This is an extremely common trick, I'm surprised you've never seen it before. It's part of a scheme to install viruses on Windows computers. Here's how the scheme works:

Eastern European organized crime sets up Web sites. These sites exist only to download computer malware onto Windows PCs. There are, at any given time, tens of thousands of these sites in operation; as quickly as they get shut down, another one pops up.

The sites are then stuffed full of popular Google keywords. There are many ways to do this. They keep track of trending search terms; they scan sites like BoingBoing and Digg and Reddit looking for popular topics; they read blogs and news sites looking for events or subjects that people are talking about.

The virus sites are given extremely high Google page position. One of the most important factors in how high a site ranks on Google is how many other sites link to it. So the organized crime groups that do this give their virus sites high page rank by using automatic tools that scan through the Web looking for insecure, vulnerable WordPress, Joomla, Drupal, phpBB, and similar popular software. When they find a site running an insecure version of one of these bits of software, they automatically hack it and fill it with links to the virus site.

Now that the site that spreads the viruses is stuffed with popular keywords and has a high Google rank, they wait. Someone does a search on Google, like you did. The Google results show the virus sites. You click on the link in Google.

As soon as you arrive on the virus site, it pops up a phony alert that says something like "Your antivirus software has found suspicious activity" or "Your computer is infected with a virus and will now be scanned." You click OK. You see a phony image of what looks like oyur Windows antivirus scanner. It shows you a progress bar, then it says "Warning! You are infected with a virus. Click here to download and install antivirus software to remove the virus."

People who believe the phony warning download the software (which is, of course actually a virus) and become infected.

Security firm Panda Labs says that his scheme brings in about $15 million a *month* for Russian organized crime. Lots and lots of people fall for it.

The site you went to, 915.grandesaver24.com, is a computer virus downloader. It is currently offline.

I generally run into about fifteen or twenty of these sites a month.


Photo gallery, all about me, and more: www.xeromag.com/franklin.html