Quote:
Originally Posted by Quickdraw
triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--
Code:
language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->
which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
which contains the code(win32.exe) explained above
|
Incase anyone misses that