I have opened a file on https://kickass.so/revenge-s04e14-hdtv-x264-lol-ettv-t10127520.html. I was supposed to click on a torrent file but I clicked on the big DOWNLOAD link.

And I had no idea that I was not supposed to open a dmg file. Anyway, done is done. I opened it, and there was an install file, I double clicked on it. Then I was not asked to do anything, it just directed me to a website.

How do I make sure I do not have a virus or spyware? Running AIR'13 Yosemite. The file name was macfest. The content looks like this: enter image description here

I also used Sophos Anti-virus and it detected OSX/FkCodec-A in the dmg file that I trashed.

  • What was the file name of the DMG, the installer and what was the domain you got directed to? You probably don't have a virus if the installer you opened didn't ask for a password. – John Keates Jan 28 '15 at 19:50
  • Thanks, updated the question. The filename is macfest and the content is shown in the quest. – maccer Jan 28 '15 at 19:57
  • It looks like it will set your homepage and install an extension. Both can be checked from preferences (system preferences and browser-specific preferences). Extensions might also end up in the internet plug-ins directory which resides in the library directory (home and/or system wide). – John Keates Jan 30 '15 at 0:11

About the website you visited should give you some idea what you downloaded.

Here is Feb. 2015 Whois Record showing the site was banned (closed) by the Authorities.

So what ever you downloaded, get rid of it, it can not be trusted.




As long you only downloaded the dmg and not installed it your should be fine by just deleting that dmg package.

  • I also used Sophos Anti-virus and it detected OSX/FkCodec-A in the dmg file that I trashed. – maccer Jan 28 '15 at 22:52
  • 1
    Any half-decent malware/adware/PUP will place files with a different bundle identifier than the original installer, making this worthless…? – grg Feb 1 '15 at 21:27
  • @grgarside I am very grateful for your opinions that are just that, since you were not able to provide a correct answer anyway. – Ruskes Jun 2 '15 at 20:41

You must log in to answer this question.

protected by Community Feb 6 '15 at 5:38

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .