Fake AV: .ru Sites Used For Redirections

This report describes a search-redirect campaign where roughly a dozen hijacked sites (primarily targeting queries for purchasing software) redirect visitors to .ru redirector pages that test for JavaScript/cookie support and then deliver persistent Fake AV pages that push malicious executables (detected by 14/43 AV engines in one sample). The document lists affected hijacked domains, redirector domains and paths, and shows the Fake AV page characteristics and delivery flow.