The new virus, originally reported last week, exploits a vulnerability in how Microsoft operating systems, including Vista as well as previous versions of Windows, handle animated cursor (.ANI) files. The attack vector can be either a Web page or e-mail message containing the malicious code.
Microsoft had originally planned to release the patch next Tuesday as part of its regular monthly release of security bulletins, but decided to release the update ahead of schedule because it has become "aware of the existence of a public attack utilizing the vulnerability," the spokesperson said in an e-mail.
The spokesman added that "Microsoft's monitoring of attack data continues to indicate that the attacks and customer impact is limited."
According to Dunham, hacker log files and payloads indicate that many of the original attacks, mainly out of China, are focused on the theft of role-playing game credentials. "Real hackers are making real money in a virtual world," he wrote.