Patrick Jordan found this one today:
The rogue Alpha AntiVirus page used to hijack a browser copies the Firefox warning screen:
Looks like the Firefox warning page (in Internet Explorer), but with a difference. Clicking leads to this:
Which goes to the payment screen:
The AlphaAV lineage:
XP Antivirus (2007)
AntiVirus 2009 (2008)
AntiVirus 360 (end of 2008)
Total Security (January 2009)
Personal AntiVirus (January 2009)
Total Security (2009)
What makes research on these rogues very challenging is the fact that they swap the download web sites about every six hours.
Thanks to Patrick Jordan
Tom Kelchner