Users of version 0.10.5 and earlier who used the built-in updater and all users who downloaded the program manually during those five days might be affected, so they should check their systems.Īccording to an analysis by Patrick Wardle, director of security research at Synack, the trojanized version of HandBrake distributed from the compromised mirror contained a new version of the Proton malware for macOS. as well as saved login credentials for your web browsers.Users of HandBrake 1.0 and later who upgraded to version 1.0.7 through the program's built-in update mechanism shouldn't be affected, because the updater verifies the program's digital signature and wouldn't have accepted the malicious file. For Firefox, you'll find them by navigating to about:preferences#security clicking Saved Logins.

In Chrome, navigate to chrome://settings/passwords to see them. To view those stored by Safari, click on Safari in the menu bar, select Preferences and click Passwords. You'll need to do the same for all the passwords saved by your web browsers. Change the passwords on every account listed, as the Proton RAT had access to your Keychain. Open Keychain from the aforementioned Utilities folder to view your stored passwords. Then command-click the recycling bin icon, and select Empty Trash. Scroll down to the bottom of the results and click 'See all results.' In the subsequent window, look for all instances of the Handbrake app, and delete each. Then, hit Command+Space to open Spotlight search and type 'handbrake.app' in. Rm -rf ~/Library/VideoFrameworks/proton.zip

(HandBrake recommends deleting the entire VideoFrameworks folder, but we're not sure whether that's a good idea.) If one of those files is named proton.zip, then copy and paste the following text string into Terminal, and hit Return to remove the file. The last command lists the files in a certain directory. Rm -rf ~/Library/RenderFiles/activity_agent.app Launchctl unload ~/Library/LaunchAgents/fr.handbrake.activity_ist (If the Terminal says you're not authorized, then type 'sudo' before the first command and log in using the password of a user authorized to install and delete software on the Mac.) Open the Terminal application (also found in the Utilities folder) and then copy and paste each of the following commands in (without the quotation marks), hitting Return after each. If you see a listed process named 'Activity_agent', we're sorry, you're infected. How to tell if you're infected, and what to doįirst, open the Activity Monitor app on your Mac, which is stored in the Utilities folder of the Applications directory.

Handbrake app for mac