Hi Pondus and Alan Baxter,

You are both right, and thanks for confirming this. The roque AV is still at that address, just scanned using jsunpack and it says: virginantivirus dot com/ suspicious and the info on the Google search page about a domain parking page is irrelevant and might be deliberately confusing to invite clicks. So good it is being blocked by the avast webshield,

This information can be found at the bottom of the virustotal analysis page:
http://www.f-secure.com/v-descs/suspicious_w32_malware!gemini.shtml and http://www.symantec.com/security_response/writeup.jsp?docid=2010-021223-0550-99
So an overall 0 /43 (0.0%) result but something suspicious definitely detected there,

polonus