Author Topic: thickbbwforum.com  (Read 1930 times)

0 Members and 1 Guest are viewing this topic.

May 22, 2009, 10:58:40 pm
Read 1930 times

xorrox

  • Special Access
  • Newbie

  • Offline
  • *

  • 3
Another site with mebroot, see:
http://wepawet.cs.ucsb.edu/view.php?hash=2a7df468e9fe340d9291580d597bd37e&t=1243032623&type=js

Came across this when searching for "advmaker_komap" (cookie-name) to understand what this is about.
They are discussing it on their forum, while the forum is still infected.

They got (newer) mebroot-version using Twitter to generate pseudo-random popup domain-names.