Ad Injectors courtesy of and VideoFileDownload

Posted by on May 29, 2012 in Ad Injectors, Malvertising

A binary signed by “TUGUU SL” is targeting the Browser vertical on popular search engines.

Essentially, they are buying the top ad spots for queries the likes of “Google Chrome” in a bid to lure unsuspecting users to install what they have in store. This is a great example of using the online advertising ecosystem to get your binary out with lightning fast speed and fairly cheaply (consider the cost of the alternative: rising to the top of the organic links for queries of this nature).

Once their binary is up and running on your machine, it will install a treasure trove of bad add ons (baddons?) into your browser, including an ad injector, all under the pretense that you’re installing the browser you were looking for; in this case it’s Google Chrome:

Baddons installed include the FunMoods Toolbar, Wajam and VideoFileDownload. Google Chrome was not installed (an error was always thrown when the time came):

Much like the last ad injector we looked at, the wajam ad injector is injecting Microsoft ads into the Google DOM but staying far away from

Interstingly enough, unlike our last ad injector, we don’t see the referrer header in the click through to Microsoft’s ads:

The VideoFileDownload addon isn’t touching search for its injections, instead it’s nailing display and “enhancing” sites the likes of Wikipedia.

Before VideoFileDownload does it’s thing:

And after (bottom left hand corner):


« »


  1. Chanel
    August 21, 2012

    Please help! I looked at this article and decided to delete VideoFileDownload from my list of programs – and now when I click on the Add or Remove Programs in the Control Panel (Windows XP Home) nothing happens! It won’t open up!! Could the deletion really have made that happen, I didnt do anything else and won’t do anything further til I hear from you. Thanks, so scary!!

  2. wesleyb
    August 22, 2012

    If you just deleted the entire folder from your “Program Files” directory then you may have a problem. Perhaps you could try restoring the folder from your Recycle Bin and then removing the program from Add/Remove Programs in your control panel.