Thanks again for this posting. You saved me a ton of time and I appreciate the great write-up. This is a really vicious attack. Do you have any idea what the vector is? The two clients who have been affected by this so far haven't been able to say how they got it.