Mystery web infection on the move

Thrax

<p>Traditional security research for web infections suggests that an infected website is immediately apparent in iframes, links or scripts that contain pointers to infected servers. The user loads the link, the frame or the script and is subsequently infected.</p>
<p>The <a href="http://www.channelregister.co.uk/2008/01/16/mysterious_web_infection_continues/">newest infection</a> on the internet generates an infection script only <i>after</i> a user has visited the homepage. It is theorized that it is a rootkit on the host computer, but as of yet security researchers cannot track it and cannot find a way to combat it. </p>

Linc

Also see: http://arstechnica.com/news.ars/post/20080116-javascript-worm-from-late-2007-happily-frolicking-in-2008.html

This seems more worrisome than exploits usually are...

Your-Amish-Daddy

Rootkit, virus, whatever. I'm not worried. If they want in my network, they have to be approved. So too bad, so sad.