thickbbwforum.com

[xorrox]

Another site with mebroot, see:
http://wepawet.cs.ucsb.edu/view.php?hash=2a7df468e9fe340d9291580d597bd37e&t=1243032623&type=js

Came across this when searching for "advmaker_komap" (cookie-name) to understand what this is about.
They are discussing it on their forum, while the forum is still infected.

They got (newer) mebroot-version using Twitter to generate pseudo-random popup domain-names.