I noticed that in the code too. I think it specifically attacked IE5 and IE6 browsers because they're the ones susceptible to the ActiveX exploit on the redirect URL. That also makes it less likely to be detected right away by the webmaster, since most of us keep our own stuff updated.
I've been through all my sites file by file and am pretty sure I've got it all. I'd already updated the trade script that had the security hole that allowed them access.
I was literally minutes late getting the update installed (released that same afternoon). Time stamp on the uploaded files for the update was 9:02 PM. Time stamp on the modified hack files was 8:50 PM.
