And one of the download button ads that I just checked (EasyPDFCombine) is "getting trough" 3 separate Google "reviews" if I understand correctly how this sche

And one of the download button ads that I just checked (EasyPDFCombine) is "getting trough" 3 separate Google "reviews" if I understand correctly how this scheme works: 1. The misleading download button Google ad. 2. After clicking the ad they ask the user to install their extension from the Google Chrome Web Store [1]. 3. After installation, the extension replaces new tab page with their own which includes a "custom" search engine "Enhanced by Google" [2]. 4. PROFIT!!!? They make money when the user clicks a Google ad in their search results on that new tab page. I'm not sure how it's worth it for Google because with the extension installed they are sharing part of their search results revenue with the owner of the extension compared to the users directly using the Google search when there is no extension to "hijack" it. From the users perspective: Sure, it's not a ransomware level malware but it's still a PUP and the users are annoyed that they were "tricked" into installing it and their new tab page has been changed, as it can be seen in almost all of the reviews for their chrome extension, and almost all the first page google result for "EasyPDFCombine" is about how to remove this "virus". It's the same decade old trick from the same company: Mindspark aka MyWebSearch aka Ask Toolbar and many more names. [1] https://chrome.google.com/webstore/detail/easypdfcombine/kpocjpoifmommoiiiamepombpeoaehfh?hl=en https://chrome.google.com/webstore/detail/easypdfcombine/kpo... [2] http://hp.myway.com/portal/ttab02/index.html http://hp.myway.com/portal/ttab02/index.html