_MDROPPER_BJ_BD_img2.gif
QUOTE: This Trojan arrives on a system as a .DOC file dropped by other malware or downloaded by unsuspecting users when visiting malicious Web sites. It may also arrive as an attachment to a spammed email message. When executed, it exploits the Windows Visual Basic vulnerability, which affects MS Office 2000 and XP. Once it successfully exploits the mentioned vulnerability, this Trojan attempts to drop and execute a file which is detected by Trend Micro as BKDR_AGENT.DNX
The following links provide more information related to the MS06-047 security patch, plus a good technique for home users to stay up-to-date for both Windows and Office Updates:
Microsoft Security Bulletin MS06-047 -- Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (921645)
http://www.microsoft.com/technet/security/bulletin/MS06-047.mspx
Microsoft Update - A more complete approach than Windows Update
http://msmvps.com/blogs/harrywaldron/archive/2006/04/14/90966.aspx