When using a search engine to search for software download links, be sure to go directly to the developer’s site rather than clicking on an advertisement as you may not get what you are expecting. Such is the case with an advertisement currently being displayed in Bing for the search phrase “chrome download”, which instead of bringing you to the official Chrome Download page, brings you to a site pushing an adware & PUP installer.
When using Bing to search for “chrome download”, I noticed an ad that looks like a legitimate advertisement from Google pushing the Chrome browser. It had Google’s url, www.google.com, and contained sublinks that looked official and were similar to other ads for Chrome that I have seen in the past.
Chrome Download Search Advertisement
When clicking on the ad, though, instead of being brought to Google Chrome’s download page, I was brought to a site called www.googlechrome2018.net. This page shows a fake www.google.co.uk page with an overlay prompting you to download Google Chrome.
Chrome PUP/Adware Bundle Download Site
If you click on the Download Now button, it will download a file called ChromeSetup.exe, which is detected on VirusTotal as an InstallCore bundle..
Download ChromeSetup.exe Adware/PUP Bundle
If you are already using Chrome, you will instead be shown a page that prompts you to download and install the unwanted Chrome Search Manager extension.
Install Search Manager Extension Prompt
If you run the downloaded ChromeSetup.exe, you will be shown the installation screen of an adware/PUP bundle instead of a normal Chrome setup.
If you click next you will be prompted to install Chrome extensions, antimalware PUPs, and other programs.
Ultimately, after being prompted to install various offers, the bundle will download the Portuguese installer for Chrome and install it on the computer.
Portuguese Chrome Installer
As you can see, a simple search for a popular download can lead to a user installing multiple unwanted programs that could have a serious impact on the performance and safety of their computer. This is why it is always important to download software from either the developer directly or through a very trusted source.
As for the ad, I have reported it to Bing, but it may take a few days to be taken down.
April 8, 2018