Ash Nallawalla's blog

Beware of MS Antispyware 2009

A few people are getting sucked into installing MS Antispyware 2009. They go to some site and get a popup offering to install this program. Think about it. Normal websites don’t offer antispyware programs through a popup.

What’s wrong with this program? It contains a virus and the victim actually consents to install it. Sean-Paul Correll has provided an excellent video and a write-up at the PandaLabs Blog about this menace.

What is different about this exploit is the use of hundreds of SEO pages targeting major brands such as Ford and Nissan – search for some specific model or a car part and you will find links (mostly in Poland – .pl) that include dangerous infections as reported by Norton Internet Security.


Targeted Blackhat SEO Attack against Ford Motor Co. from Panda Security on Vimeo.

The following Google search “site:.pl nissan” has a few normal results at the top of the page, but then you get dozens of weird subdomains such as (don’t go there):

  • 347.aw.lubomogo.az.pl
  • 666.oo.mrfehz.wroclaw.pl
  • 872.zw.owncav.warszawa.pl

All of them are marked noarchive, hence you won’t see a Cached link. Most of these are doorway pages to p0rn sites but some also include infectious content.

Ash Nallawalla

Search strategist experienced in large, complex websites. Ash's Google+ profile

Related Posts

President Obama’s whitehouse.gov pages archived

Ash Nallawalla

22 January 2017

Other, SEO

Feel free to share...After Mr Donald Trump became the president at noon today (USA EST), many reported that the whitehouse.gov website removed references to Climate Change and LGBT. That isn’t entirely accurate. The website up to that point has been archived and can be found at https://obamawhitehouse.archives.gov/. The LGBT URL was https://www.whitehouse.gov/lgbt but it redirects […]

Read More

Coding Australian 13 and 1300 “tel:” numbers – 404 errors

Feel free to share...Australia has six- and ten-digit local numbers that begin with 13 and 1300 respectively. The 13 xx xx numbers connect you to a local number in your city so it is a local call. The 1300 xxx xxx number is similar but is usually a single destination for the price of a […]

Read More

Older Posts