REMOVE ZIPCLOUD POPUP INSTALL
REMOVE ZIPCLOUD POPUP FULL
REMOVE ZIPCLOUD POPUP CODE

In reality, though, there’s no evidence that Yahoo is involved, and I strongly doubt that they would be. It’s also worth noting that this makes it look an awful lot like Yahoo is responsible for this adware. There’s no sign of any Chrome extension, and as with previous versions of this adware, the Firefox extension is a flop.

In addition, although the agreement claims in one spot to install the extension in Safari, Chrome and Firefox, only Safari is actually affected. If you click the Continue button, the second step of the process requires you to accept changing your homepage to Yahoo and the installation of a “Search-Assist extension.” Of course, the actual extension is called nothing of the sort. This window strongly suggests that it will be installing Safari, which it absolutely does not do. On running the installer, which is actually an application rather than a file made to be opened with Apple’s own Installer app, a window will appear imitating the Apple installer. The resulting installer tries to look like a Safari installer, but not too hard… it’s a pretty poor imitation, as the installer icon doesn’t look anything like any installer Apple has ever used. The page itself was down before I could see it, but he had the presence of mind to send me the installer that was downloaded from this site. Then, yesterday, someone tipped me off to being redirected to a web page that was reporting that Safari was out-of-date on his computer. This latest Softonic installer, dropping the jbsearch Safari extension, also improperly installed this Set Search Settings extension in Firefox in exactly the same way. This extension, however, was a major fail, as it was installed into a “staged” folder in Firefox’s extensions folder, which meant it never became active and was deleted by Firefox next time it opened. In addition, earlier variants of this adware in its Searchme/searchtab form tended to be accompanied by a Firefox extension called Set Search Settings.

Examining the code for this extension, it turns out to be the same as the latest Searchme and searchtab extensions. Then, last weekend, when checking the latest adware-riddled Softonic installer (see Continue to boycott Softonic), I found that it currently installs a Safari extension named jbsearch. For my friend in France, it installed searchtab. It turns out that this installer behaved differently based on location. However, this resulted in some confusion and miscommunication between us, and it finally turned out that he was getting an extension called “searchtab,” with the same code as my “Searchme” extension. The adware it installed for me looked like the familiar Searchme component of Spigot, albeit with very different code internally than the older Spigot extension. And some of the strategies it’s using stink just as badly!īack in February, a colleague from a security company brought my attention to a fake Adobe Flash Player installer that was installing adware.

(One of these took the same name as a Spigot extension, “Searchme”, leaving questions about whether InstallCore might be related to Spigot in some way or whether this is purely coincidence.) Recently, however, new variants of InstallCore have been appearing like poop on a lawn full of geese. InstallCore is adware that began with a couple simple browser extensions. April 8th, 2015 at 11:42 AM EDT, modified

REMOVE ZIPCLOUD POPUP INSTALL

REMOVE ZIPCLOUD POPUP CODE

REMOVE ZIPCLOUD POPUP FULL

Remove zipcloud popup