Firefox add-on gave malware/virus??

Question

Level 1

6 points

Firefox add-on gave malware/virus??

I've been using Firefox's Downloadhelper for a while and never had issues; however, last week I downloaded a converter to enable me to convert from video to audio format from Downloadhelper. Since then, I've had part of a note in Notes app deleted, and my gmail account went from 100's of emails in the inbox to 5. Now these two issues could be simply correlated to the timing of downloading the converter, or it could be caused by. Does anyone have any experience?

I'm running El Capitan on an iMac.

The instruction to download the converter is found on http://www.downloadhelper.net/install-converter3.php

It says to

==========

An easy method for installing Libav consists of using Homebrewfrom a terminal:

Start the Terminal application from Applications → Utilities → Terminal
Type
```
brew install libav
```

If Homebrew is not installed on your Mac:

Start the Terminal application from Applications → Utilities → Terminal

Type

ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

==========

iMac, OS X Yosemite (10.10.3)

Posted on Aug 30, 2016 5:50 AM

Reply

Answer 1

Barney-15E

Level 10

122,084 points

Aug 30, 2016 6:15 AM in response to FYMac

Anytime you download software from a site like that, you run the risk of it being bundled with Adware.

Did you download anything that required you to install it?

The Homebrew install would not have added any adware.

This Adware removal tool may be able to find if you did install adware: http://www.adwaremedic.com/index.php

Reply

Answer 2

FYMac Author

Level 1

6 points

Aug 30, 2016 6:28 AM in response to Barney-15E

Thanks Barry! It did indeed have me download from an external site via terminal.

I have Flextivity and ran that. Found nothing...

I'm curious if anyone's ever done research into what site and files the above is downloading, and whether it's got malware/virus attached to it or not. This converter has been around for a number of years now...

Reply

Answer 3

FYMac Author

Level 1

6 points

Aug 30, 2016 6:43 AM in response to FYMac

Sorry: more details. Here are the Terminal commands copied/pasted from my computer:

Last login: Mon Aug 22 07:45:01 on console

Frank-Yang:~ frank$ brew install libav

-bash: brew: command not found

Frank-Yang:~ frank$ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

==> This script will install:

/usr/local/bin/brew

/usr/local/Library/...

/usr/local/share/doc/homebrew

/usr/local/share/man/man1/brew.1

/usr/local/share/zsh/site-functions/_brew

/usr/local/etc/bash_completion.d/brew

==> The following directories will be made group writable:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

==> The following directories will have their owner set to frank:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

==> The following directories will have their group set to admin:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

Press RETURN to continue or any other key to abort

Frank-Yang:~ frank$ brew install libav

-bash: brew: command not found

Frank-Yang:~ frank$ /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

==> This script will install:

/usr/local/bin/brew

/usr/local/Library/...

/usr/local/share/doc/homebrew

/usr/local/share/man/man1/brew.1

/usr/local/share/zsh/site-functions/_brew

/usr/local/etc/bash_completion.d/brew

==> The following directories will be made group writable:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

==> The following directories will have their owner set to frank:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

==> The following directories will have their group set to admin:

/usr/local/.

/usr/local/bin

/usr/local/include

/usr/local/lib

/usr/local/lib/pkgconfig

Press RETURN to continue or any other key to abort

==> /usr/bin/sudo /bin/chmod g+rwx /usr/local/. /usr/local/bin /usr/local/include /usr/local/lib /usr/local/lib/pkgconfig

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:

Sorry, try again.

Password:

Sorry, try again.

Password:

==> /usr/bin/sudo /usr/sbin/chown frank /usr/local/. /usr/local/bin /usr/local/include /usr/local/lib /usr/local/lib/pkgconfig

==> /usr/bin/sudo /usr/bin/chgrp admin /usr/local/. /usr/local/bin /usr/local/include /usr/local/lib /usr/local/lib/pkgconfig

==> /usr/bin/sudo /bin/mkdir -p /Users/frank/Library/Caches/Homebrew

==> /usr/bin/sudo /bin/chmod g+rwx /Users/frank/Library/Caches/Homebrew

==> /usr/bin/sudo /usr/sbin/chown frank /Users/frank/Library/Caches/Homebrew

==> Searching online for the Command Line Tools

==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress

==> Installing Command Line Tools (OS X 10.11) for Xcode-7.3

==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ (OS\ X\ 10.11)\ for\ Xcode-7.3

Software Update Tool

Downloading Command Line Tools (OS X 10.11) for Xcode

Downloaded Command Line Tools (OS X 10.11) for Xcode

Installing Command Line Tools (OS X 10.11) for Xcode

Done with Command Line Tools (OS X 10.11) for Xcode

Done.

==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress

==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools

==> Downloading and installing Homebrew...

remote: Counting objects: 1030, done.

remote: Compressing objects: 100% (919/919), done.

remote: Total 1030 (delta 93), reused 690 (delta 70), pack-reused 0

Receiving objects: 100% (1030/1030), 1.03 MiB | 0 bytes/s, done.

Resolving deltas: 100% (93/93), done.

From https://github.com/Homebrew/brew

* [new branch] master -> origin/master

Checking out files: 100% (973/973), done.

HEAD is now at 31052a9 Merge pull request #782 from MikeMcQuaid/weak-imports-opt-in

==> Tapping homebrew/core

Cloning into '/usr/local/Library/Taps/homebrew/homebrew-core'...

remote: Counting objects: 3718, done.

remote: Compressing objects: 100% (3605/3605), done.

remote: Total 3718 (delta 15), reused 1789 (delta 4), pack-reused 0

Receiving objects: 100% (3718/3718), 2.87 MiB | 0 bytes/s, done.

Resolving deltas: 100% (15/15), done.

Checking connectivity... done.

Checking out files: 100% (3722/3722), done.

Tapped 3596 formulae (3,745 files, 8.9M)

==> Installation successful!

==> Next steps

Run `brew help` to get started

Further documentation: https://git.io/brew-docs

==> Homebrew has enabled anonymous aggregate user behaviour analytics

Read the analytics documentation (and how to opt-out) here:

https://git.io/brew-analytics

Frank-Yang:~ frank$ brew install libav

==> Auto-updated Homebrew!

Updated 1 tap (homebrew/core).

==> Updated Formulae

mozjpeg

==> Installing dependencies for libav: faac, lame, x264, xvid

==> Installing libav dependency: faac

==> Downloading https://homebrew.bintray.com/bottles/faac-1.28.el_capitan.bottle

######################################################################## 100.0%

==> Pouring faac-1.28.el_capitan.bottle.1.tar.gz

/usr/local/Cellar/faac/1.28: 15 files, 671.7K

==> Installing libav dependency: lame

==> Downloading https://homebrew.bintray.com/bottles/lame-3.99.5.el_capitan.bott

######################################################################## 100.0%

==> Pouring lame-3.99.5.el_capitan.bottle.1.tar.gz

/usr/local/Cellar/lame/3.99.5: 26 files, 2M

==> Installing libav dependency: x264

==> Downloading https://homebrew.bintray.com/bottles/x264-r2668.el_capitan.bottl

######################################################################## 100.0%

==> Pouring x264-r2668.el_capitan.bottle.tar.gz

/usr/local/Cellar/x264/r2668: 10 files, 3.3M

==> Installing libav dependency: xvid

==> Downloading https://homebrew.bintray.com/bottles/xvid-1.3.4.el_capitan.bottl

######################################################################## 100.0%

==> Pouring xvid-1.3.4.el_capitan.bottle.tar.gz

/usr/local/Cellar/xvid/1.3.4: 9 files, 1.3M

==> Installing libav

==> Downloading https://homebrew.bintray.com/bottles/libav-11.4_2.el_capitan.bot

######################################################################## 100.0%

==> Pouring libav-11.4_2.el_capitan.bottle.2.tar.gz

/usr/local/Cellar/libav/11.4_2: 8 files, 17.9M

Frank-Yang:~ frank$ brew analytics off

Frank-Yang:~ frank$

[Restored Aug 30, 2016, 9:31:35 AM]

Reply

Answer 4

dialabrain

Level 10

135,611 points

Aug 30, 2016 7:02 AM in response to FYMac

Just a reminder: Not everything installed that goes awry has to be caused by malware or virus. The instructions could be wrong, some third-party app could interact badly, typos, out-of-date, etc.

It may just be a coincidence as well.

Reply

Answer 5

FYMac Author

Level 1

6 points

Aug 30, 2016 7:08 AM in response to dialabrain

Definitely agree w/ you, Dialabrian... correlation doesn't equal causation.

Reply

Answer 6

Barney-15E

Level 10

122,084 points

Aug 30, 2016 7:22 AM in response to dialabrain

As I stated, the Homebrew install did not cause the problem. I know what it installs and how it works.

It would be something else you downloaded and installed.

Reply

Answer 7

dialabrain

Level 10

135,611 points

Aug 30, 2016 7:30 AM in response to Barney-15E

Not me. I didn't even install Homebrew. Although I'm familiar with it. 😎

The convertor the OP is referring to has been around a long time. Download Helper is an extension for FF and maybe other browsers, that helps download videos among other things. Personally I never installed the convertor. I just download the video and extract the audio once it's downloaded rather than converting it "on the fly".

Reply