SecureMac, Inc.

Computer security news. Just for Macs.

Get the latest computer security news for Macs and be the first to be informed about critical updates. Industry news, security events and all you need right at your fingertips. Malware threats change daily, so keep up to date on the latest developments to help ensure your privacy and protection. You can never be too safe.

CNET’s Adware Installer Bundled with Popular Apps – Advisory

Posted on October 13, 2013

Update (10/29/13 12:15pm): SecureMac has prepared a guide to help users identify and remove the adware being distributed by CNET’s in place of popular Mac apps. The guide provides detailed information, including step-by-step instructions to determine if the adware is installed on your system, and the steps to remove it. View CNet Adware Identification and Removal Guide for Mac OS X.

Direct download links for a variety of popular Mac software products have been replaced on CNET’s with installers for browser toolbars, commonly used by adware to track user browsing habits. A wide variety of Mac apps have had their download links replaced with the adware installer, including popular Mac antivirus software. It At this time it is not clear if CNET had provided any prior notification to the creators of affected apps, but it appears that many of the companies were unaware that their download links had been switched to one that installed toolbars and changed web browser settings.

When a user clicks the “Download Now” button, they receive the adware installer rather than the app they expected to download. The adware installer changes the user’s homepage and default search engine to Yahoo, as well as installing various browser toolbars and add-ons, with names like “Slick Savings” and “Ebay Shopping Assistant.” The browser extensions appear to come from a company called Spigot, Inc.


Apps affected by the adware downloader will be listed as “CNET Installer Enabled” on the website, which provides this further information:

“The CNET Installer is a tiny ad-supported stub installer or “download manager” that helps securely deliver your downloads from’s servers. We also include offers for carefully screened software that complies with Software Policies as part of our Installer process.”


While the the adware installer includes a way for the user to opt-out, the toolbar is set to be installed by default. Additionally, the installation is presented in such a way that it could confuse users who think they are installing the app they attempted to download. After the adware has been installed and browser settings changed, the installer retrieves the original software that the user intended to download, and presents it to the user.


This is a developing story, and we will update this page as more information becomes available.


Join our mailing list for the latest security news and deals