In case you have to deal with the aftermath of someone that agrees to
download and run a copy of the scam anti-virus application that forces
it's way in front of the user (usually as a result of clicking on an
infected google search result) you might want to look at this:
http://anubis.iseclab.org/?action=result&task_id=1f384edd94763bb74e55c...c41bcd9
The domains that are generating the fake http scanner page and serving
up the malware are:
gotomyprotectedzone.com
limestee.net
windows-protectonline.net
onlinesecurescan.com
(and no doubt others)
An example file that I grabbed (setup_build7_195.exe) naturally turns up
no hits at virustotal (that's the file that was sandboxed above at
anubis).
Computer Security