![]() ![]() In addition, earlier variants of this adware in its Searchme/searchtab form tended to be accompanied by a Firefox extension called Set Search Settings. Examining the code for this extension, it turns out to be the same as the latest Searchme and searchtab extensions. Then, last weekend, when checking the latest adware-riddled Softonic installer (see Continue to boycott Softonic), I found that it currently installs a Safari extension named jbsearch. For my friend in France, it installed searchtab. It turns out that this installer behaved differently based on location. However, this resulted in some confusion and miscommunication between us, and it finally turned out that he was getting an extension called “searchtab,” with the same code as my “Searchme” extension. The adware it installed for me looked like the familiar Searchme component of Spigot, albeit with very different code internally than the older Spigot extension. And some of the strategies it’s using stink just as badly!īack in February, a colleague from a security company brought my attention to a fake Adobe Flash Player installer that was installing adware. (One of these took the same name as a Spigot extension, “Searchme”, leaving questions about whether InstallCore might be related to Spigot in some way or whether this is purely coincidence.) Recently, however, new variants of InstallCore have been appearing like poop on a lawn full of geese. InstallCore is adware that began with a couple simple browser extensions. ![]() April 8th, 2015 at 11:42 AM EDT, modified ![]()
0 Comments
Leave a Reply. |