A Technibble subscriber and a fellow computer technician, Patrick Croteau of www.logic1.com sent us an interesting tip today. One of his clients was infected with a typical rogue-antivirus which he went out and cleaned up. However, they managed to reinfect themselves later that day and upon checking their internet history he found this:


When you search for “dancing with the stars 2010 lineup” on Google, which is a fairly innocent query and probably searched for a lot; the top result is a hacked site with malware hosted on it.

Dancing with the Stars Malware

When you visit it, you’ll see your typical “You have 100 viruses” scareware.

Dancing with the stars Malware

Once installed, the malware product appears to be the rogue antivirus “CleanUp Antivirus”.

Dancing with the stars Malware - Cleanup Antivirus

As Patrick said “I’ll bet its making them a fortune”. Such an innocent query with a malicious site as the top result. If you ever do encounter this infection, BleepingComputer.com have removal instructions for Cleanup Antivirus.