(Fixed) It seems there is virus in official download

[fsymkin52]

Hello. I downloaded smplayer for windows from http://smplayer.sourceforge.net/ru/downloads. After install I've got the "sweet page" virus (start pages of all browsers has been changed to "sweet page" (commercial website), and all windows shortcuts to browsers (IE, firefox, chrome) has been changed to "<browser-path> sweet_page_url"). I checked my system by Malwarebytes anti-malware, and file ...\Downloads\smplayer-14.9.0-x64.exe was marked as infected.

line from anti-malware log:
PUP.Optional.FriedCookie, ...\Downloads\smplayer-14.9.0-x64.exe, Quarantined, [008e16d7502b77bf25de4138c53f2ed2],

I downloaded smplayer using firefox 32.0.1.

[rvm]

That is caused by the sourceforge wrapper. You can get the original installer by adding ?nowrap to the URL:



You can also use the fosshub mirror:
http://www.fosshub.com/SMPlayer.html

[brittney24]

Wow. You mean Sourceforge is actually hijacking browser start pages? (at least in the SMPlayer installer).
RVM - What's your opinion of that?

I normally use portable versions. Does the installer setup dialog make it clear they are going to change your start page?
In the setup, Is the action to change start page enabled by default, or is it opt out?

I haven't witnessed this myself (don't use the installers), so can't comment too much.
But if they're not making what they're about to do absolutely clear, with a clear, easy way to avoid it, then that's the kind of thing that drives users away.

No offense, but putting a reply in a forum post (that most users won't see), with instructions how to avoid the browser hijacking Sourceforge wrapper isn't really sufficient to warn users.

If it's actually true, this is the sort of thing that drove millions away from downloading from CNET. Sure, "there's a sucker born every minute."
But I wouldn't think SMPlayer would want this type of bad publicity.

[rvm]

The sourceforge wrapper offers the user to install two applications before (or while) downloading the smplayer actual installer. It provides info about the software that is offered, and if it would change something in the web browser it informs about it. The information texts are localized (in my case they are in spanish). The user can reject to install the offer by clicking the decline button.

[realnc]

AFAIK, projects need to opt-in to this. Did you opt-in to allow sourceforge to replace your smplayer downloads with malware installers? My own sourceforge project for example works just fine, and people get my original files when they download.

If this is opt-in, you might want to reconsider if it's worth it getting paid in order to trick inexperienced users who don't know much about computers into installing malware on their systems.

[rvm]

Yes, it's necessary to opt-in

There are many download sites (like softonic) which also have their own installer with offers. They earn a lot of money by distributing software created by other people. The developers get nothing. At least sourceforge shares the revenue with the authors of the software. It's not much, but helps to pay the bills.

By the way, it seems sourceforge has fixed the problem with their installer:
https://sourceforge.net/p/forge/site-support/8548/