New attack hitting Web users through major sites

Internet users may unwittingly be downloading malicious code

The attack affects only users running Microsoft Corp.'s Windows operating system and Internet Explorer browser


Internet users visiting some of the most popular sites on the Web may unwittingly be downloading malicious code that compromises their computers and sets up a relay network for a future onslaught of spam, a security services company warned Thursday.



NetSec Inc., which provides managed security services for large businesses and government agencies, began detecting suspicious traffic on several of its customers' networks on Thursday morning, said Chief Technology Officer Brent Houlahan.

Examining firewall logs and other data points on those networks, NetSec found that when users visit certain popular Web sites -- including an online auction, a search engine and a comparison shopping site -- they unwittingly download a piece of malicious JavaScript code attached to an image or graphics file on the site.

Without the user's knowledge, the code connects their PC to one of two IP (Internet Protocol) addresses in North America and Russia. From those systems they unknowingly download a piece of malicious code that appears to install a keystroke reader and probably some other malicious code on the computer, Houlahan said.

The code may be gathering the addresses of Web sites visited by affected users and the passwords used to access them. In addition, the IP address in Russia is a known source of spam, and the code may be creating a network of infected machines that could be used to relay spam across the Internet at some later date,