Rogue ads target EU users, expose them to Win32/Toolbar.SearchSuite through the KingTranslate PUA

By Dancho Danchev

Who would need a virtually unknown, but supposedly free, desktop based application in order to translate texts between multiple languages? Tens of thousands of socially engineered European ads, who continue getting exposed to the rogue ads served through Yieldmanager’s network, are promoting more Potentially Unwanted Applications (PUAs) courtesy of Bandoo Media Inc and their subsidiary Koyote-Lab Inc.

More details:

Sample screenshots of the rogue KingTranslate PUA landing/download page:



Rogue URL: –

Detection rate for the PUA: KingTranslateSetup-r133-n-bc.exe – MD5: 51d98879782d176ababcd8d47050f89f – detected by 3 out of 47 antivirus scanners as Adware.Searcher.2497; Win32/Toolbar.SearchSuite.

Just like in iLivid and fTalk’s cases, their Privacy Policy reveals their true intentions:

When you visit the Website, KingTranslate may automatically receive and record certain non-personally identifiable information on its server logs from your browser, including your IP address, browser type, internet service provider (ISP), cookie information, and the webpage that you visit. KingTranslate collects non-personally identifiable information for general purposes, including but not limited to analyzing trends, administering the site, tracking user movements, conducting research, and providing anonymous reporting to internal and external clients. KingTranslate will not link any Personal Information, including e-mail addresses, with the aggregate data of its users. Please be aware that some non-personally identifiable information such as Uniform Resource Locators (“URL’s) or Internet Protocol (“IP”) addresses could become Personal Information when combined by third parties with the ISP’s records. KingTranslate does NOT do this with your information.

We advise users to avoid using this application and to consider other free, legitimate translation services such as, for instance, Google Translate or Bing’s Translator.

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on Twitter.

Join the Conversation

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s