The release of a Trojan that exploits an unpatched IE hole has prompted speculation that Microsoft may release an emergency out-of-cycle security patch. The Delf-DH Trojan downloader uses an Internet Explorer vulnerability to infect unprotected Windows users who stray onto maliciously constructed websites. Delf-DH downloads other malware onto infected machines changing settings in order to monitor user activity and redirect surfers onto porn sites.

The attack relies on a flaw in the way IE handles requests to the window() object, highlighted by proof-of-concept code last week and now used in anger by VXers. Even fully patched Windows 2000 and Windows XP systems are vulnerable. Until a patch is available to address this vulnerability, US-CERT strongly encourages Windows users to disable Active Scripting.

Security experts at the SANS Institute Internet Storm Centre speculate that the attack, though not widespread, is serious enough for Microsoft to release an out of cycle patch rather than waiting for its scheduled monthly patching day, which this month falls on 13 December. Microsoft isn't commenting on when a patch might be available but the smart money is on Redmond following a June 2004 precedent and releasing an emergency security fix outside its regular Patch Tuesday updates. ®

Related stories

• NSA writes more potent malware than hacker (28 September 2007)
• MS anti-Trojan shield fails to protect older Offices (6 June 2007)
• Germany jails €12m porn Trojan scam duo (22 December 2006)
• IE and Firefox blighted by fake login flaw (23 November 2006)
• Patches released for zero-day IE threat (29 March 2006)
• 'Critical' IE bug threatens PC users (27 March 2006)
• US man faces IRC Trojan charges (6 March 2006)
• Windows support program bent to fit (12 January 2006)
• More cracks appear in Windows (11 January 2006)
• Security flaws on the rise, questions remain (9 January 2006)
• World+dog scrambles to fight Windows flaw (3 January 2006)
• Trojan alert over unpatched Windows flaw (29 December 2005)
• UK shelters from smut Trojan blitz (19 December 2005)
• Update glitch spins out IE7 beta testers (19 December 2005)
• Dasher update pierces Windows flaw (16 December 2005)
• Dasher worm targets October Windows vuln (15 December 2005)
• MS releases IE überpatch (14 December 2005)
• Security threats soar in 2005 (7 December 2005)
• Exploit code unpicks IE flaw (22 November 2005)
• Solitary patch for MS Nov Patch Tuesday (4 November 2005)
• Exploit for unpatched IE vuln fuels hacker fears (19 August 2005)
• Six patches - three critical - in MS August patch batch (10 August 2005)
• Warning over unpatched IE bug (4 July 2005)