Follow The Safe Mac on Twitter to stay advised of the latest Mac security news!
Posted on December 6th, 2013 at 6:55 AM EST
Softonic has been a problem before, as outlined in a previous article, Boycott Softonic. In a nutshell, Softonic was wrapping some software downloaded from their site in an adware installer, which installed the ChatZum adware. Worse, the adware was installed regardless of whether you declined this “optional” software. Although Softonic quickly removed these installers when caught, they obviously did not learn the error of their ways. Adware-riddled installers are back!
I was alerted by someone who ended up redirected to installmac.com in Safari, who identified a copy of Gimp downloaded from Softonic as the culprit. Sure enough, downloading Gimp from Softonic results in the download of a file named “installgimp.dmg,” but that disk image does not contain the Gimp app as it would if downloaded directly from the official Gimp website. Instead, it contains a file generically named “Installer.”
This installer looks like an official Apple installer package (a .pkg file, which would open in Apple’s installer app), but it is actually an application that is using the icon for Apple’s .pkg file type. Upon opening it and proceeding with the installation, the screen shown at right will be encountered. The information shown here does not clearly state that additional software will be installed. This could be interpreted as deceptive, especially given the Gimp icon at the top and the description of Gimp at the bottom, making it seem like a simple license agreement.
On clicking the Next button, however, there is a drop-down window that asks whether you want to change your search page in Safari. If you decline, the adware will not be installed, unlike Softonic’s previous foray into adware installers. However, the default is to accept this optional installation.
Accepting and continuing results in the installation of a version of the Genieo adware. However, unlike the normal Genieo installer, there is nothing installed anywhere that the user can see. There’s no Genieo app, and no uninstaller. (However flawed the Genieo uninstaller may be, at least they provide one normally.) All the user can see is that their searches are briefly redirected to installmac.com, which then redirects to bing.com, and no reason for this can be found.
There are some serious ethical, and probably legal, issues at play here. Softonic has no ownership of the apps that they are wrapping in these installers, and do not have permission from the developers in question. In any case, though, I strongly recommend boycotting Softonic for the foreseeable future. Do not download from them, avoid their website and warn your friends!
Adware is becoming a serious problem for Mac users, and we all need to do our parts to fight this blight! Softonic is not the only download site resorting to such underhanded tricks. See Boycott CNET’s Download.com.
Because this InstallMac adware is powered by Genieo, removal instructions can be found in the Genieo removal section of my Adware Removal Guide. Keep in mind that not all the files described there will be present, so don’t be surprised or alarmed when you cannot find a file that the guide says to remove.