My Vivaldi has a virus

nomadic

@vincej1 The notifications are labeled as coming from Vivaldi, right?

You can safely hit the Unregister button on all of the service workers. Sites that need them will reregister them the next time you visit them. Although, I would skip any that start with chrome-extension:// as those are the background scripts for your extensions.

The notifications could also be coming from a bad extension. Did you recently add any new extensions?

ingolftopf

@vincej1
How long did the scan take?

ingolftopf

@vincej1
Please find a second "Deep Scan" for Apple.

ingolftopf

@vincej1
I would be even more sceptical.

ingolftopf

@vincej1
Anyone who has gone to the trouble of writing a virus for Apple may have other tricks built in.

Was there anything conspicuous about the page or the MP3 in retrospect?

ingolftopf

@vincej1
A good 'deep scan' will take quite a while, depending on how much is on your computer.

vincej1

@ingolftopf I turned notifications back on and got 6 notifications from this url with a great big long string on the end of it.:

https://app2.mackeeperaff.com/

It looks like a legit website, but hundreds of other people have complained about the same thing.

nomadic

@vincej1 Are the notifications coming from Vivaldi? A screenshot of one of the notifications might help.

ingolftopf

@vincej1
—> @nomadic ^^

TbGbe · Win: Snapshot Vivaldi 7.4.3670.3

@vincej1 You may not need these any more, but just in case

https://malwaretips.com/blogs/remove-boustahe-com/

https://macsecurity.net/view/252-mackeeper-popup-virus

vincej1

@nomadic It looks like I have solved my problem. In the end all I did was read through this doc: How to uninstall MacKeeper

https://www.macworld.com/article/224718/how-to-uninstall-mackeeper-from-your-mac.html

I think the thing that did it was a complete deletion of all things from Vivaldi yesterday, using shift command delete.

Many Thanks for everyone's suggestions!

Pathduck

@vincej1 Good

I think you can relax about your PC or Vivaldi being "infected". Most likely you inadvertently allowed push notifications from some site. Many sites will trick you into pressing Allow on these, say to allow a download you "must" allow notifications. And most users have no idea what they are allowing.

These things are a plague of the modern web, constantly bombarding users who have no idea where these "popups" are coming from.

The usual method for disallowing them is to visit whatever site you originally allowed them, and remove the permission. But again, that's not always obvious. One can find what sites have been allowed in the internal page chrome://settings/content/notifications but that's not easily accessible in Vivaldi for most users. Not that easy to find in other browsers for that matter, hence all the guides on "how to remove" out there.

Your act of deleting browser data, including "Site Settings" would have cleaned it up.

Luckily in Vivaldi there's a simple way to block these things permanently. Just go to Settings > Privacy & Security, and under Default Permissions set Notifications to "Block".

This way you will never again be asked to allow these on any site. If for some reason you should want notifications from some site, it can be allowed for this specific site.

I have never heard about anyone getting a "virus" from playing an MP3 file, so you can relax on that as well. In theory it's possible, but in practice it's just not feasible for various reasons.

And a good thing - if one could get infected from downloading MP3s, I would be in serious trouble

vincej1

@Pathduck Many Thanks for the very useful email and your great advice.

Nope - I wasn't surfing for porn, I am studying jazz and I really was trying to rip a MP3 off a youtube site.

the cool jazz site: https://www.youtube.com/watch?v=vvOwLleEiKM

Here is the offending site that got me to magically add MacKeeper.

https://y2bs.com

I will follow you advice, and I hope this thread helps someone else,

Cheers Vince

//modedit - removed auto-link to possibly illegal/malicious site

OakdaleFTL

@vincej1 said in My Vivaldi has a virus:

I hope this thread helps someone else,

It already has! I've never allowed notifications from a website (via the drop-down request window) and, so, had not experienced any problems like those you reported... But either through inattention or forgetfulness I was unaware of the preference @Pathduck noted above.
No longer will my browsing be interrupted by my having to dismiss requests to allow notifications! Yay!

Pathduck

@vincej1 No worries!

Yeah I got that you were downloading YT videos for music. Which is something a lot of people find a need for - hence the many many shady sites offering to do so. Honestly, these sites are all terrible and chock-full of ads and possible malware if you get redirected to some other sites.

I'm not sure of the legality of such sites, they operate in a kind of grey-zone. YouTube frowns on downloaders and it's probably breaking their Terms of Use, but there's not a lot they can do about it currently.

My recommendation is to get a tool for this. There's an excellent command-line tool called YT-DLP that I use all the time. But there's a bit of learning curve naturally.
https://github.com/yt-dlp/yt-dlp#readme
(look under Releases for MacOS)

So if I wanted to download just the audio I would do:
yt-dlp.exe -x https://www.youtube.com/watch?v=vvOwLleEiKM
This downloads the video and extracts the audio in OPUS format.

I could convert to mp3 (but OPUS is a great audio format).
yt-dlp.exe -x --audio-format mp3 https://www.youtube.com/watch?v=vvOwLleEiKM

The converting/extraction also requires ffmpeg on your path so that's another thing to learn.

A better/easier alternative might be a GUI tool. There's several for Windows, for MacOS a quick search found a couple, but you'd need to test:
https://github.com/section83/MacYTDL
https://jely2002.github.io/youtube-dl-gui/
https://stacher.io

Most of these are on GitHub - it's generally considered safe to download executables from GitHub as they are open-source projects. The Stacher thing I'm not so sure about, they say it's open-source, but can't find any actual source...

Oh and BTW that's a really sweet slow swing track

vincej1

@Pathduck Thanks for the great advice.