...the owner of the hacked site removes the malicious .js code and secure their server, exploits could start hitting unpatchedvisitors again. The attackers are exploiting flaws patched in Microsoft's MS06-014 and MS07-004 bulletins...
http://blogs.zdnet.com/security/?p=15