Neowin.net

In an unprecedented move, Microsoft has issued a critical advisory urging users to apply a critical update from Flash Player update from Macromedia.

The vulnerability first reported by eEye Digital Security and Sec Consult, can allow malicious parties to inject unauthorized code, using invalid array indexes, to be executed by Flash Player. This vulnerability is browser independent. Users who have already upgraded to Flash Player 8 are not affected by this issue. Macromedia recommends all Flash Player 7 and earlier users upgrade to this new version, which can be downloaded from the Macromedia Player Download Center.

Several forums including Neowin.net allow users to add flash files in their avatars or signatures. Therefore the impact of this issue is far reaching.

News source: Microsoft Security Advisory (910550)
Download: Macromedia Player Download Center

Breplibot.b is a file 10240 bytes in size, packed using UPX. When launching, the backdoor copies itself to the Windows system directory as $SYS$DRV.EXE. Using this name makes it possible for the Sony rootkit technology to be used to hide the activity of the malicious program. Of course, the backdoor's activity will only be hidden if DRM protection, as used on some Sony Audio CDs, functions on the victim machine.

As usual, Kaspersky Lab warns users to be careful, and not to open email from unknown senders, or open attachments to suspicious messages.