search

MrS0m30n3 / youtube-dl-gui

A cross platform front-end GUI of the popular youtube-dl written in wxPython.
The Unlicense
9.27k stars 1.58k forks source link

WARNING!! - The Windows Variant Contains MALICIOUS CODE #355

Closed morphological closed 5 years ago

morphological commented 5 years ago

Right after installing/running the software, I was alerted to have been infected with a "Zwangi Browser Modifier". The purpose of this tool is to manipulate or add certain browser properties such as home pages, search bars etc., with the primary focus being advertisement. MrS0m30n3 is likely being financially compensated for adding this marketing tool on the Windows end. I have carefully tested this behavior in a virtual environment and checked both files with deep scans of various anti-virus software and I can confirm that both have been deliberately infected.

I caution Windows Users not to use this.

nodiscc commented 5 years ago

@morphological I do not use Windows but ran bot the portable and the installer versions of the windows release through http://virustotal.com/. Both checks came back without warnings:

Are those the same zips you downloaded? What AV software did you use? Do you have the same detection results with other software? For example does the well-established youtube-dl return any results for you?

I am not doubting your good faith and the ability to build windows builds from source is sadly (I think?) missing (at least not documented), but could these be false positives?

paradigmArchitect commented 5 years ago

thanks for posting this, congrats on finding it if your right! -

SorrySoSorry commented 5 years ago

I agree with @nodiscc and both are safe. I just checked and run them both under Win7: Everything is working just well.

@morphological please paste checksums of your files you may have been infected elsewhere... be careful with false assumptions it can hurt...

ghost commented 5 years ago

I look forward to an official developer response.

All I can say is I have been using this fine, on Windows, for a while now, and have not had any issues with home pages changing, toolbars being added, or any other form of marketing at all. Not even in the software itself.

JJRcop commented 5 years ago

Did you install this from the releases page? https://github.com/MrS0m30n3/youtube-dl-gui/releases

Downloadig and installing Youtubedlg from other places might result in tainted or tampered with installers.

SorrySoSorry commented 5 years ago

I checked my archives and found no change in these files since last year at least .

bernd-wechner commented 5 years ago

For what it's worth, I just gave clipgrab a spin on Vimeo and was impressed:

https://clipgrab.org/

I've used NomNom in past too:

http://nomnom.sourceforge.net/

so there seems to be some pretty stiff general competition in this space if you're worried about any one app containing malware. But then to be honest, jump over Linux and your malware risks drop by an order of magnitude at least.

nodiscc commented 5 years ago

No reply from @morphological , closing.