So now I’m running my search tools in a Sandbox to isolate it, and just hit my first hijack / trojan attempt. It was a web site that formerly was a religious station.
It showed a picture of a woman sitting on a toilet naked…. and when you moused over the image, it announced pretty convincingly that your version of Adobe Flash needs to be updated (uh-huh) and you sthould start the download…. Attempting to back out of the page or navigate away from the page initiates a download of one of those fake antivirus scanners.
None of that did anything, but not really because of the sandbox. But just in case, with one click anything it did goes bye-bye. I also notice the sandbox caught RealPlayer trying to add itself back into my “Scheduled tasks” lists in Windows (without asking). That alone is worth the price of running sandboxed.
Interestingly, upon returning to the web site a second time, it didn’t attempt a hijack, although the page is very messed up.
It looks like the station is using a “free” menu popup utility that loads the menu script from the site that gave it away “free”. That’s the only thing that looks like an entry point. Trying to look at the script in a non-browser gets a 403 error.