This is definately something that's generated locally... there's no headers and footers or anything in that code, the code as posted in that other thread was all that showed up on the page. If this was done with javascript it would show in the source and the headers and footers of smutserver would be there...
Also, if it would be something in the HTML the original URL and the URL with the IP-address should give the same result, but on an infected machine, they don't. This is really caused by spy-ware
|