I am actually wondering if this is a single effort or some sort of combination?

From what I can see, although Reunion.com are a total shower of scumbags, I suspect that they are incompetent toe-rags to boot?

I think that their site has been owned and is probably serving drive-by infections as well. That would explain the fake security product? unless, of course, the thing is really online............... err, well the message probably is, but was there any download or any real scan?

I don't believe that Reunion would knowingly let someone try to spam fake AVs from their very own spamsite. With "40 million users"?................ seems like too good a power base to squander?