This page was spammed on August 17 and 18, replacing the MSNBC and CNN landing pages with something more safely anonymous. (When major news organizations start warning people about your scam, you know you're doing it wrong.)

It looks a lot like the old Watch Free Movie, but diffs between this page and both the Watch Free Movie page of yore and the MSNBC page of yesterday show that aside from the content, this is much more closely related to yesterday's page.

The payload has changed from adobe_flash.exe to install.exe. (When Adobe warns the public not to download upgrades from anyone but them, you know you're doing it wrong.)

It was replaced on August 18 by a slightly modified successor, WFM IIa.

The full text is here.

Our antivirus popup is still in place, but since the server hosting asvoo.org and i56web.org has gone belly-up, we are now pointing to http://79.135.167.18/antivir/ (analysis here). This content has changed from the old content, but not by much: the account number on the StatCounter plugin has been changed. The exploit is the same.