Microsoft, meanwhile, would only say that it was on the case. "We are aware of the issues and are working to rectify the situation," said Justin Osmer, a senior product manager for Live Search, in an e-mail sent by the company's public relations firm.

Yahoo did not respond to a similar request for comment Wednesday.

Sunbelt first noticed the huge number of infected sites, and their appearance in results lists for a bewildering array of searches, on Sunday. Thomas explained how the attackers managed to beat the search system. "For months now, our research team has monitored a network of bots whose sole purpose is to post spam links and relevant keywords into online forms, typically comment forms and bulletin board forums," he said. "This network, combined with thousands of pages such as the two seen above, have given the attackers very good, if not top, search-engine position for various search terms." Among the hundreds of search terms he had spotted being used were "infinity" and "hospice."

"Pretty sick," Thomas said.

Users with PCs not completely up-to-date on their patches, he continued, were attacked by what Sunbelt has dubbed "Scam.Iwin," which turns the compromised computer into a pay-per-click zombie that generates revenue for the attacker. "Scam.Iwin is also used to load malware for other groups," claimed Thomas. "In this case, one of those malware groups is known to have been associated with the infamous RBN [Russian Business Network]."

The RBN, a notorious malware and hacker hosting organization, made the news this month when it pulled up stakes and shifted operations from St. Petersburg, Russia, to Shanghai. Literally within days of the move to China, however, RBN abandoned the IP blocks it had been allocated there, spurring speculation by security professionals that the network had gone underground to avoid publicity, which its criminal clients naturally shun.

Other researchers, while not downplaying the scope of the attempted attack, said that it was only its size that set this one apart.

"This is the same stuff we talk about when we talk about innocent searches, mostly anyway, and it must be working because there's a huge push at the moment," said Roger Thompson, chief technology officer at Exploit Prevention Labs Inc., in a post to his company's security blog. "Bear in mind that we see this nearly every day."