Until Jan 6, 2006, Corypaints(dot)com was a kids site.  The whois on Jan 1, 2006 shows it was a pending delete.  It was taken over by a spyware gang that deals with porn.

Let’s take a look at the front page:

Never mind the kid’s content.  It’s being pulled from old material.

Let’s do a search in google for “cory paints”, and these are the types of results you’ll get:

If you type the same search in, but instead with “site:corypaints.com”, you get links to corypaint(dot)com directories with really sick links (not for the faint at heart):

Private familysex video download
Free dad & daughter f—-
schoolgirl rapecom
Mother and teen son porn
Real rape scenes and stories

Clicking on these links results in an attempted WMF exploit to infect you with spyware.

The lengths these slimeballs will go to to infest a machine just boggle the mind. 

Alex Eckelberry
(Thanks Sunbelt spyware researcher Patrick Jordan)