Security Response

With only a couple of days to go before the start of the World Cup in South Africa, the people behind the black hat search engine poisoning attacks have been very busy trying to up their game. The goal, as ever, is to get their bogus software out to as many victims as possible, and the excitement around the World Cup presents a golden opportunity.

We have become aware of many World Cup 2010-related search terms that are currently being used to direct users to the familiar FakeAV scanner pages.

The scanner pages are the usual suspects that have been designed to look like the user interfaces of Windows XP, Vista and Windows 7. We have seen them time and time again—after the fake scan is over, they offer the user a file named packupdate[RANDOM NUMBER]_195.exe to...