I built a VM with XP SP2 and no patches, and surfed FoxNews in it, and it didn't take long to pick up the Vundo.
I got it when I hit the "scitech" link. But since the ads are rotated, it's luck of the draw.
But now my VM is running a "virus scan" that shows infections of all sorts... tee hee hee..
Next challenge, remove this sucker! --
To ISPs: Leave our ports alone! If I want ports blocked, I'll do it myself, thank you.