I also blocked some of the sites that had loaded them - they don't come from places I click on:
Good argument for installing the noscript add-on in Firefox, with cross site scripting disabled, then.
Trojans and rootkits often install via a similar type of pathway.