OSX/Installcore on Macupdate

[Gadsby]

Hi,

I downloaded an app named Lazesoft Mac Data Recovery on the Macupdate site (BTW I might have clicked on "install").

When I opened the DMG, VirusBarred warned of a malware detected (OS X/InstallCore) on the "pulpitarian" file (Macupdateinstaller>Macupdate Installer.app>Contents>MacOs>pulpitarian)

I posted a comment on the app page on Macupdate and it was deleted.

I also sent a message to the developer who replied that they "had not added the Apple's Code Signing on their program and, maybe, this (was) the reason why VirusBarrier warned of a malware".

 

Is MacUpdate really doing this?

[treed]

Yes, unfortunately, MacUpdate has fallen to the plague that has affected many other download aggregation sites. They are now wrapping other people's software in adware installers, and seem to see nothing wrong with doing so. MacUpdate is no longer to be trusted, and should not be used.

 

For more information, see:

 

https://blog.malwarebytes.org/news/2015/11/has-macupdate-fallen-to-the-adware-plague/

 

As for the adware that may have been installed, Malwarebytes Anti-Malware for Mac should remove it for you if it managed to get past VirusBarrier.

 

https://malwarebytes.org/antimalware/mac

[Gadsby]

Well, thanks for the reply ; we're sort of left on our own in this cruel world...

When I use Macupdate, I usually click on the developers' link and download the app from their site. I hope this is not "compromised".

[treed]

As long as you can verify that you're actually on the correct site, and not still on a MacUpdate page or some other site not affiliated with the real developer of the app, you should be fine.