*** PAY ATENTION BEFORE CLICK ON ANY LINK ON THAT MESSAGE ***

I don't know if this thing is already known, but I just got this when
I was "navigating" on a certain website. It was a sucession of hidden
 from diferent domains, ending on:

http://69.50.183.34/m.html 

It will then call another frame, targeting to:

http://69.50.183.34/xpl.wmf 

Which is the exploit itself. This WMF will download the file cj.exe on
the same server (http://69.50.183.34/cj.exe) and run. It worked with 
me, and probably will work with a lot of people (hey, I just checked
the windows update site for updates, and seems that I'm fully
patched... even though, the exploit was triggered on me).
After exploitation, cj.exe will try to install some browser helper
objects (probably a spyware or something like that)

Just checked on www.virustotal.com and it seems that both files are 
quite unknown.

--
# (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil