From: "Geo" 

http://sunbeltblog.blogspot.com/2005/12/new-wmf-exploit-confirmed-in-spam.html

In an email advisory I just received from McAfee AVERT labs a new version
of the WMF exploit using new Exploit-WMF code released today has been
confimed in spam attacks resulting in the installation of a new
Backdoor-CEP variant.

An email message containing the Exploit-WMF sample built from this new code
has been spammed. The message appears as follows:


  Subject: Happy New Year
  Body: picture of 2006
  Attachment: HappyNewYear.jpg (actually a WMF file with a .JPG extension)


The attachment causes a new BackDoor-CEP variant to be downloaded and run
from www.ritztours[dot]com.

--- BBBS/NT v4.01 Flag-5