2 URLs that appeared on yahoo groups today

[tom_]

patipezy.freehostking.com

dulofady.hostevo.com

These were in posts made by an account we know to be compromised.

[MysteryFCM]

Both load a script from;

Code: [Select]

http://3ttman.com/ok2.htm
Which loads;

Code: [Select]

http://lipesr.com/update/?eb70c8bc3e184ffe5a98905e484546d9
Which I'm working on decoding

[MysteryFCM]

JSUnpack, Wepawet and Malzilla have all sadly failed to decode it manual decoding has also failed.

[CM_MWR]

Odd one....mystery check the priv section