OK, here's the scoop.
What you saw was a poisoned banner ad. Poisoned banner ads are becoming common. The malware writers create a fake company, usually in Russia or Latvia, with a real business license and everything. They set up a Web site for this fake company, and they create banner ads for the fake company.
The banner ads contain special Flash code. The Flash code looks at the IP address of the computer that sees the banner ad. If it is the IP address of the place where they are buying the ad from, it goes to the fake site. If it is a different IP address, it goes to a site that tries to download computer viruses disguised as fake antivirus software.
So let's say they buy the ads from Excite.com. If the ads are viewed from any computer inside Exite's offices, they do not go to the malware sites. So the people at Excite check out the ad, and it works fine, no problem. They put the ad up. Then you see the ad (or more likely, you don't see the ad--tit redirects the instant it is shown) and it takes you to a place that tries to infect your computer.
You complain to Excite. They bring up the ad. It works fine, no malware--it just goes to what looks like an ordinary business site. So they say "You're nuts, there's nothing wrong!" and they keep showing the ad.
That's the way it works. These ads are the responsibility of the Russian malware gangs, who go to incredible lengths to make the ads appear legitimate to the folks they buy ad space from; they can even show business licenses and everything.
This particular malware is 100% harmless on Macs; the fake antivirus software only works on Windows. But it is annoying.
There is malware out there that can affect Macs, though; the same people who do these fake antivirus programs are also responsible for the Mac DNSchanger malware.
