An attack first noted on the VFW website is spreading, say researchers at Symantec. If you must use IE9 or IE10, get patched now