OpenOffice.org virus warning

Discuss setup / installation issues - Add a spell checker, Language pack?

OpenOffice.org virus warning

Postby tony73 » Tue Jan 27, 2009 9:07 pm

Warning to openoffice product seekers for the following site.

Free Download Office™
New version in English for you
Free Download OpenOffice now
Openoffice.pro/free-download <which then forwards you to openoffice.pro/CA

Thanks to ADVAST for picking up on this threat
Whats worse is that this was a GoogleAD! Sponsored Links by GOOGLE ADSENCE!

Search term "openoffice" via google.com appears on the first page! via sponsored google ad!
OOo 3.0.X on MS Windows Vista + Windows Vista 64 Bit
tony73
 
Posts: 17
Joined: Fri Jan 16, 2009 9:15 pm

Re: openoffice virus warning

Postby thomasjk » Tue Jan 27, 2009 10:10 pm

Always download from www.openoffice.org the official site.
Tom K.
Windows 7 Home Premium
LibreOffice 4.2.3.3
thomasjk
Moderator
 
Posts: 3599
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: openoffice virus warning

Postby Villeroy » Tue Jan 27, 2009 10:10 pm

The name of the software is "OpenOffice.org" and it's also the domain where you get the latest release for all operating systems.
On the same site you find the license, the source code, release notes, product information, system requirements, manuals, links to extensions, templates, localization packages, spell check dictionalies, older versions, a software development kit and so much more.

As a Windows user you need an extra tool to verify what you downloaded. The tool is linked on openoffice.org as well ...
http://www.openoffice.org/dev_docs/using_md5sums.html
http://download.openoffice.org/3.0.1/md5sums.html

It's an open source software developed, distributed and maintained on the internet. The internet is still a free place. It's up to you if you lookup the right thing by the right name and do the right thing with what you download.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 12.04, Apache OpenOffice 4.x
User avatar
Villeroy
Volunteer
 
Posts: 17273
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: openoffice virus warning

Postby tony73 » Tue Jan 27, 2009 10:51 pm

Im not sure if openoffice runs any googleads via google adsence, but you would think google would offer some sort of protection on their
add networks to provide sole rights to ads featuring the term "openoffice" strictly for openoffice approved vendors only.

If there is a fake add promoting openoffice.org products which ends up infecting ones pc with a virus , i believe it is the responsibly of google
to insure adds running on google adsence are free from harmful ads.

Don't you have to be approved to run ads on google adsence?
And shouldn't ads that run on their network, Like "Openoffice Products or Microsoft Products" be verified that they are legit products by the vendors.
OOo 3.0.X on MS Windows Vista + Windows Vista 64 Bit
tony73
 
Posts: 17
Joined: Fri Jan 16, 2009 9:15 pm

Re: OpenOffice virus warning

Postby Villeroy » Tue Jan 27, 2009 11:12 pm

Again, there is no software named "OpenOffice" nor " Open Office". That name is claimed by a Dutch company. They don't do anything against scammers using the name. Scammers pay Google for page ranks. Simply train yourself to ignore all google-ads (and advertising in general).
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 12.04, Apache OpenOffice 4.x
User avatar
Villeroy
Volunteer
 
Posts: 17273
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: OpenOffice virus warning

Postby acknak » Wed Jan 28, 2009 12:53 am

We really need to be a little more careful: it is possible for a site other than OO.org to legitimately offer the software for download. As far as I can see, the download link on the site referred to in this thread (openoffice.pro/CA) actually points to the OO.org download site. The download did not ask for any registration or payment, and the file that I downloaded matches the md5sum posted on the OO.org download site, so it seems highly unlikely to me that the file actually contains any virus. It has been known that antivirus products can give false positive alerts.

The best policy is to get the software directly through the OO.org site, but raising a false alarm is not a good thing either, in that we now have (apparently) false information on a public forum.
AOO 4 • Linux • Fedora 17
User avatar
acknak
Moderator
 
Posts: 17399
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: OpenOffice virus warning

Postby tony73 » Wed Jan 28, 2009 1:43 am

acknak wrote:We really need to be a little more careful: it is possible for a site other than OO.org to legitimately offer the software for download. As far as I can see, the download link on the site referred to in this thread (openoffice.pro/CA) actually points to the OO.org download site. The download did not ask for any registration or payment, and the file that I downloaded matches the md5sum posted on the OO.org download site, so it seems highly unlikely to me that the file actually contains any virus. It has been known that antivirus products can give false positive alerts.

The best policy is to get the software directly through the OO.org site, but raising a false alarm is not a good thing either, in that we now have (apparently) false information on a public forum.


If you updated your Avast, you should obtain the same results.
Here after a google search, you are redirected to the URL show'n in the firefox browser, followed by the warning message from AVAST..
screen image below...
Image
<a href="http://www.mediafire.com/imageview.php?quickkey=qjmcmtnjcjy&thumb=5" target="_blank"><img src="http://www.mediafire.com/imgbnc.php/98b5f82806187436e2ef85199f86896b4g.jpg" border="0" alt="Unlimited Free Image and File Hosting at MediaFire"></a>
OOo 3.0.X on MS Windows Vista + Windows Vista 64 Bit
tony73
 
Posts: 17
Joined: Fri Jan 16, 2009 9:15 pm

Re: OpenOffice virus warning

Postby tony73 » Wed Jan 28, 2009 1:46 am

if the above image does not load, try refreshing that page, should display on the second if not third try, weird.
OOo 3.0.X on MS Windows Vista + Windows Vista 64 Bit
tony73
 
Posts: 17
Joined: Fri Jan 16, 2009 9:15 pm

Re: OpenOffice virus warning

Postby Hagar Delest » Wed Jan 28, 2009 10:14 am

Your pic still doesn't show (it does only if you're the uploader sometimes IIRC). Please save as .png (or .jpg if still too big) and upload it here, it won't disappear in the future if the pic is removed from the file sharing web site. See: How to attach a document here.
AOO 4.0.1 on Windows 7 and Xubuntu 13.10 (Saucy Salamander)
User avatar
Hagar Delest
Moderator
 
Posts: 25087
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OpenOffice virus warning

Postby acknak » Wed Jan 28, 2009 6:36 pm

Sorry, I don't mean to make a big deal out of this; it's certainly valid and worthwhile to raise a question if you find a site that you think may be malicious.

But just because a virus scanner says there's a problem does not mean that there is actually a problem. The scanner may report that something contains a virus when, in fact, it does not.

If the md5sum of the downloaded package is the same as the sum published by OO.org, you can be reasonably sure that you have the same exact bits that OO.org packaged, which had better be virus-free.

If you have a downloaded package that has a different md5sum, then it is not the same as what OO.org packaged and the virus scanner results carry more weight.

So I'm not questioning whether the scanner reports a virus or not; I believe you when you say that it does. But more important is the name, file size and md5sum of the package that you downloaded. The exact URL that you downloaded it from would also be helpful.
AOO 4 • Linux • Fedora 17
User avatar
acknak
Moderator
 
Posts: 17399
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: OpenOffice virus warning

Postby ChaseEasy » Sun Feb 22, 2009 7:00 pm

Warning to openoffice.org, Open Office users!

As of yesterday, my system has been compromised and I've sourced it back to Java and Open Office. As usual I updated my Java when prompted by the auto updater. Pretty sure the update was not a legit Java update and it was somehow made to look like a legit Java update provoked by Open Office.. not really sure. I had an application called softbin, running under openoffice which would try to use iexplorer, launching it and trying to connect. I don't use iexplorer... First thing it tried to disable my windows firwall. Tried to uninstall iexplorer and it would not let me delete, kept telling me an application was using the file, which was tracked back to softbin. I could not delete my connection wizard either, had to stop all processes related to these files before I could delete them... having some serious issues! Also had another Admin account appear.. all in the last day.

This is a pretty good one.. whatever it is, a full thorough archive deep virus scan last night did not pick up any virus, using Avast. Say I'm paranoid.. but creating a login for this site is giving someone?? lots of info about operating system.. OpenOffice version.. email.. passwords, (hope no one uses the same login/email passes for message forums) Should you be infected and not know it, you have essentially given someone some valuable compromising information, maybe the pass is not the same but they can compile your information with your email, and cross reference with any website you may have visited or registered to with the same email address.

For now I'm shutting down my java.. and open office, hoping the issues will be addressed. It's too bad so many web apps require java framework installed, but I don't ever want to go that deep into my system to remove apps.. exe's etc.. which launch on their own.. I'm sure this isn't over!!

ChaseEasy
OOo 2.4.X on Linux-Other
ChaseEasy
 
Posts: 1
Joined: Sun Feb 22, 2009 6:32 pm

Re: OpenOffice virus warning

Postby Hagar Delest » Sun Feb 22, 2009 11:07 pm

I don't understand anything about what you've written. You run Windows but your profile shows Linux-other.

Why should the java update be non legit? What's the link with the forum login and so on?

Before claiming such alarms, you should get some information. Before you point to an official virus report, this is just nonsense.
AOO 4.0.1 on Windows 7 and Xubuntu 13.10 (Saucy Salamander)
User avatar
Hagar Delest
Moderator
 
Posts: 25087
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OpenOffice virus warning

Postby wkevinwildermuth » Fri Mar 26, 2010 7:30 am

Does this work?

I have uninstalled and reinstalled Open Office from openoffice.org 3 times in the last 2 days. Open Office works for about 2 hours, or until I close and reload it. I think this kicks off a queue to download from teh website and will immediately get me errors. Vipre Antivirus keep telling me that the files:

C:\Program Files\OpenOffice.org 3\program\formi.dll
C:\Program Files\OpenOffice.org 3\program\dnd.dll

Are known bad.

Vipre blocks attempts by C:\Windows\System32\svchost.exe to access these known bad files. At this point, I have to reinstall Open Office, as the files are cleaned to disable the virus.

I have this post marked for replies, if anyone has any ideas.
Attachments
OpenOffice2.jpg
Details on the one
OpenOffice1.jpg
Details on the other
OpenOffice3.jpg
My Daily scan.
OpenOffice version 3x on Windows XP SP 3 and Vista
wkevinwildermuth
 
Posts: 1
Joined: Fri Mar 26, 2010 7:16 am

Re: OpenOffice virus warning

Postby Hagar Delest » Fri Mar 26, 2010 9:02 am

Vipre is known to warn about false positives, see that query.
AOO 4.0.1 on Windows 7 and Xubuntu 13.10 (Saucy Salamander)
User avatar
Hagar Delest
Moderator
 
Posts: 25087
Joined: Sun Oct 07, 2007 9:07 pm
Location: France


Return to Install, Setup and Troubleshooting

Who is online

Users browsing this forum: No registered users and 11 guests