Just five minutes ago I had an injection attack through Yahoo! Messenger. The only visible effect was the change of my status message. I also got a dialog message saying that a script cannot continue running because the string was not terminated, or something like that; when I looked for the script at the specified path I could not find it.
How the attack was executed: a conversation window with someone I did not know popped up; it displayed a distorted box, the kind that appears when the other person is sending you a file (only there was no file to save). (The box was distorted as if the client had trouble rendering it.)
I tried saving the conversation (to see the text that was sent), but it was empty. I haven't restarted my computer. Any chance I could see what was sent to me?
I searched the id through which the attack came and found it is affiliated with a site that has a public form for changing any person's status message: all you have to do is put in their id, the status message and you're done. (I don't think I should mention what site it is.)
I used the form to send attacks to my own self so I could capture them with a network analyzer. The exploit was sent through a malformed File Transfer Request. I also sent a normal FTR to compare and see what is different in the exploit. Among others, a FTR contains the following info:
(a) name of the file being sent
(b) size in bytes
(c) hash probably used to check if the transfer succeeded
The exploit had no file name, and presumably the size of the file is 4128 bytes (but there's no file you can actually download). The hash is somewhat more interesting. In a normal FTR, the hash looks like any other (a string of characters); the exploit FTR had this for a hash:
Anyway, I'll report the site to Yahoo!. (Edit: Except I can't seem to find where to report it... >:( )