Sample code is circulating on the Internet for an attack using a flaw that Microsoft knows about, but has not yet fixed.

On Thursday, Microsoft warned people about a vulnerability in the Windows Shell, the part of the operating system that presents the user interface. The flaw affects Windows 2000, Windows XP and Windows Server 2003 and could be exploited via the Internet Explorer Web browser through a component called WebViewFolderIcon, the company said in an advisory.

"An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer," Microsoft said. "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user."

While sample exploit code has been published, Microsoft said it has not yet seen any related attacks. The vulnerability was actually discovered two months ago, but the code only surfaced this week, according to the French Security Incident Response Team.

In-the-wild exploits against the latest unpatched Windows vulnerability have started circulating, using Internet Explorer as the attack vector to load identity theft Trojans and rootkits on infected machines.

The exploits target a Windows Shell vulnerability that was first released during HD Moore's Month of Browser Bugs project in July 2006 and is being launched by a known cybercrime organization operating out of Russia, according to virus hunters tracking the threat.

Microsoft has released an advisory with pre-patch workarounds and said an official update is on tap for delivery on Oct. 10.

The attack uses IE to trigger an integer overflow error in the 'setSlice()' method in the 'WebViewFolderIcon' ActiveX control. Microsoft recommends that IE users disable attempts to instantiate the ActiveX control by setting the kill bit for the control in the registry.

According to Exploit Prevention Labs, an Atlanta, Ga. company that provides zero-day protection tools, two separate online crime groups are hacking into legitimate Web sites and message boards and quietly planting a malicious HTML tag called an iFrame on the site.