[Solved] Malware in download from Apache Project?

[technicavolous]

I recently bragged how great OO is, and has been for me for many years. I downloaded for a client OO from the Apache Project web site, and installed to a clients machine.

It was humiliating - a perfectly working install of Windows 7 was completely destroyed by malware contained in the download. Several search engine hijacks, one hostage-ware demanding money to remove it, and something called "Rocket" that hijacked Chrome.

Needless to say I lost the client after FFRing the windows install.

Has anyone else seen this? Are there instructions on how to avoid this, as it comes packaged in what one believes to be 'safe' to install. Is the Apache Project site the wrong place to download?

It's incredible FUD for me right now, Ive started to use LibreOffice until I figure this out.

Help?

[acknak]

Welcome to the community forum. Sorry to hear of this problem--it's really, really awful.

The problem is that there are lots of scam sites that look official, and will install OO, but they are in fact scam sites which install all kinds of nasty malware along with OO. These sites are very slick--some are more professional-looking than the official OO site--and they fool a lot of people, even people who should know to be more careful.

These sites have nothing to do with OO; the download absolutely did not come from the official OO site.

My guess is that you did a web search for open office and clicked on the top hit. Somehow, the scam sites manage to appear at the top of a web search in some situations, and it fools lots of people.

Or, if the system is already compromised from some other source, it may hijack the browser or the search page to lead you to the wrong site.

The only official site is: http://www.openoffice.org

Edit: PS:

If you have a way to check the download history and can find the exact address the download came from, it can be reported to go on a blacklist.

[magooch]

I just did (7/7/2014) try to download Open Office from the "official site" and Norton shut it down. I had previously downloaded it from the same site about two weeks ago and it came complete with "Rocket Search" and "Speedial". Fortunately, I didn't complete the installation. However, the hijackers managed to inflict themselves on my browsers. Again, fortunately, I was advised to get Malwarebytes to get rid of that crap. It did the job, but just for good measure I tossed the Apache Open Office.

I have Open Office on two other computers and am reasonably happy with it--especially the older 4.0. The newer version (4.1) works fine on a different computer except that the spellchecker does not work. I tried everything that was advised to fix it and nothing worked. I will not update to the new version on the computer that has the 4.0--if it ain't broke, don't fix it.

Okay, back to the issue at hand. Either I am being fooled by the official http://www.openoffice.org site, or Norton is full of crap. I actually took a chance on downloading the program, because I thought I could save it instead of run it and hopefully have Malwarebytes check it before installing it--if that is possible. I actually tried to install the older version from a flash drive on the computer with the newer version, but it wouldn't install without an OO installer. There might be a way to do it without the installer, but I don't know how. So what to do?

I very much would like to install the newest version on this new 8.1 computer, but Norton says no. Obviously I'm not about to second guess Norton.

[magooch]

I just clicked on the download icon at the bottom of this forum page and it is the very same site that Norton refused to allow the download from. And I am reasonably sure that it is the same site that I used about two weeks ago and got infected from. Something is wrong somewhere.

[magooch]

So what happened? I tried one more time this morning just to see what would happen. I Googled Open Office just like every time before, selected the "official site" and wonder of wonders, the download went off without a hitch. Even Norton approved. I've even created my first document and couldn't be more pleased; the spellchecker works perfect. I'm a happy man. Thank you so much Open Office, Apache, Source Group, or Group Source.

[acknak]

I'm sure you're aware of this but the first hit in a Google search is NOT always the official site. Googling for product web sites is a risky strategy.

[WhiteHawkUK]

I am only posting here as creating a duplicate/related topic elsewhere on the forum doesn't seem... efficient.

I would like to confirm for fellow users (and anyone concerned) that the sponsored links on Google results pages lead to unofficial installers that package OO with a large amount of dubious software. Sponsored links include "Apache OpenOffice Free - Full Version. No Trials" (openoffice.free-download-now_dotcom), "Apache OpenOffice Free - Safe & Easy Install" (openoffice.soft-now_dotcom), and "Open Office 2014 Download" (open-office.free-office_dotorg). DON'T TOUCH THESE!! The wary should be alerted by the language and the URL structure, but we can all make mistakes.

I never see the sponsored ads in Google on my own computer, so while installing this on a friend's personal machine (without an ad-blocker), a momentary lapse in concentration saw me finally fall for this today... at least until halfway through the litany of license agreements when my mental alarms started going off.

The first dialogue of this particular installer prompts you to accept a license agreement (that cannot be skipped) for the installation of 'Rocket Browser' - this dialogue deliberately obfuscates its purpose (the text actually identifying the installation as something other than OO is tiny, and all other identifying markers simply state "Open Office Installer"). It then proceeds to prompt for agreement to the software license for several other packages (which can be skipped), and the final 'progress' dialogue (which downloads and installs these packages without further ado) continuing to identify itself as "Open Office Installer".

It's disgusting - patently deceitful, and arguably dubious, even malicious - but I think it also highlights just how popular and successful Open Office is that it has become a target for such machinations. What can you do but keep your guard up and always source your installer from a trusted site (such OO's own official one)? Apache can't police the internet after all, and Google hasn't made much of a show of caring one way or the other about the veracity of sponsored links so long as they get their pound of ad-related revenue. It's up to the end user, ultimately, to ensure the safety of the data they download - best to be well informed in order to avoid the pitfalls.

Just my tuppence. Professionally (and personally), I'm supposed to know these things... but even I can get caught out when my guard is down. :/

[moorek]

I followed the update link from within Open Office, which brought me to the official website. Chrome flagged the download as malicious and will not let me complete the download. I am hesitant to try downloading with IE. Would like to update to newest version.

[thomasjk]

I just downloaded the latest version with Chrome from http://www.openoffice.org/download/. The download was not flagged as malicious. The linked site and resulting redirect to Sourceforge is malware free. Try IE or Firefox both will work.

[Bill]

I followed the update link from within Open Office, which brought me to the official website. Chrome flagged the download as malicious and will not let me complete the download. I am hesitant to try downloading with IE. Would like to update to newest version.

What does "flagged the download as malicious" actually mean? Please post the message.

[RoryOF]

If one is in any doubt about the integrity of a download from
http://www.openoffice.org/download
either that it is complete or to ensure it is clear of viruses/malware, one can check the MD5Sum, which will verify that the file is as it left the code factory.
Details are given in
http://www.openoffice.org/download/checksums.html

Note that the above download URL will redirect to SourceForge servers where the files are stored; this is correct.

[moorek]

I tried to download again, and this time it downloaded with no problem. What I remember is that after the download icon (Chrome) was green all the way around, the entire tab in the status bar turned red and said that this was a malicious download. This time, it performed just as I originally expected. Gmail has put the following message in a gold bar across the e-mail: "This message may not have been sent by: aoo.forum.en@gmail.com".

Could it be that because of the earlier reported malware problem Google has OpenOffice in the database of potential problems?
Again, the download worked fine this time with no flag on the play. Sorry to have been precipitous; I will set a restore point before installing, however.

Thanks for the link to the source of the official files.

[RoryOF]

I would strongly advise checking its MD5Sum. The MD5Sum for all OO files of the same name ought be the same, so you can download the MD5Sum from the OO site and check your download.

[B Marcelly]

For your information,
Apache OpenOffice uses SourceForge as storage and redirects to it.
Since 2013 SourceForge has decided to display ads in its web pages.

The problem is that among these ads, one was a malicious download of an altered version of OpenOffice.
A cautious internet user who uses an ad-blocker will not even see these ads.
An ordinary user could see this advertisement and clicked it thinking it was the real OpenOffice (SourceForge delays the download 5 seconds so the user can see and click ads).

Further information in Issue 125872 (containing screenshots) and in this initial thread and this thread of the dev mailing list.

I have verified today that the infamous ad does not appear anymore.

[moorek]

I misremembered what the malicious message was. I found it again when I tried to download File Checksum Tool via the links above. The tab in the status bar has a red circle with a horizontal white bar in it, the message "This file is malicious, and Chrome has blocked it." in the center, and a white button that says Dismiss on the right hand side.

[B Marcelly]

With its advertising, SourceForge has become a mousetrap.
When you search SourceForge for an application it displays at top related advertisings found by Google.

Here I have searched : File Checksum Tool

Results of search in sourceforge

Circled in red, you see the Google-found ads. They are related but chosen at random.
Here the first provides the terrible "ask" toolbar that is notoriously difficult to uninstall.
Circled in green is what you really should look for.

By the way, it does not display a very good freeware (I use it) : HashMyFiles. Because it is not in SourceForge. It is simple and efficient, offered for free without any advertisement.

Second example, the search for : ftp
In the search results you find at 7th position the freeware FileZilla. That is a good and simple ftp server and client.
Click it, you get the description of FileZilla in SourceForge.

FileZilla description

Now click on the Download link in the green rectangle...
Sometimes Google will display you a related ad that is very similar to what you are looking for.

Not FileZilla

If you click the green rectangle you are redirected to another product (cerberus).
Now you understand why The Gimp removed its download from SourceForge.

[without_word]

I'm now having this problem.

I downloaded the file from openoffice.org by clicking "download full installation"



and was redirected to sourceforge.net where the download began automatically after 5 seconds



After the download Chrome gave me this message:

"Apache_OpenOffice_4.1.1_Win_x86_install_en-US.exe is malicious, and Chrome has blocked it"




I am in need of a word processing program. What to do? I'm a bit worried about overriding the safety protocol.

Thanks for any suggestions.

[thomasjk]

This is a false report from Chrome. I tired this download using Chrome and did not receive any message at all. Please read all the posts above to understand what has happened to others.

[without_word]

Thanks,

I downloaded it again with IE and everything seems fine. I suppose somebody needs to inform Google of the mistake.

[RusselB]

I did that a month ago.. and actually got a message from them saying "Thanks. This situation will be looked into."
Who knows if, or when, they'll actually do something

[VieEnRas]

I just had the same issue with Chrome blocking the download due to malware. I did manage to do an easy fix that allowed it. When it does the "your download will begin in .... seconds" I clicked on the "Problems with the download? Please use this direct link."

Using the direct link, I managed to download it and Chrome was fine with it.

[vking]

It looks like the error may be limited to certain mirrors. I was also getting "Apache_OpenOffice_4.1.1_Win_x86_install_en-US.exe is malicious, and Chrome has blocked it" regardless of whether I selected Direct Link or not. Instead, I switched to Softlayer (Dallas, TX, US) and Chrome did not block it.

[guest101]

I agree with vking. Chrome blocked the first time, then it was OK when I tried it 5 minutes later.
I rather have Chrome over-protected than nothing. Two days ago, IE did nothing when I downloaded from ".com" instead of ".org" on my wife new laptop. I trusted the Open Office name so much and ignored the malware warning of my anti-virus when I installed it. It took me half day to figured out what was wrong and fixed it (used windows restore). Luckily I had a restore point before I installed it.

[brownkat]

Having the same issue. I visited the official page, selected full download, which went to sourceforge site, and dled from there via the automatic starting download (ie, I didn't click on anything there, so I couldn't have clicked on a link that was a misleading ad). Chrome is blocking it as malware, and tells me it will put a "world of hurt" (or something like that) on my computer if I choose to recover it. Definitely the first time that I've run into this with OO. Think I'm going to stick with Abiword for now... OpenOffice is a great product though, someone on either the OO or Chrome end should really look into this because it's definitely losing OO business!

[RoryOF]

Reports are that the "direct download" link on that same page does not trigger the Chrome warning.

[JamieinATX]

Same thing exactly has been happening to me. I had to get a new laptop and install again and i go to OpenOffice.org & Site and it looks 99% the same. some faded coloring is slightly different I now see; and all other options and info are identical, click download the full installation and this last time, Chrome blocked it (download file was unconfirmed 873583.crdowload).

It was tough to find where to find the real software!

Thanks for the replies. I used the direct link in the post and got it installed!

Jamie

[rlmrdl]

And another with the same problem.

This one started in OO 4.1.0 which indicated that a new version was available. I clicked the linbk in OO dialogue which took me to this URL http://www.openoffice.org/download/?utm ... gn=Upgrade I changed the download to the British English version and clicked the "Download full installation" option which then opened http://sourceforge.net/projects/openoff ... e/download and began the automatic process. Like everyone else I then received the blocked as malicious warning,

Just repeated the procedure and again blocked.

Then tried direct link rather than the automatic process. Same block.

The followed the link above and downloaded the US version (ie, didn't touch any settings) Blocked again.

Still looking for a clean download.

OK, downloaded Firefox and got a complete download of OO. Then scanned with AVG, no threats found. I will be seriously PO'd if it turns out to be a duff

[RusselB]

Hmm.. appears Chrome doesn't like the Great Britain version.
The file downloaded, but then was blocked by Chrome when it tried to run.
I had no problem downloading the US version simultaneously, though I can't guarantee that the same server was used for both downloads.
You could try downloading the US version and then add the Great Britain language pack.

I just tried my suggestion and it went with no problems.

[rlmrdl]

Thanks RusselB but see my edit above. Tried the US version, same problem.

[RusselB]

Well, you can try using a different browser and/or disabling the security settings in whichever browser you decide to use.
Might not be a bad idea to ensure that the browser is up-to-date.
If you're still concerned, you can run a malware scan using Malware Bytes (the malware scanner recommended by most of the helpers on this forum).
I don't know what, if any, anti-virus program you have (hopefully you do have one), but you can scan the downloaded file before it installs.
I, personally, use Avast and it is configured to automatically scan anything that is downloaded.