Because of the seriousness of the flaw, Microsoft has decided to publish the patch before the company's scheduled release of security patches Aug. 10. The so-called "out of band" release corrects a flaw that results in Windows incorrectly parsing shortcuts in a way that allows malicious code to be executed when the icon of a specially crafted shortcut is displayed, the company said.
"We're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability," Christopher Budd, spokesman for the Microsoft Security Response Center, said Friday. "We firmly believe that releasing the update out of band is the best thing to do to help protect our customers."
According to the Microsoft Malware Protection Center, attackers have used .LNK files to exploit the vulnerability. As malware writers have learned of the flaw, multiple techniques to exploit it are showing up on the Internet.
One family of viruses, called Sality, has caught the attention of security researchers, who have spotted a newly developed member Sality.AT that exploits the latest vulnerability.
"Sality is a highly virulent strain," the Protection Center says in its blog. "It is known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security and then download other malware."
With the release of Sality.AT, developers of other virus families will likely move quickly to copy the technique to target the same vulnerability, the center said.
Affected versions of Windows include Windows 7, XP, Server 2003, Vista and Server 2008. Microsoft has posted a detailed list.