The massive attack managed to inject the name of several rogue domains into hundreds of thousands of websites.

The link led to a page that carried out a fake virus scan and then recommended fake security software to clean up what it supposedly found.

By late on 3 April, Google was reporting that more than four million webpages were showing links to the domains involved in the attack.

The way Google counts webpages makes it hard to estimate exactly how many websites were hit but security firms said the number ran into the "hundreds of thousands".