AVG stopped it dead...
The problem is not everyone has AVG or updates their virus software. I never saw one like this before.. It wasn't on my machine, it was on the server.
Every site on that server was affected.