Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #120663

Re: CodecSetup-Mac - Trojan?

Subject Re: CodecSetup-Mac - Trojan?
Newsgroups comp.sys.mac.system
References (3 earlier) <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> <slrnq3qrhk.5uq.g.kreme@Snow.local> <q1jra4$i9l$1@news.albasani.net> <Y92dnYCNz7mm4aPBnZ2dnUU7-d-dnZ2d@giganews.com> <q1m5i8$tbp$1@news.albasani.net>
From "David B." <"David B"@nomail.afraid.org>
Message-ID <ZSB%D.97635$Mo2.19335@fx28.fr7> (permalink)
Organization blocknews - www.blocknews.net
Date 2019-01-16 08:24 +0000

Show all headers | View raw

On 16/01/2019 02:40, gtr wrote:
> On 2019-01-16 00:35:07 +0000, Alan Browne said:
> 
>> On 2019-01-15 00:32, gtr wrote:
>>> On 2019-01-15 05:23:00 +0000, Lewis said:
>>>
>>>> In message <SaydnYo6CNAthaDBnZ2dnUU7-LOdnZ2d@giganews.com> Alan 
>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>> On 2019-01-14 17:33, Lewis wrote:
>>>>>> In message <bK-dnXwRbP1QVKHBnZ2dnUU7-UvNnZ2d@giganews.com> Alan 
>>>>>> Browne <bitbucket@blackhole.com> wrote:
>>>>>>> On 2019-01-13 19:22, gtr wrote:
>>>>>>>> A friend is adamant I see a movie.  Along the (unplayable) video 
>>>>>>>> he sent
>>>>>>>> me there is a unix compressed archive named "CodecSetup-Mac". I've
>>>>>>>> uncompressed it and there sure is a lot of stuff going on in there.
>>>>>>>>
>>>>>>>> Elsewhere I see on the next that others believe it is a trojan 
>>>>>>>> hourse
>>>>>>>> for Windows, but there is also this Mac version.  What know he 
>>>>>>>> of all this?
>>>>>>>>
>>>>>>>> I think Perian use to provide a lot of codecs but they are now 
>>>>>>>> gone, and
>>>>>>>> wonder if a utility that *seems* to purport to provide support 
>>>>>>>> for newer
>>>>>>>> videos is valid.  I assume it is not and I have ditched it, but 
>>>>>>>> I'd like
>>>>>>>> to know what history there is of this.
>>>>>>>>
>>>>>>>> Perhaps I should get some expensive antivirus software--JOKE!  
>>>>>>>> I'm only
>>>>>>>> joking!
>>>>>>
>>>>>>> Did you try ffmpeg to convert it to .mov?
>>>>>>
>>>>>> If it does not play in VLC, and he's said ti does not, it is not 
>>>>>> worth
>>>>>> wasting time on and is almost certainly simply a malware package or a
>>>>>> fake binary blog to encourage the malware package's installation.
>>>>>>
>>>>>>> (Our security cameras at work record in .dav.  When we need to copy
>>>>>>> segment for, er, legal reasons, we convert it using the command 
>>>>>>> above.
>>>>>>> (.fmt would be .dav of course...)
>>>>>>
>>>>>> And VLC will load the .dav, even it it will not play it perfectly, it
>>>>>> will play it.
>>>>
>>>>> Definitely not.  First thing we tried.  Then Handbrake.  Neither 
>>>>> worked.
>>>>
>>>> I've played .dav files in VLC. It was the Windows VLC and it may have
>>>> had a codec installed (I don't know), but it definitely played the dav.
>>>>
>>>> But the point is, delete the file, delete the malware script, and tell
>>>> the friend to stop sending malware.
>>>
>>> I did all that, but I did snatch them back out of the trash as people 
>>> have asked me to sic ffmpeg and such at it.  I attempted that but the 
>>> location (./ffmpeg) wasn't appropriate.
>>
>> Just path to the files from where ffmpeg is located in the command 
>> line or put a copy of ffmpeg into the same folder (these are quick 
>> lazy fixes if you don't want to edit paths).
> 
> I know, but having to chase it down itself became the point where 
> laziness interceded.  In any case I've kinda blown the whole thing off. 
> I was mostly curious if others knew about this particular malevolence or 
> not.  Seemingly: not.

Have you scanned with Malwarebytes to make sure nothing untoward is 
remaining?   (It's FREE)

FYI  https://www.malwarebytes.com/

I trust all is well!
-- 
David B.

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 16:22 -0800
  Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-13 19:34 -0500
  Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 14:13 +1300
  Re: CodecSetup-Mac - Trojan? David Ritz <dritz@mindspring.com> - 2019-01-13 21:12 -0600
  Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 03:36 +0000
    Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-13 20:22 -0800
      Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-14 19:17 +1300
      Re: CodecSetup-Mac - Trojan? nospam <nospam@nospam.invalid> - 2019-01-14 06:53 -0500
  Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-13 23:05 -0700
  Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 12:41 -0500
    Re: CodecSetup-Mac - Trojan? André G. Isaak <agisaak@gm.invalid> - 2019-01-14 11:48 -0700
      Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:22 -0500
      Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 16:25 -0500
    Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-14 22:33 +0000
      Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-14 18:18 -0500
        Re: CodecSetup-Mac - Trojan? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2019-01-15 05:23 +0000
          Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:32 -0800
            Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:35 -0500
              Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-15 18:40 -0800
                Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-16 08:24 +0000
                Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 17:53 -0800
                Re: CodecSetup-Mac - Trojan? Your Name <YourName@YourISP.com> - 2019-01-17 16:04 +1300
                Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-16 19:49 -0800
                Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-16 23:16 -0800
                Re: CodecSetup-Mac - Trojan? Jolly Roger <jollyroger@pobox.com> - 2019-01-17 18:53 +0000
                Re: CodecSetup-Mac - Trojan? Alan Baker <nunya@ness.biz> - 2019-01-17 10:55 -0800
                Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 01:13 +0000
                Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-17 18:42 -0800
                Re: CodecSetup-Mac - Trojan? "David B." <"David B"@nomail.afraid.org> - 2019-01-18 09:12 +0000
          Re: CodecSetup-Mac - Trojan? Alan Browne <bitbucket@blackhole.com> - 2019-01-15 19:33 -0500
      Re: CodecSetup-Mac - Trojan? gtr <xxx@yyy.zzz> - 2019-01-14 21:31 -0800

csiph-web