Microsoft published MS06-001 on Thursday 5 January 2006, five days before the Tuesday it had named. The bulletin rated the flaw Critical on Windows 2000, XP and Server 2003 and noted that it was already being exploited. A Windows Metafile is a list of drawing commands; one, a printer escape called SETABORTPROC, named a routine for Windows to call so that a print job could be cancelled, and in a metafile that routine could be bytes inside the file itself. The CERT Coordination Center called the escape "obsolete", kept "only for compatibility with 16-bit versions of Windows". Nobody had to run a program. Windows parsed the file whenever it drew one — in a web page, a preview pane or a folder of thumbnails.
The attacks arrived with the disclosure. The flaw became public on 27 December 2005; on the 28th Sunbelt Software reported it in use against fully patched Windows XP, and Microsoft published Security Advisory 912840. The SANS Internet Storm Center found one site where it dropped a trojan that fetched a fake anti-spyware program, Winhound. Renaming the file did not help, since Windows judged format by content, and F-Secure warned that Google Desktop indexing a downloaded file was "enough to invoke the exploit". On New Year's Eve a worm crossed MSN Messenger in the Netherlands as "xmas-2006 FUNNY.jpg", and an exploit generator whose code claimed Metasploit and xfocus as authors began producing files no anti-virus engine then recognised. The Storm Center went to yellow alert for the second time in four days.
Ilfak Guilfanov had posted his fix on Saturday 31 December. It hooked every program that loaded user32.dll and patched the Escape function in memory to refuse SETABORTPROC; "all pictures will continue to be visible," he wrote. The Storm Center's handlers, who had reached much the same fix, asked to redistribute his, tested it, and on New Year's Day told readers: "You cannot wait for the official MS patch." The patch, Tom Liston wrote, "does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective." F-Secure said it had installed it on 500 of its own computers. By 4 January SANS reported more than 120,000 downloads, and the Storm Center's chief technology officer, Johannes Ullrich, called the recommendation a first for SANS. Microsoft and Gartner advised against it.
Microsoft had said its fix would arrive with the monthly release on 10 January, and Debby Fry Wilson, a director in its security response unit, saw no need for an emergency patch, with infection rates stabilised and the risk seen as low to moderate. On 4 January the company confirmed that a pre-release build had been "briefly and inadvertently" posted on a security website. On Thursday it changed course, citing testing completed "earlier than anticipated" and "strong customer sentiment", and published after 2 p.m. Pacific. Wilson allowed that she could not recall a third-party patch having had the security community's endorsement before. The official update did in effect what Guilfanov's had: it removed SETABORTPROC support from metafiles. Guilfanov told his users to uninstall his and take Microsoft's.
Through the Front Door
The Federal Trade Commission announced on 26 January 2006 that the data broker ChoicePoint would pay a $10 million civil penalty — "the largest civil penalty in FTC history" — and $5 million for consumer redress. Nobody had needed to break in. The commission alleged that ChoicePoint had approved as customers people who lied about their credentials, used commercial mail drops as business addresses and sent applications for supposedly separate companies from fax machines at public commercial locations, and that it had not tightened its checks even after law-enforcement subpoenas alerted it to fraud going back to 2001. The company noticed the suspicious accounts in September 2004 and called the Los Angeles police in October; it began notifying people in February 2005, starting with 35,000 Californians because that state's law required it. The records of more than 163,000 people had been compromised, and the commission counted at least 800 cases of identity theft. "Consumers' private data must be protected from thieves," said its chairman, Deborah Platt Majoras. ChoicePoint admitted no violation and agreed to independent security audits every other year until 2026.
Machines for Rent
Jeanson James Ancheta, 20, of Downey, California, pleaded guilty in the federal court in Los Angeles on Monday 23 January 2006 to four of the seventeen counts in his November indictment: conspiracies under the Computer Fraud and Abuse Act and the CAN-SPAM Act, damaging computers used in national defence, and accessing protected computers to commit fraud. The Justice Department had called it "the first prosecution of its kind" in the nation. By its account he spread a modified trojan called rxbot, gathered the infected machines in an IRC channel and sold access to them for attacks and spam — about $3,000 from more than 30 sales. Adware paid better: more than $107,000 from advertising affiliates for installs on more than 400,000 computers. His bots had reached the Naval Air Warfare Center at China Lake and the Defense Information Systems Agency. On 8 May Judge R. Gary Klausner gave him 57 months — the department's "longest known sentence" for spreading viruses — and told him: "Your worst enemy is your own intellectual arrogance that somehow the world cannot touch you on this."
A Registry for the Back Office
On Wednesday 18 January 2006 Nasscom, the software and services industry's association, announced a National Skills Registry for people working in IT and outsourcing. It was built with, and hosted by, National Securities Depository Ltd of Mumbai, which already handled the country's electronic share transfers. Employees entered their own personal and career details, agencies chosen by Nasscom and NSDL verified them, and the design added biometric identification. An employer could see a record only with the employee's consent, and would pay a fee to do so. The decision dated from 2005 and from allegations that outsourcing staff had stolen and sold customers' data: in April twelve people had been arrested over more than $300,000 allegedly taken from four Citibank account holders in New York, three of them former call-centre employees of Mphasis BFL, and in June a British tabloid alleged that an IT worker in Delhi had sold data on a thousand UK bank customers, which he denied — coverage The Economic Times called "Indiaphobia".
Sunil Mehta, a Nasscom vice-president, called it "a site that is in a way owned and operated by employees", and gave the industry's reason in a sentence: "We believe the entire ecosystem has to be protected." Registration was voluntary and spread slowly; by November 2008, The Indian Express reported, about 350,000 professionals had signed up, and only 22 of the 66 participating companies required it. The registry is still running. Its own page now counts some 3.7 million web registrations and 337 subscribing companies, and still tells registrants that a profile "can be viewed by companies upon your authorisation" — consent, which the DPDP Act now makes the usual lawful basis for handling personal data.
Sony drops Aibo and Qrio; Lego unveils NXT
On Thursday 26 January 2006, with its quarterly results, Sony said it would stop making Aibo, the robot dog it had sold since 1999, at the end of March, and stop developing Qrio, a 60-centimetre humanoid that never went on sale. Some 150,000 Aibos had found owners; the artificial-intelligence research behind both, Sony said, would go into its core business. Three weeks earlier Lego had gone the other way: at the Consumer Electronics Show on 4 January it unveiled Mindstorms NXT, due in August at $249.99, a kit around a 32-bit programmable brick, with touch, light, sound and ultrasonic sensors, three motors that sensed their own rotation, Bluetooth and software built on National Instruments' LabVIEW. On 23 January IBM said it had put the source code of UIMA, its framework for analysing text and other unstructured information, on SourceForge. Sony revived Aibo in 2018 and in June 2026 said it would stop selling it in Japan once stock ran out; Lego ended Mindstorms in 2022; and IBM's Watson ran DeepQA software on Apache's UIMA.
Symantec unhides a folder; StopBadware launches
Symantec posted an advisory on Tuesday 10 January 2006: in Norton SystemWorks 2005 and 2006, NProtect, the directory behind the Norton Protected Recycle Bin, was hidden from Windows' programming interfaces, so virus scans might miss files placed there. A LiveUpdate made it visible. Symantec credited Mark Russinovich of Sysinternals and F-Secure's BlackLight team but rejected their term, loaded so soon after Sony BMG's copy-protection rootkit: "It's a hidden folder, not a rootkit," said Symantec's Vincent Weafer. Kaspersky Lab, criticised for cloaking the checksums its anti-virus kept of scanned files, said there was no vulnerability. On 24 January Washington's attorney general announced the state's first suit under its 2005 spyware law, alleging that the free scan used to sell Secure Computer's $49.95 Spyware Cleaner always reported spyware; Microsoft sued separately, and late that year Secure Computer settled with the state for $1 million, admitting no wrongdoing. The next day Harvard's Berkman Center and the Oxford Internet Institute launched StopBadware.org, backed by Google, Lenovo and Sun Microsystems; Google's warning pages for dangerous sites would later link to it.
⏳ Time capsule — January 2006
- On 10 January, at the Macworld Conference & Expo, Steve Jobs announced the first two Macs built on Intel processors, an iMac and the 15-inch MacBook Pro, both on the Intel Core Duo. Apple had announced the move from PowerPC in June 2005; it declared the transition complete with the Mac Pro in August 2006, and in June 2020 announced it would leave Intel for chips of its own.
- On 15 January the Stardust sample capsule landed on the Utah Test and Training Range at 10:12 UTC, carrying dust gathered from the coma of comet Wild 2. At 12.9 kilometres a second, its re-entry was the fastest ever achieved by a human-made object.
- On 16 January Ellen Johnson Sirleaf took office as President of Liberia, the first elected female head of state in Africa. She served until January 2018 and received the Nobel Peace Prize in 2011.
- On 24 January Disney agreed to buy Pixar for about $7.4 billion, paid entirely in Disney stock. The deal, completed on 5 May, made Steve Jobs Disney's largest individual shareholder and gave him a seat on its board.
Who Patches First
The metafile flaw is remembered less for its damage than for the question it settled. On 13 January Stephen Toulouse of Microsoft's Security Response Center explained its origin: the escape had entered metafiles with Windows 3.0, around 1990, when "these metafile records were all completely trusted by the OS." Its beginning is still a claim. In February Kaspersky Lab's Alexander Gostev reported that someone appeared to have found the flaw around 1 December, and that two or three Russian groups appeared to have sold an exploit for $4,000. The question was who may patch. The Zeroday Emergency Response Team answered the VML flaw that September and the cursor flaw in April 2007; when Windows 10's support ended in October 2025, a company pledged at least five years of micropatches.
The briefs ended as precedents with long tails. ChoicePoint settled with the commission for another $275,000 in 2009, over a security tool switched off in April 2008 and not missed for four months; the audits ordered in 2006 run until this year, and the sums have changed scale — Equifax agreed in 2019 to pay at least $575 million, an ending recorded in September 2017. Ancheta's was, in the Justice Department's words, the first prosecution of its kind; the botnets that followed run through this archive, from Storm to Conficker and Mirai. Nasscom's registry is still asking for consent. Behind this edition the archive runs back through December 2005 to January 2005, where it begins.