According to recent research by Google, fake antivirus programmes now account for 15 percent of all the malware Google detects on the Web.  Using a combination of search engine optimization and malicious ads, antivirus distribution networks are thriving.

In an analysis of 240 million Web pages between January 2009 and February 2010, Google detected more than 11,000 domains involved in rogue antivirus operations.  More recent fake antivirus programme use complex JavaScript to mimic the look and feel of the Windows user interface.  In some cases, the fake antivirus programme detects even the operating system version running on the target machine and adjusts its interface to match.”

The researchers also discovered that fake antivirus programmes distributors rely heavily on online advertisements and domains with pages that contain trending keywords and often make use of search engine optimization techniques, such as exploiting search engine indexing algorithms, link farming, keyword stuffing and cloaking.