Thanks for all the helpful info, especially this link http://www.kaspersky.com/news?id=156681162 which pretty much sums it up. Once a site is infected, it doesn't start attacking others. It's called a worm, but it isn't propagating itself is it? Are we allowed to post the ip address of the offending...