Web caches used by search engines and ISPs are harbouring malicious code thought to have been long-removed, according to a recent report.

Security company Finjan said that the caching servers used by sites such as Google and Yahoo are holding exploit code that could be used by third parties to carry out an attack.

"It is possible that storage and caching servers could unintentionally become the largest legitimate storage venue for malicious code," said Yuval Ben-Itzhak, chief technology officer at Finjan.

Caches are created from copies of pages made by search engines which then sort and index the information on the pages.

Even after sites containing exploit code are removed, the individual pages indexed by search engines will remain on the web within those cache servers.

Finjan said that it has given the details of its findings to several search engine companies and ISPs, and is in discussions on ways to solve the problem.