9. A system for detecting scareware, comprising: a processor; and a computer storage medium coupled to the processor, the computer storage medium storing instructions that cause the processor to execute modules comprising: a web crawler configured to select webpages; a feature extractor configured to extract a first feature from a first selected webpage; a feature classifier configured to classify the first extracted feature as indicative of either a scareware webpage or a non-scareware webpage and store reference feature data identifying the first feature and a classification, the feature classifier further configured to determine a likelihood that a landing page and one or more redirection pages is a scareware page based on the number of times the considered feature occurs in known scareware pages, the number of times the considered feature does not occur in known scareware pages, the number of times the considered feature occurs in known non-scareware pages, and the number of times the considered feature does not occur in known non-scareware pages; and a feature matcher configured to compare a second feature extracted from a second selected webpage to the first extracted feature to determine whether the second feature is indicative of a scareware webpage or a non-scareware webpage, the feature matcher further configured to, in response to determining at least one of the first webpage and the second webpage is a scareware page, store reference feature data for the scareware page locally.
11. The system of claim 9 , wherein the first and second features are of a type selected from a group comprising an image, text, and a pop-up.