To answer the question about how stations get infected. Many POS malware infections start with insecure remote access. For example, over the past 12 months, LogMeIn was used insecurely by several POS companies. An account was breached, and the hacker was able to access 100's of POS stations in an unattended mode. There are ways to use these tools correctly, but many do not. For more data about this, look at the Department of Homeland Security brief: http://www.us-cert.gov/sites/default/files/publications/BackoffPointOfSaleMalware.pdf