Imagine getting this scary message while surfing a site (in this case, a porn site):
(upssex(dot)com/galls/amateur.html)
Clicking Ok takes you to a page which describes the so-called “virus” that you’re infected with:
(watchforall(dot)com/cgi-bin/search/go.fcgi)
In this case, the page directs you to a TopTenReviews page (yesterday, it referred to an antispyware application–so I guess it depends on what the state of the affiliate plans are out there…).
Clicking “Cancel” brings up various porn sites.
tonsporn(dot) com//galls/amateur.html also brings up the fake message.
Alex Eckelberry
(Thanks to Sunbelt researcher Patrick Jordan for this)