This exploit involves drive-by attacks originating from thousands of newly-compromised websites. These websites transfer malware to the victim computer through a vulnerable DLL in Microsoft DirectShow video streaming software. Exploit code is currently available in the wild and there is no patch available at the time of this writing.

This attack affects the following operating systems:

The attack works in the following way:

The malicious payload allows the attacker to gain the same user rights as the local user. Such rights give the attacker a range of abilities such as downloading more malicious programs, redirecting a victim's Web searches, and intercepting information that the user types or keeps on the computer.

At the time of this writing no patch is available from Microsoft. Check Point offers immediate, preemptive protection for both its enterprise and consumer customers:

ZoneAlarm Customers:

If you are running ZoneAlarm® ForceField™ browser security technology (included in ZoneAlarm Extreme Security), you are already protected.

Users who lack protection are invited to download a 15-day trial version of ZoneAlarm Extreme.