The usual Set Search Settings extension for Firefox, which I have observed multiple times with InstallCore, was also incorrectly installed, as always.Īlthough no browser extensions were successfully installed, both Chrome and Firefox had their preferences modified. Interestingly, the typical InstallCore Safari extension was for some reason not installed.

I chose to accept all of these, of course.Īs a result, both MacKeeper and ZipCloud were installed and opened automatically. Next was acceptance of the installation of MacKeeper, though the text was relatively small and uniform, and the familiar MacKeeper logo was nowhere to be seen.įinally, I had to accept the installation of ZipCloud. I was greeted with the familiar InstallCore installer interface, except that the first page of the installer read “Welcome to Safari.”Ĭontinuing with the installation resulted in being asked to accept the “Search-Assist” extension for Safari, with a big Yahoo! logo at the top of the window. The installer on that disk image did not look like an Apple installer at all, but nonetheless, I opened it anyway. (I was using OS X 10.9.5, so this actually was true.)Ĭlicking the Update Now button downloaded a disk image file named “Apple Safari Setup.dmg”. When I attempted to view one of the supposed streams, it redirected me to a page that claimed that Safari was outdated. This new installer was obtained while visiting one of the “First Row Sports” scam sports streaming sites. Last week, we discovered a new version of the InstallCore installer that displays an unpleasant new trick: it pretends to be a Safari update!

Malwarebytes for mac 10.9