Details Of A "new" Fake AV Page

The report describes an active Fake AV campaign using SEO-poisoned Google search results to serve unobfuscated malicious landing pages that trigger executable downloads (via an IFRAME and a google() JavaScript function). Despite low technical sophistication, the campaign is effective against home users because many antivirus engines fail to detect the payload (only 5/42 detections reported), and the malware is trivially downloadable (e.g., via wget).