New IE flaw has faster payload

The software – posted to the Milw0rm.com website – is based on the createTextRange() flaw, disclosed March 22, which allows malicious attackers to execute code and use the PC as a bot to execute DDos attacks, media outlets reported Monday.

Initial versions of the malware worked slowly, giving users a chance to turn off their systems before the payload was unleashed. But the new software moves much quicker to compromise a system and employs features that are not detected by some anti-virus software.

Microsoft has yet to patch the vulnerability, but at least two vendors – eEye Digital Security and Determina – have issued fixes.

Mike Reavey, security program manager at Microsoft, said last week that the Redmond, Wash.-based computing giant is not seeing an increased spread of attacks and has been active in eliminating malicious websites that are exploiting the vulnerability.

"But attacks are still occurring, so we certainly still recommend up-to-date (anti-virus) software and our safe browsing guidance while we work on the update...," Reavey said on the Microsoft Security Response Center blog.