Malwarebytes takes a look at the methods that the installers for Yontoo browser hijackers use to keep as much information about their program as possible away from security researchers. Vendors want to avoid to get classified as a PUP by behaving nice they will do just that when they detect they might be installing on a security researchers machine. The installer will prompt you if you agree to a change in default search engine in Internet Explorer will change to Yahoo Search! If you use Google search results they alter the results by adding links to the top results listed at the top of the results.”]
Source: https://blog.malwarebytes.com/puppum/2016/01/yontoo-pups-with-two-faces/