In theory you could detect any AV software with a direct browser
protection component. All you would need to do is run a segment of
code known to trigger the AV's protection system and detect the code's
failure to run. The difficulty is maintaining the individual tests and
making sure they don't collide. However, they don't need a 100%
success rate to trap most casual visitors.

David Genord II

On Mon, May 9, 2011 at 8:39 AM, Al Puzzuoli <[log in to unmask]> wrote:
> I was looking up something on Google, clicked on a seemingly innocuous webpage, and got the attached warning. This is clearly fake, but the interesting thing is that I am indeed running the Eset product. I wonder if this was just coincidental, or if there was code on this page that was able to query my system and determine which AV was running? If the latter is true, then I'm more than a little concerned,
> Al
>
>