Web Server infected?

From: Thomas Goodson (thomas_nospam.goodson_at_omega-link.com)
Date: 09/16/05


Date: Fri, 16 Sep 2005 14:58:24 -0400

I have a customer's web site that seems to be infected. When the local
internet cache is empty and it is the first time that I hit the site from a
given IP address, I'll get back the normal web page with the following text
added to the top of the message:

<script language=JavaScript src=/oofohmg.js></script>

and internet explorer will seem to be in a loop. In any case, the load of
the page never reaches the point where it displays "done" on the status bar.
If I do a refresh of the site, then it will load correctly and the text
above will not appear in the view source. It has been suggested by the web
host that I have a virus. I have tried this from 5 different computers
running 3 different anti virus program, 1 of which was freshly loaded from
the windows xp sp2 cd. Anyone else encountered this? Any ideas?
** Tom **