Well haven't gotten to look further yet.
Last night I got hit with the Security Shield malware going around when I went to a website with LIRR maps.
I wound up having to go through two of the three programs mentioned on the site link below to fix it, I am not sure I wish to run the third, the first fix I tried was a program that found the malware but required full purchase to fix. The option in the link is free.
And be careful around some sites with LIRR maps.
http://www.bleepingcomputer.com/virus-removal/remove-security-shield
I use Vipre from Sunbelt Software. In general it works well, but also got stumped with one of these download fake AV products.
The problem is these look like legit programs to the installed AV program because they are in many cases polymorphic, so they can sneak in. It's done in two parts, and they install using the javascripts on websites such as Google, ImageShack, and many others.
Part one is a dropper that gets downloaded. They are picked up somewhere, usually as a Trojan Horse, and get dumped into your system during a normal browsing session when you contact the website. They will then contact the download site, and initiate a planted javascript, on the website you've contacted, and it'll then download the fake AV from its source.
The problem is these fake antivirus companies target the top-level searches on search engines such as Google. These are usually primed by bots to ensure that they are the most exposed and receive the most hits. Then malware bots do the same thing, and place their javascript connectors on the links to these websites.
This has become quite an issue, and has made searching on Google and other search engines risky. In general when searching for something, rarely go to the top-level search results.
These downloaders rely on the effectiveness of AJAX. The way the interactive websites use background activity to update the screens and allow for multi-media and other things to happen while page information is being downloaded. Before the devlopment of AJAX, you had to wait for each web screen to download. With AJAX you can use such programs as Google Maps to browse for a street address while the map information is being updated.
Since these programs look like a utility, and polymorph, the installed A/V can't see it. However, an external scan will find it and kill it. I highly recommend Malwarebytes as one of the tools to remove the fake antivirus.
You need to put the machine in Safe Mode with networking to get the download for the a/v product and to scan the system. So far these fake a/v programs don't run in Safe-Mode yet.
The problem is that with these bugs, they put themselves everywhere including the System Restore. In order to remove them completely from a machine, it is necessary to disable System Restore before scanning the system. This will put the malware out in the open so that the scanner can find the files.
References:
http://www.fakealerts.com/
http://news.cnet.com/8301-1009_3-10256449-83.html?tag=mncol;7n
http://www.eweek.com/c/a/Security/Malware-Infects-More-than-12-Million-Web-Sites-Dasient-678316/