Sigh… SourceForge continues it’s descent. Be careful if use FileZilla when you upgrade! People are reporting that there are still safe download links on the project website.
There is indeed malware bundled with the SourceForge FileZilla installer, AVG is doing a pretty good job of warning you. You can prevent the malware from being installed in the installer, but you have to pay very close attention, and many users have reported that the malware is being installed anyway.