Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #120526 > unrolled thread

CodecSetup-Mac - Trojan?

Back to article view | Back to comp.sys.mac.system

Contents

  CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 16:22 -0800
    Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-13 19:34 -0500
    Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 14:13 +1300
    Re: CodecSetup-Mac - Trojan? David Ritz <dritz@mindspring.com> - 2019-01-13 21:12 -0600
    Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 03:36 +0000
      Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 20:22 -0800
        Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 19:17 +1300
        Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-14 06:53 -0500
    Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-13 23:05 -0700
    Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 12:41 -0500
      Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-14 11:48 -0700
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:22 -0500
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:25 -0500
      Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 22:33 +0000
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 18:18 -0500
          Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-15 05:23 +0000
            Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:32 -0800
              Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:35 -0500
                Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-15 18:40 -0800
                  Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-16 08:24 +0000
                    Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 17:53 -0800
                      Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-17 16:04 +1300
                        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 19:49 -0800
                          Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-16 23:16 -0800
                            Re: CodecSetup-Mac - Trojan? Jolly Roger <jollyroger@pobox.com> - 2019-01-17 18:53 +0000
                              Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-17 10:55 -0800
                      Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 01:13 +0000
                        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-17 18:42 -0800
                          Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 09:12 +0000
            Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:33 -0500
        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:31 -0800

Page 2 of 2 — ← Prev page 1 [2]

#120688

On 2019-01-16 08:24:24 +0000, David B. said:

> On 16/01/2019 02:40, gtr wrote:
>> On 2019-01-16 00:35:07 +0000, Alan Browne said:
>> 
>>> On 2019-01-15 00:32, gtr wrote:
>>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>> 
>>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne 
>>>>> <bitbucket@blackhole.com> wrote:
>>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne 
>>>>>>> <bitbucket@blackhole.com> wrote:
>>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>>>> 
>>>>>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>>>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>>>>>> 
>>>>>>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>>>>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>>>>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>>>>>>> to know what history there is of this.
>>>>>>>>> 
>>>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>>>>>>> joking!
>>>>>>> 
>>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>> 
>>>>>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>>>>>> wasting time on and is almost certainly simply a malware package or a
>>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>> 
>>>>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>>>>> segment for, er, legal reasons, we convert it using the command above.
>>>>>>>> (.fmt would be .dav of course...)
>>>>>>> 
>>>>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>>>>> will play it.
>>>>> 
>>>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
>>>>> 
>>>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>>>> had a codec installed (I don't know), but it definitely played the dav.
>>>>> 
>>>>> But the point is, delete the file, delete the malware script, and tell
>>>>> the friend to stop sending malware.
>>>> 
>>>> I did all that, but I did snatch them back out of the trash as people 
>>>> have asked me to sic ffmpeg and such at it.  I attempted that but the 
>>>> location (./ffmpeg) wasn't appropriate.
>>> 
>>> Just path to the files from where ffmpeg is located in the command line 
>>> or put a copy of ffmpeg into the same folder (these are quick lazy 
>>> fixes if you don't want to edit paths).
>> 
>> I know, but having to chase it down itself became the point where 
>> laziness interceded.  In any case I've kinda blown the whole thing off. 
>> I was mostly curious if others knew about this particular malevolence 
>> or not.  Seemingly: not.
> 
> Have you scanned with Malwarebytes to make sure nothing untoward is 
> remaining?   (It's FREE)
> 
> FYI  https://www.malwarebytes.com/
> 
> I trust all is well!

All is well according to MWB.  I never actually ran the "codec 
installer", I just poked around and looked inside and googled it a bit.

By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and not 
for free, but for $40 PER YEAR.  It has real-time checking and (I 
assume) a lot of other stuff I don't want or need.

On the other hand, I assume there have been additional malware scams 
that have occured since 9/22/17 that are not being filtered in the free 
version.

What think ye of that?

[toc] | [prev] | [next] | [standalone]

#120689

On 2019-01-17 01:53:48 +0000, gtr said:
> On 2019-01-16 08:24:24 +0000, David B. said:
>> 
>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>> remaining?   (It's FREE)
>> 
>> FYI  https://www.malwarebytes.com/
>> 
>> I trust all is well!
> 
> All is well according to MWB.  I never actually ran the "codec 
> installer", I just poked around and looked inside and googled it a bit.
> 
> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and not 
> for free, but for $40 PER YEAR.  It has real-time checking and (I 
> assume) a lot of other stuff I don't want or need.
<snip>

Yes and no.

You can download Malwarebytes from their website and install it. For 
the first 14 days you get to trail all the "Premium" features 
(background real-time checking / blocking, scheduled scans, etc.). 
After the 14 day trial period expires, the "Premium" features get 
locked, but you can still continue use the app as a free malware 
checker and remover, including updating the definitions, but you have 
to manually run it instead of it running in the background.

Check the comparison table at the bottom of this web page:
<https://www.malwarebytes.com/mac/>

[toc] | [prev] | [next] | [standalone]

#120690

On 2019-01-17 03:04:03 +0000, Your Name said:

> On 2019-01-17 01:53:48 +0000, gtr said:
>> On 2019-01-16 08:24:24 +0000, David B. said:
>>> 
>>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>>> remaining?   (It's FREE)
>>> 
>>> FYI  https://www.malwarebytes.com/
>>> 
>>> I trust all is well!
>> 
>> All is well according to MWB.  I never actually ran the "codec 
>> installer", I just poked around and looked inside and googled it a bit.
>> 
>> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and not 
>> for free, but for $40 PER YEAR.  It has real-time checking and (I 
>> assume) a lot of other stuff I don't want or need.
> <snip>
> 
> Yes and no.
> 
> You can download Malwarebytes from their website and install it. For 
> the first 14 days you get to trail all the "Premium" features 
> (background real-time checking / blocking, scheduled scans, etc.). 
> After the 14 day trial period expires, the "Premium" features get 
> locked, but you can still continue use the app as a free malware 
> checker and remover, including updating the definitions, but you have 
> to manually run it instead of it running in the background.
> 
> Check the comparison table at the bottom of this web page:
> <https://www.malwarebytes.com/mac/>

So your MalwareBytles FREE edition gets it's identified malware updated 
when you run the trial?  I don't need/want all the other stuff.  So 
when my 14 days run out, will the FREE version be upgraded?

If so I guess I should install the TRIAL subscription software every 3 
monts or so to update my black list.

[toc] | [prev] | [next] | [standalone]

#120691

On 2019-01-16 7:49 p.m., gtr wrote:
> On 2019-01-17 03:04:03 +0000, Your Name said:
> 
>> On 2019-01-17 01:53:48 +0000, gtr said:
>>> On 2019-01-16 08:24:24 +0000, David B. said:
>>>>
>>>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>>>> remaining?   (It's FREE)
>>>>
>>>> FYI  https://www.malwarebytes.com/
>>>>
>>>> I trust all is well!
>>>
>>> All is well according to MWB.  I never actually ran the "codec 
>>> installer", I just poked around and looked inside and googled it a bit.
>>>
>>> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and 
>>> not for free, but for $40 PER YEAR.  It has real-time checking and (I 
>>> assume) a lot of other stuff I don't want or need.
>> <snip>
>>
>> Yes and no.
>>
>> You can download Malwarebytes from their website and install it. For 
>> the first 14 days you get to trail all the "Premium" features 
>> (background real-time checking / blocking, scheduled scans, etc.). 
>> After the 14 day trial period expires, the "Premium" features get 
>> locked, but you can still continue use the app as a free malware 
>> checker and remover, including updating the definitions, but you have 
>> to manually run it instead of it running in the background.
>>
>> Check the comparison table at the bottom of this web page:
>> <https://www.malwarebytes.com/mac/>
> 
> So your MalwareBytles FREE edition gets it's identified malware updated 
> when you run the trial?  I don't need/want all the other stuff.  So when 
> my 14 days run out, will the FREE version be upgraded?
> 
> If so I guess I should install the TRIAL subscription software every 3 
> monts or so to update my black list.
> 

No.

The trial version will continue to get updates to its malware definitions.

It just won't automatically check files in the background, etc.

You have to run it MANUALLY.

[toc] | [prev] | [next] | [standalone]

#120694

On 2019-01-17, Alan Baker <nunya@ness.biz> wrote:
>
> The trial version will continue to get updates to its malware definitions.
>
> It just won't automatically check files in the background, etc.
>
> You have to run it MANUALLY.

And that's a good thing, since antivirus background scanners are
notorious for causing performance problems. In fact, I make it a rule to
completely uninstall MalwareBytes after I am done using it, since
antivirus utilities are also notorious for introducing their own
security vulnerabilities on systems that would otherwise be more secure.
If I need it, I install it, run a scan, then uninstall it from the Help
menu.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#120695

On 2019-01-17 10:53 a.m., Jolly Roger wrote:
> On 2019-01-17, Alan Baker <nunya@ness.biz> wrote:
>>
>> The trial version will continue to get updates to its malware definitions.
>>
>> It just won't automatically check files in the background, etc.
>>
>> You have to run it MANUALLY.
> 
> And that's a good thing, since antivirus background scanners are
> notorious for causing performance problems. In fact, I make it a rule to
> completely uninstall MalwareBytes after I am done using it, since
> antivirus utilities are also notorious for introducing their own
> security vulnerabilities on systems that would otherwise be more secure.
> If I need it, I install it, run a scan, then uninstall it from the Help
> menu.
> 

I've had good success letting AVG do automatic scanning, but YMMV.

:-)

[toc] | [prev] | [next] | [standalone]

#120706

On 17/01/2019 01:53, gtr wrote:
> On 2019-01-16 08:24:24 +0000, David B. said:
> 
>> On 16/01/2019 02:40, gtr wrote:
>>> On 2019-01-16 00:35:07 +0000, Alan Browne said:
>>>
>>>> On 2019-01-15 00:32, gtr wrote:
>>>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>>>
>>>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan 
>>>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan 
>>>>>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) 
>>>>>>>>>> video he sent
>>>>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". 
>>>>>>>>>> I've
>>>>>>>>>> uncompressed it and there sure is a lot of stuff going on in 
>>>>>>>>>> there.
>>>>>>>>>>
>>>>>>>>>> Elsewhere I see on the next that others believe it is a trojan 
>>>>>>>>>> hourse
>>>>>>>>>> for Windows, but there is also this Mac version.  What know he 
>>>>>>>>>> of all this?
>>>>>>>>>>
>>>>>>>>>> I think Perian use to provide a lot of codecs but they are now 
>>>>>>>>>> gone, and
>>>>>>>>>> wonder if a utility that *seems* to purport to provide support 
>>>>>>>>>> for newer
>>>>>>>>>> videos is valid.  I assume it is not and I have ditched it, 
>>>>>>>>>> but I'd like
>>>>>>>>>> to know what history there is of this.
>>>>>>>>>>
>>>>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  
>>>>>>>>>> I'm only
>>>>>>>>>> joking!
>>>>>>>>
>>>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>>>
>>>>>>>> If it does not play in VLC, and he's said ti does not, it is not 
>>>>>>>> worth
>>>>>>>> wasting time on and is almost certainly simply a malware package 
>>>>>>>> or a
>>>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>>>
>>>>>>>>> (Our security cameras at work record in .dav.  When we need to 
>>>>>>>>> copy
>>>>>>>>> segment for, er, legal reasons, we convert it using the command 
>>>>>>>>> above.
>>>>>>>>> (.fmt would be .dav of course...)
>>>>>>>>
>>>>>>>> And VLC will load the .dav, even it it will not play it 
>>>>>>>> perfectly, it
>>>>>>>> will play it.
>>>>>>
>>>>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither 
>>>>>>> worked.
>>>>>>
>>>>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>>>>> had a codec installed (I don't know), but it definitely played the 
>>>>>> dav.
>>>>>>
>>>>>> But the point is, delete the file, delete the malware script, and 
>>>>>> tell
>>>>>> the friend to stop sending malware.
>>>>>
>>>>> I did all that, but I did snatch them back out of the trash as 
>>>>> people have asked me to sic ffmpeg and such at it.  I attempted 
>>>>> that but the location (./ffmpeg) wasn't appropriate.
>>>>
>>>> Just path to the files from where ffmpeg is located in the command 
>>>> line or put a copy of ffmpeg into the same folder (these are quick 
>>>> lazy fixes if you don't want to edit paths).
>>>
>>> I know, but having to chase it down itself became the point where 
>>> laziness interceded.  In any case I've kinda blown the whole thing 
>>> off. I was mostly curious if others knew about this particular 
>>> malevolence or not.  Seemingly: not.
>>
>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>> remaining?   (It's FREE)
>>
>> FYI  https://www.malwarebytes.com/
>>
>> I trust all is well!
> 
> All is well according to MWB.  I never actually ran the "codec 
> installer", I just poked around and looked inside and googled it a bit.
> 
> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and not 
> for free, but for $40 PER YEAR.  It has real-time checking and (I 
> assume) a lot of other stuff I don't want or need.
> 
> On the other hand, I assume there have been additional malware scams 
> that have occured since 9/22/17 that are not being filtered in the free 
> version.
> 
> What think ye of that?

In my recent absence (attending yet another funeral!) you have received 
the correct information from others. I do as 'Jolly Roger' does and 
uninstall Malwarebytes when I don't need or want to use it.

-- 
David B.

[toc] | [prev] | [next] | [standalone]

#120709

On 2019-01-18 01:13:19 +0000, David B. said:

> On 17/01/2019 01:53, gtr wrote:
>> On 2019-01-16 08:24:24 +0000, David B. said:
>> 
>>> On 16/01/2019 02:40, gtr wrote:
>>>> On 2019-01-16 00:35:07 +0000, Alan Browne said:
>>>> 
>>>>> On 2019-01-15 00:32, gtr wrote:
>>>>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>>>> 
>>>>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne 
>>>>>>> <bitbucket@blackhole.com> wrote:
>>>>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne 
>>>>>>>>> <bitbucket@blackhole.com> wrote:
>>>>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>>>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>>>>>> 
>>>>>>>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>>>>>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>>>>>>>> 
>>>>>>>>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>>>>>>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>>>>>>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>>>>>>>>> to know what history there is of this.
>>>>>>>>>>> 
>>>>>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>>>>>>>>> joking!
>>>>>>>>> 
>>>>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>>>> 
>>>>>>>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>>>>>>>> wasting time on and is almost certainly simply a malware package or a
>>>>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>>>> 
>>>>>>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>>>>>>> segment for, er, legal reasons, we convert it using the command above.
>>>>>>>>>> (.fmt would be .dav of course...)
>>>>>>>>> 
>>>>>>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>>>>>>> will play it.
>>>>>>> 
>>>>>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
>>>>>>> 
>>>>>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>>>>>> had a codec installed (I don't know), but it definitely played the dav.
>>>>>>> 
>>>>>>> But the point is, delete the file, delete the malware script, and tell
>>>>>>> the friend to stop sending malware.
>>>>>> 
>>>>>> I did all that, but I did snatch them back out of the trash as people 
>>>>>> have asked me to sic ffmpeg and such at it.  I attempted that but the 
>>>>>> location (./ffmpeg) wasn't appropriate.
>>>>> 
>>>>> Just path to the files from where ffmpeg is located in the command line 
>>>>> or put a copy of ffmpeg into the same folder (these are quick lazy 
>>>>> fixes if you don't want to edit paths).
>>>> 
>>>> I know, but having to chase it down itself became the point where 
>>>> laziness interceded.  In any case I've kinda blown the whole thing off. 
>>>> I was mostly curious if others knew about this particular malevolence 
>>>> or not.  Seemingly: not.
>>> 
>>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>>> remaining?   (It's FREE)
>>> 
>>> FYI  https://www.malwarebytes.com/
>>> 
>>> I trust all is well!
>> 
>> All is well according to MWB.  I never actually ran the "codec 
>> installer", I just poked around and looked inside and googled it a bit.
>> 
>> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and not 
>> for free, but for $40 PER YEAR.  It has real-time checking and (I 
>> assume) a lot of other stuff I don't want or need.
>> 
>> On the other hand, I assume there have been additional malware scams 
>> that have occured since 9/22/17 that are not being filtered in the free 
>> version.
>> 
>> What think ye of that?
> 
> In my recent absence (attending yet another funeral!) you have received 
> the correct information from others. I do as 'Jolly Roger' does and 
> uninstall Malwarebytes when I don't need or want to use it.

Thanks to you and Jolly Roger for the advice.

[toc] | [prev] | [next] | [standalone]

#120715

On 18/01/2019 02:42, gtr wrote:
> On 2019-01-18 01:13:19 +0000, David B. said:
> 
>> On 17/01/2019 01:53, gtr wrote:
>>> On 2019-01-16 08:24:24 +0000, David B. said:
>>>
>>>> On 16/01/2019 02:40, gtr wrote:
>>>>> On 2019-01-16 00:35:07 +0000, Alan Browne said:
>>>>>
>>>>>> On 2019-01-15 00:32, gtr wrote:
>>>>>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>>>>>
>>>>>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan 
>>>>>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> 
>>>>>>>>>> Alan Browne <bitbucket@blackhole.com> wrote:
>>>>>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) 
>>>>>>>>>>>> video he sent
>>>>>>>>>>>> me there is a unix compressed archive named 
>>>>>>>>>>>> "CodecSetup-Mac". I've
>>>>>>>>>>>> uncompressed it and there sure is a lot of stuff going on in 
>>>>>>>>>>>> there.
>>>>>>>>>>>>
>>>>>>>>>>>> Elsewhere I see on the next that others believe it is a 
>>>>>>>>>>>> trojan hourse
>>>>>>>>>>>> for Windows, but there is also this Mac version.  What know 
>>>>>>>>>>>> he of all this?
>>>>>>>>>>>>
>>>>>>>>>>>> I think Perian use to provide a lot of codecs but they are 
>>>>>>>>>>>> now gone, and
>>>>>>>>>>>> wonder if a utility that *seems* to purport to provide 
>>>>>>>>>>>> support for newer
>>>>>>>>>>>> videos is valid.  I assume it is not and I have ditched it, 
>>>>>>>>>>>> but I'd like
>>>>>>>>>>>> to know what history there is of this.
>>>>>>>>>>>>
>>>>>>>>>>>> Perhaps I should get some expensive antivirus 
>>>>>>>>>>>> software--JOKE!  I'm only
>>>>>>>>>>>> joking!
>>>>>>>>>>
>>>>>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>>>>>
>>>>>>>>>> If it does not play in VLC, and he's said ti does not, it is 
>>>>>>>>>> not worth
>>>>>>>>>> wasting time on and is almost certainly simply a malware 
>>>>>>>>>> package or a
>>>>>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>>>>>
>>>>>>>>>>> (Our security cameras at work record in .dav.  When we need 
>>>>>>>>>>> to copy
>>>>>>>>>>> segment for, er, legal reasons, we convert it using the 
>>>>>>>>>>> command above.
>>>>>>>>>>> (.fmt would be .dav of course...)
>>>>>>>>>>
>>>>>>>>>> And VLC will load the .dav, even it it will not play it 
>>>>>>>>>> perfectly, it
>>>>>>>>>> will play it.
>>>>>>>>
>>>>>>>>> Definitely not.  First thing we tried.  Then Handbrake.  
>>>>>>>>> Neither worked.
>>>>>>>>
>>>>>>>> I've played .dav files in VLC. It was the Windows VLC and it may 
>>>>>>>> have
>>>>>>>> had a codec installed (I don't know), but it definitely played 
>>>>>>>> the dav.
>>>>>>>>
>>>>>>>> But the point is, delete the file, delete the malware script, 
>>>>>>>> and tell
>>>>>>>> the friend to stop sending malware.
>>>>>>>
>>>>>>> I did all that, but I did snatch them back out of the trash as 
>>>>>>> people have asked me to sic ffmpeg and such at it.  I attempted 
>>>>>>> that but the location (./ffmpeg) wasn't appropriate.
>>>>>>
>>>>>> Just path to the files from where ffmpeg is located in the command 
>>>>>> line or put a copy of ffmpeg into the same folder (these are quick 
>>>>>> lazy fixes if you don't want to edit paths).
>>>>>
>>>>> I know, but having to chase it down itself became the point where 
>>>>> laziness interceded.  In any case I've kinda blown the whole thing 
>>>>> off. I was mostly curious if others knew about this particular 
>>>>> malevolence or not.  Seemingly: not.
>>>>
>>>> Have you scanned with Malwarebytes to make sure nothing untoward is 
>>>> remaining?   (It's FREE)
>>>>
>>>> FYI  https://www.malwarebytes.com/
>>>>
>>>> I trust all is well!
>>>
>>> All is well according to MWB.  I never actually ran the "codec 
>>> installer", I just poked around and looked inside and googled it a bit.
>>>
>>> By the way, my FREE version is 1.3.1.  I see it is up to 3.1.1, and 
>>> not for free, but for $40 PER YEAR.  It has real-time checking and (I 
>>> assume) a lot of other stuff I don't want or need.
>>>
>>> On the other hand, I assume there have been additional malware scams 
>>> that have occured since 9/22/17 that are not being filtered in the 
>>> free version.
>>>
>>> What think ye of that?
>>
>> In my recent absence (attending yet another funeral!) you have 
>> received the correct information from others. I do as 'Jolly Roger' 
>> does and uninstall Malwarebytes when I don't need or want to use it.
> 
> Thanks to you and Jolly Roger for the advice.


You are most welcome!

Have a grand day! :-)

-- 
David B.

[toc] | [prev] | [next] | [standalone]

#120650

On 2019-01-15 00:23, Lewis wrote:
> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
>> On 2019-01-14 17:33, Lewis wrote:
>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
>>>> On 2019-01-13 19:22, gtr wrote:
>>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>
>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>>
>>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>>> to know what history there is of this.
>>>>>
>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>>> joking!
>>>
>>>> Did you try ffmpeg to convert it to .mov?
>>>
>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>> wasting time on and is almost certainly simply a malware package or a
>>> fake binary blog to encourage the malware package's installation.
>>>
>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>> segment for, er, legal reasons, we convert it using the command above.
>>>> (.fmt would be .dav of course...)
>>>
>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>> will play it.
> 
>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
> 
> I've played .dav files in VLC. It was the Windows VLC and it may have
> had a codec installed (I don't know), but it definitely played the dav.

.dav doesn't mean ... consistent perhaps.  Who knows....

> 
> But the point is, delete the file, delete the malware script, and tell
> the friend to stop sending malware.

But the video might have valuable macrame tips!


-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120605

On 2019-01-14 22:33:34 +0000, Lewis said:

> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne 
> <bitbucket@blackhole.com> wrote:
>> On 2019-01-13 19:22, gtr wrote:
>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>> uncompressed it and there sure is a lot of stuff going on in there.
>>> 
>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>> for Windows, but there is also this Mac version.  What know he of all this?
>>> 
>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>> wonder if a utility that *seems* to purport to provide support for newer
>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>> to know what history there is of this.
>>> 
>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>> joking!
> 
>> Did you try ffmpeg to convert it to .mov?
> 
> If it does not play in VLC, and he's said ti does not, it is not worth
> wasting time on and is almost certainly simply a malware package or a
> fake binary blog to encourage the malware package's installation.

VLC will not play it.

>> (Our security cameras at work record in .dav.  When we need to copy
>> segment for, er, legal reasons, we convert it using the command above.
>> (.fmt would be .dav of course...)
> 
> And VLC will load the .dav, even it it will not play it perfectly, it
> will play it.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.sys.mac.system

csiph-web