Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #120526 > unrolled thread

CodecSetup-Mac - Trojan?

Back to article view | Back to comp.sys.mac.system

Contents

  CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 16:22 -0800
    Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-13 19:34 -0500
    Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 14:13 +1300
    Re: CodecSetup-Mac - Trojan? David Ritz <dritz@mindspring.com> - 2019-01-13 21:12 -0600
    Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 03:36 +0000
      Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 20:22 -0800
        Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 19:17 +1300
        Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-14 06:53 -0500
    Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-13 23:05 -0700
    Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 12:41 -0500
      Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-14 11:48 -0700
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:22 -0500
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:25 -0500
      Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 22:33 +0000
        Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 18:18 -0500
          Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-15 05:23 +0000
            Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:32 -0800
              Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:35 -0500
                Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-15 18:40 -0800
                  Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-16 08:24 +0000
                    Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 17:53 -0800
                      Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-17 16:04 +1300
                        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 19:49 -0800
                          Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-16 23:16 -0800
                            Re: CodecSetup-Mac - Trojan? Jolly Roger <jollyroger@pobox.com> - 2019-01-17 18:53 +0000
                              Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-17 10:55 -0800
                      Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 01:13 +0000
                        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-17 18:42 -0800
                          Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 09:12 +0000
            Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:33 -0500
        Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:31 -0800

Page 1 of 2  [1] 2  Next page →

#120526 — CodecSetup-Mac - Trojan?

A friend is adamant I see a movie.  Along the (unplayable) video he 
sent me there is a unix compressed archive named "CodecSetup-Mac". I've 
uncompressed it and there sure is a lot of stuff going on in there.

Elsewhere I see on the next that others believe it is a trojan hourse 
for Windows, but there is also this Mac version.  What know he of all 
this?

I think Perian use to provide a lot of codecs but they are now gone, 
and wonder if a utility that *seems* to purport to provide support for 
newer videos is valid.  I assume it is not and I have ditched it, but 
I'd like to know what history there is of this.

Perhaps I should get some expensive antivirus software--JOKE!  I'm only 
joking! 

[toc] | [next] | [standalone]

#120527

In article <q1gkni$hnm$1@news.albasani.net>, gtr <xxx@yyy.zzz> wrote:

> A friend is adamant I see a movie.  Along the (unplayable) video he 
> sent me there is a unix compressed archive named "CodecSetup-Mac". I've 
> uncompressed it and there sure is a lot of stuff going on in there.

do *not* even think about using that and your friend needs to be
educated on safe computing.

open the movie in quicktime player and see what codec it uses, then
find the appropriate solution.

[toc] | [prev] | [next] | [standalone]

#120529

On 2019-01-14 00:22:10 +0000, gtr said:

> A friend is adamant I see a movie.  Along the (unplayable) video he 
> sent me there is a unix compressed archive named "CodecSetup-Mac". I've 
> uncompressed it and there sure is a lot of stuff going on in there.
> 
> Elsewhere I see on the next that others believe it is a trojan hourse 
> for Windows, but there is also this Mac version.  What know he of all 
> this?
> 
> I think Perian use to provide a lot of codecs but they are now gone, 
> and wonder if a utility that *seems* to purport to provide support for 
> newer videos is valid.  I assume it is not and I have ditched it, but 
> I'd like to know what history there is of this.
> 
> Perhaps I should get some expensive antivirus software--JOKE!  I'm only joking!

VLC can play a lot of different video formats (not all though) and it's free:
<https://www.videolan.org/vlc/download-macosx.html>

[toc] | [prev] | [next] | [standalone]

#120534

On Sunday, 13 January 2019 16:22 -0800, 
 in article <q1gkni$hnm$1@news.albasani.net>, 
 gtr <xxx@yyy.zzz> wrote:

> A friend is adamant I see a movie.  Along the (unplayable) video he 
> sent me there is a unix compressed archive named "CodecSetup-Mac". 
> I've uncompressed it and there sure is a lot of stuff going on in 
> there.

A good jumping off point may be to grab a md5 hash of the file, then 
copy and paste it into the VirusTotal search form.

From the terminal command line prompt:

    md5 /path/to/file

    https://www.virustotal.com/#/home/search

After you run it up the flagpole, let us know whether anyone salutes.

-- 
David Ritz <dritz@mindspring.com>
 Be kind to animals; kiss a shark.

[toc] | [prev] | [next] | [standalone]

#120536

In message <q1gkni$hnm$1@news.albasani.net> gtr <xxx@yyy.zzz> wrote:
> wonder if a utility that *seems* to purport to provide support for 
> newer videos is valid.

99.9999% it is malware.

> I assume it is not and I have ditched it, but 
> I'd like to know what history there is of this.

Get you to install something with admin privileges that can then
download more malware.

If VLC cannot play a video, you are best off deleting the video.

-- 
Can I tell you the truth? I mean this isn't like TV news, is it?

[toc] | [prev] | [next] | [standalone]

#120540

On 2019-01-14 03:36:22 +0000, Lewis said:

> In message <q1gkni$hnm$1@news.albasani.net> gtr <xxx@yyy.zzz> wrote:
>> wonder if a utility that *seems* to purport to provide support for
>> newer videos is valid.
> 
> 99.9999% it is malware.
> 
>> I assume it is not and I have ditched it, but
>> I'd like to know what history there is of this.
> 
> Get you to install something with admin privileges that can then
> download more malware.
> 
> If VLC cannot play a video, you are best off deleting the video.

VLC won't play it.  Seemingly nothing will.  That's probably a 
give-away in itsef.

[toc] | [prev] | [next] | [standalone]

#120542

On 2019-01-14 04:22:53 +0000, gtr said:
> On 2019-01-14 03:36:22 +0000, Lewis said:
>> In message <q1gkni$hnm$1@news.albasani.net> gtr <xxx@yyy.zzz> wrote:
>>> wonder if a utility that *seems* to purport to provide support for
>>> newer videos is valid.
>> 
>> 99.9999% it is malware.
>> 
>>> I assume it is not and I have ditched it, but
>>> I'd like to know what history there is of this.
>> 
>> Get you to install something with admin privileges that can then
>> download more malware.
>> 
>> If VLC cannot play a video, you are best off deleting the video.
> 
> VLC won't play it.  Seemingly nothing will.  That's probably a 
> give-away in itsef.

Potentially it could be a custom video format that can only be played 
with the proper player app.

Flash video .swf files are one such example which can't be played in 
either VLC or QuickTime Player. You need Flash (either the browser 
plug-in or the standalone projector app). There may be other apps that 
can play Flash videos too.

[toc] | [prev] | [next] | [standalone]

#120549

In article <q1h2qt$a8s$1@news.albasani.net>, gtr <xxx@yyy.zzz> wrote:

> 
> VLC won't play it.  Seemingly nothing will.  That's probably a 
> give-away in itsef.

find out what codec it uses and go from there.

[toc] | [prev] | [next] | [standalone]

#120541

On 2019-01-13 5:22 p.m., gtr wrote:
> A friend is adamant I see a movie.  Along the (unplayable) video he sent 
> me there is a unix compressed archive named "CodecSetup-Mac". I've 
> uncompressed it and there sure is a lot of stuff going on in there.

You should get a different friend.

André

-- 
To email remove 'invalid' & replace 'gm' with well known Google mail 
service.

[toc] | [prev] | [next] | [standalone]

#120558

On 2019-01-13 19:22, gtr wrote:
> A friend is adamant I see a movie.  Along the (unplayable) video he sent 
> me there is a unix compressed archive named "CodecSetup-Mac". I've 
> uncompressed it and there sure is a lot of stuff going on in there.
> 
> Elsewhere I see on the next that others believe it is a trojan hourse 
> for Windows, but there is also this Mac version.  What know he of all this?
> 
> I think Perian use to provide a lot of codecs but they are now gone, and 
> wonder if a utility that *seems* to purport to provide support for newer 
> videos is valid.  I assume it is not and I have ditched it, but I'd like 
> to know what history there is of this.
> 
> Perhaps I should get some expensive antivirus software--JOKE!  I'm only 
> joking!

Did you try ffmpeg to convert it to .mov?

I see Isaak on the thread - surprised he didn't mention it.

  ./ffmpeg -f  h264 -i xyz.fmt xyz.mov

(Our security cameras at work record in .dav.  When we need to copy 
segment for, er, legal reasons, we convert it using the command above.
(.fmt would be .dav of course...)

-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120562

On 2019-01-14 10:41 a.m., Alan Browne wrote:
> On 2019-01-13 19:22, gtr wrote:
>> A friend is adamant I see a movie.  Along the (unplayable) video he 
>> sent me there is a unix compressed archive named "CodecSetup-Mac". 
>> I've uncompressed it and there sure is a lot of stuff going on in there.
>>
>> Elsewhere I see on the next that others believe it is a trojan hourse 
>> for Windows, but there is also this Mac version.  What know he of all 
>> this?
>>
>> I think Perian use to provide a lot of codecs but they are now gone, 
>> and wonder if a utility that *seems* to purport to provide support for 
>> newer videos is valid.  I assume it is not and I have ditched it, but 
>> I'd like to know what history there is of this.
>>
>> Perhaps I should get some expensive antivirus software--JOKE!  I'm 
>> only joking!
> 
> Did you try ffmpeg to convert it to .mov?
> 
> I see Isaak on the thread - surprised he didn't mention it.

I think you might be confusing me with someone else... I don't recall 
ever discussing ffmpeg in any thread.

André

-- 
To email remove 'invalid' & replace 'gm' with well known Google mail 
service.

[toc] | [prev] | [next] | [standalone]

#120575

On 2019-01-14 13:48, André G. Isaak wrote:
> On 2019-01-14 10:41 a.m., Alan Browne wrote:
>> On 2019-01-13 19:22, gtr wrote:
>>> A friend is adamant I see a movie.  Along the (unplayable) video he 
>>> sent me there is a unix compressed archive named "CodecSetup-Mac". 
>>> I've uncompressed it and there sure is a lot of stuff going on in there.
>>>
>>> Elsewhere I see on the next that others believe it is a trojan hourse 
>>> for Windows, but there is also this Mac version.  What know he of all 
>>> this?
>>>
>>> I think Perian use to provide a lot of codecs but they are now gone, 
>>> and wonder if a utility that *seems* to purport to provide support 
>>> for newer videos is valid.  I assume it is not and I have ditched it, 
>>> but I'd like to know what history there is of this.
>>>
>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm 
>>> only joking!
>>
>> Did you try ffmpeg to convert it to .mov?
>>
>> I see Isaak on the thread - surprised he didn't mention it.
> 
> I think you might be confusing me with someone else... I don't recall 
> ever discussing ffmpeg in any thread.

Colour me dumb then.


-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120576

On 2019-01-14 13:48, André G. Isaak wrote:
> On 2019-01-14 10:41 a.m., Alan Browne wrote:
>> On 2019-01-13 19:22, gtr wrote:
>>> A friend is adamant I see a movie.  Along the (unplayable) video he 
>>> sent me there is a unix compressed archive named "CodecSetup-Mac". 
>>> I've uncompressed it and there sure is a lot of stuff going on in there.
>>>
>>> Elsewhere I see on the next that others believe it is a trojan hourse 
>>> for Windows, but there is also this Mac version.  What know he of all 
>>> this?
>>>
>>> I think Perian use to provide a lot of codecs but they are now gone, 
>>> and wonder if a utility that *seems* to purport to provide support 
>>> for newer videos is valid.  I assume it is not and I have ditched it, 
>>> but I'd like to know what history there is of this.
>>>
>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm 
>>> only joking!
>>
>> Did you try ffmpeg to convert it to .mov?
>>
>> I see Isaak on the thread - surprised he didn't mention it.
> 
> I think you might be confusing me with someone else... I don't recall 
> ever discussing ffmpeg in any thread.
> 
> André
> 
Someone named bi...@mix.com it was.  Google Groups has obfuscated the 
first part of his name ...

-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120580

In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
> On 2019-01-13 19:22, gtr wrote:
>> A friend is adamant I see a movie.  Along the (unplayable) video he sent 
>> me there is a unix compressed archive named "CodecSetup-Mac". I've 
>> uncompressed it and there sure is a lot of stuff going on in there.
>> 
>> Elsewhere I see on the next that others believe it is a trojan hourse 
>> for Windows, but there is also this Mac version.  What know he of all this?
>> 
>> I think Perian use to provide a lot of codecs but they are now gone, and 
>> wonder if a utility that *seems* to purport to provide support for newer 
>> videos is valid.  I assume it is not and I have ditched it, but I'd like 
>> to know what history there is of this.
>> 
>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only 
>> joking!

> Did you try ffmpeg to convert it to .mov?

If it does not play in VLC, and he's said ti does not, it is not worth
wasting time on and is almost certainly simply a malware package or a
fake binary blog to encourage the malware package's installation.

> (Our security cameras at work record in .dav.  When we need to copy 
> segment for, er, legal reasons, we convert it using the command above.
> (.fmt would be .dav of course...)

And VLC will load the .dav, even it it will not play it perfectly, it
will play it.


-- 
"Love is the triumph of imagination over intelligence." - H. L. Mencken

[toc] | [prev] | [next] | [standalone]

#120585

On 2019-01-14 17:33, Lewis wrote:
> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
>> On 2019-01-13 19:22, gtr wrote:
>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>
>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>
>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>> wonder if a utility that *seems* to purport to provide support for newer
>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>> to know what history there is of this.
>>>
>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>> joking!
> 
>> Did you try ffmpeg to convert it to .mov?
> 
> If it does not play in VLC, and he's said ti does not, it is not worth
> wasting time on and is almost certainly simply a malware package or a
> fake binary blog to encourage the malware package's installation.
> 
>> (Our security cameras at work record in .dav.  When we need to copy
>> segment for, er, legal reasons, we convert it using the command above.
>> (.fmt would be .dav of course...)
> 
> And VLC will load the .dav, even it it will not play it perfectly, it
> will play it.

Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.

-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120604

In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
> On 2019-01-14 17:33, Lewis wrote:
>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
>>> On 2019-01-13 19:22, gtr wrote:
>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>
>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>
>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>> to know what history there is of this.
>>>>
>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>> joking!
>> 
>>> Did you try ffmpeg to convert it to .mov?
>> 
>> If it does not play in VLC, and he's said ti does not, it is not worth
>> wasting time on and is almost certainly simply a malware package or a
>> fake binary blog to encourage the malware package's installation.
>> 
>>> (Our security cameras at work record in .dav.  When we need to copy
>>> segment for, er, legal reasons, we convert it using the command above.
>>> (.fmt would be .dav of course...)
>> 
>> And VLC will load the .dav, even it it will not play it perfectly, it
>> will play it.

> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.

I've played .dav files in VLC. It was the Windows VLC and it may have
had a codec installed (I don't know), but it definitely played the dav.

But the point is, delete the file, delete the malware script, and tell
the friend to stop sending malware.

-- 
Light thinks it travels faster than anything but it's wrong. No matter
how fast light travels it finds the darkness has always got there first,
and is waiting for it. --Reaper Man

[toc] | [prev] | [next] | [standalone]

#120606

On 2019-01-15 05:23:00 +0000, Lewis said:

> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne 
> <bitbucket@blackhole.com> wrote:
>> On 2019-01-14 17:33, Lewis wrote:
>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne 
>>> <bitbucket@blackhole.com> wrote:
>>>> On 2019-01-13 19:22, gtr wrote:
>>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>> 
>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>> 
>>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>>> to know what history there is of this.
>>>>> 
>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>>> joking!
>>> 
>>>> Did you try ffmpeg to convert it to .mov?
>>> 
>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>> wasting time on and is almost certainly simply a malware package or a
>>> fake binary blog to encourage the malware package's installation.
>>> 
>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>> segment for, er, legal reasons, we convert it using the command above.
>>>> (.fmt would be .dav of course...)
>>> 
>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>> will play it.
> 
>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
> 
> I've played .dav files in VLC. It was the Windows VLC and it may have
> had a codec installed (I don't know), but it definitely played the dav.
> 
> But the point is, delete the file, delete the malware script, and tell
> the friend to stop sending malware.

I did all that, but I did snatch them back out of the trash as people 
have asked me to sic ffmpeg and such at it.  I attempted that but the 
location (./ffmpeg) wasn't appropriate.

[toc] | [prev] | [next] | [standalone]

#120651

On 2019-01-15 00:32, gtr wrote:
> On 2019-01-15 05:23:00 +0000, Lewis said:
> 
>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne 
>> <bitbucket@blackhole.com> wrote:
>>> On 2019-01-14 17:33, Lewis wrote:
>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan 
>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video 
>>>>>> he sent
>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>
>>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>>> for Windows, but there is also this Mac version.  What know he of 
>>>>>> all this?
>>>>>>
>>>>>> I think Perian use to provide a lot of codecs but they are now 
>>>>>> gone, and
>>>>>> wonder if a utility that *seems* to purport to provide support for 
>>>>>> newer
>>>>>> videos is valid.  I assume it is not and I have ditched it, but 
>>>>>> I'd like
>>>>>> to know what history there is of this.
>>>>>>
>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm 
>>>>>> only
>>>>>> joking!
>>>>
>>>>> Did you try ffmpeg to convert it to .mov?
>>>>
>>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>>> wasting time on and is almost certainly simply a malware package or a
>>>> fake binary blog to encourage the malware package's installation.
>>>>
>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>> segment for, er, legal reasons, we convert it using the command above.
>>>>> (.fmt would be .dav of course...)
>>>>
>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>> will play it.
>>
>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
>>
>> I've played .dav files in VLC. It was the Windows VLC and it may have
>> had a codec installed (I don't know), but it definitely played the dav.
>>
>> But the point is, delete the file, delete the malware script, and tell
>> the friend to stop sending malware.
> 
> I did all that, but I did snatch them back out of the trash as people 
> have asked me to sic ffmpeg and such at it.  I attempted that but the 
> location (./ffmpeg) wasn't appropriate.

Just path to the files from where ffmpeg is located in the command line 
or put a copy of ffmpeg into the same folder (these are quick lazy fixes 
if you don't want to edit paths).


-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]

#120656

On 2019-01-16 00:35:07 +0000, Alan Browne said:

> On 2019-01-15 00:32, gtr wrote:
>> On 2019-01-15 05:23:00 +0000, Lewis said:
>> 
>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan Browne 
>>> <bitbucket@blackhole.com> wrote:
>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan Browne 
>>>>> <bitbucket@blackhole.com> wrote:
>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video he sent
>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>> 
>>>>>>> Elsewhere I see on the next that others believe it is a trojan hourse
>>>>>>> for Windows, but there is also this Mac version.  What know he of all this?
>>>>>>> 
>>>>>>> I think Perian use to provide a lot of codecs but they are now gone, and
>>>>>>> wonder if a utility that *seems* to purport to provide support for newer
>>>>>>> videos is valid.  I assume it is not and I have ditched it, but I'd like
>>>>>>> to know what history there is of this.
>>>>>>> 
>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  I'm only
>>>>>>> joking!
>>>>> 
>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>> 
>>>>> If it does not play in VLC, and he's said ti does not, it is not worth
>>>>> wasting time on and is almost certainly simply a malware package or a
>>>>> fake binary blog to encourage the malware package's installation.
>>>>> 
>>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>>> segment for, er, legal reasons, we convert it using the command above.
>>>>>> (.fmt would be .dav of course...)
>>>>> 
>>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>>> will play it.
>>> 
>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither worked.
>>> 
>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>> had a codec installed (I don't know), but it definitely played the dav.
>>> 
>>> But the point is, delete the file, delete the malware script, and tell
>>> the friend to stop sending malware.
>> 
>> I did all that, but I did snatch them back out of the trash as people 
>> have asked me to sic ffmpeg and such at it.  I attempted that but the 
>> location (./ffmpeg) wasn't appropriate.
> 
> Just path to the files from where ffmpeg is located in the command line 
> or put a copy of ffmpeg into the same folder (these are quick lazy 
> fixes if you don't want to edit paths).

I know, but having to chase it down itself became the point where 
laziness interceded.  In any case I've kinda blown the whole thing off. 
 I was mostly curious if others knew about this particular malevolence 
or not.  Seemingly: not.

[toc] | [prev] | [next] | [standalone]

#120663

On 16/01/2019 02:40, gtr wrote:
> On 2019-01-16 00:35:07 +0000, Alan Browne said:
> 
>> On 2019-01-15 00:32, gtr wrote:
>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>
>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan 
>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan 
>>>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video 
>>>>>>>> he sent
>>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>>>
>>>>>>>> Elsewhere I see on the next that others believe it is a trojan 
>>>>>>>> hourse
>>>>>>>> for Windows, but there is also this Mac version.  What know he 
>>>>>>>> of all this?
>>>>>>>>
>>>>>>>> I think Perian use to provide a lot of codecs but they are now 
>>>>>>>> gone, and
>>>>>>>> wonder if a utility that *seems* to purport to provide support 
>>>>>>>> for newer
>>>>>>>> videos is valid.  I assume it is not and I have ditched it, but 
>>>>>>>> I'd like
>>>>>>>> to know what history there is of this.
>>>>>>>>
>>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  
>>>>>>>> I'm only
>>>>>>>> joking!
>>>>>>
>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>
>>>>>> If it does not play in VLC, and he's said ti does not, it is not 
>>>>>> worth
>>>>>> wasting time on and is almost certainly simply a malware package or a
>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>
>>>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>>>> segment for, er, legal reasons, we convert it using the command 
>>>>>>> above.
>>>>>>> (.fmt would be .dav of course...)
>>>>>>
>>>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>>>> will play it.
>>>>
>>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither 
>>>>> worked.
>>>>
>>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>>> had a codec installed (I don't know), but it definitely played the dav.
>>>>
>>>> But the point is, delete the file, delete the malware script, and tell
>>>> the friend to stop sending malware.
>>>
>>> I did all that, but I did snatch them back out of the trash as people 
>>> have asked me to sic ffmpeg and such at it.  I attempted that but the 
>>> location (./ffmpeg) wasn't appropriate.
>>
>> Just path to the files from where ffmpeg is located in the command 
>> line or put a copy of ffmpeg into the same folder (these are quick 
>> lazy fixes if you don't want to edit paths).
> 
> I know, but having to chase it down itself became the point where 
> laziness interceded.  In any case I've kinda blown the whole thing off. 
> I was mostly curious if others knew about this particular malevolence or 
> not.  Seemingly: not.

Have you scanned with Malwarebytes to make sure nothing untoward is 
remaining?   (It's FREE)

FYI  https://www.malwarebytes.com/

I trust all is well!
-- 
David B.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web