Antivirus 200x spyware

[Andrew]

My mother was browsing the net, and searched in google and a very innocent looking link was listed (niche/not popular type keywords, only 6 pages of links in total). Wasn't a paid ad link.

She clicked on it (it genuinely looked ok in google search) and then a popup appeared about antivirus 2009 asking if they wanted to be protected from viruses (yes/cancel). Does this mean website hacked, or these spambots register lots of websites (even niche ones) to spread this crap?

I clicked on the x on the ok/cancel window, and I think firefox went to antivirus 2009 website that had nothing to do with what was searched.

Luckily on puppy linux, so not much to fear, doesn't appear firefox was highjacked.

I suppose if someone was on windows and clicked "ok" for whatever reason, their computer would be infected.

This is one of the worst spyware I've seen in years. I've seen others have been infected with it, and you basically need to format to get rid of it (disables antivirus, does not allow you to browse web to search for antivirus solutions etc).

Anyone else have with problems with it?

Maybe I already asked this somewheres else, but it seems to be quite rampant.

[gryphon]

I've noticed it on a few computers on the network at my work. Symantec picked it up and deleted it (I know, Symantec and yes it was disabled without a reinstall of the clients). Think that a Windows update of late December also disabled the darned thing. Didn't cause much havoc for us.

[Andrew]

Yes, I think that MS released an update last month for its rootkit in windows update. I remember reading on slashdot that people were having problems as well.