ytgw123 (dot) cn – block immediately
The Internet Storm Center has two important articles:
1. 10 signs you might be compromised, and don’t even know it
The asprox domain – ytgw123 (dot) cn is injected using a via a cookie.
A quick search on google (hxxp://www.google.com/search?q=ytgw123 – don’t click on any results!) reports New York Methodist Hospital, quicklogic, and others are infected.
Domain will be added on the next update, but you should not wait.