If this article doesn't make you uncomfortable, you may need to re-read it.
The infection routines being used by some scareware and rogue AV gangs are much more comprehensive and far-reaching than many current analysis have shown
Quote from SANS -
""Once the site has been compromised, the attackers install their script in any directory, preferably in a directory that is not accessible directly from the web since they will not need to access it directly. The next step the attackers do is to infect all (and I mean all!) PHP files on the compromised web site. If it's a shared web site, and the permissions are not setup correctly, they will actually infect absolutely every web site hosted on that machine,"
Read the full article and Threatpost
