1

So I downloaded a torrent of Apple Final Cut Pro.

There was a quick pop of either Terminal or Green looking terminal. The said application (green Terminal) opened and close, opened and close, and so on for a short period of time. It looked fishy so I didn't know whether it's a virus or not.

Can someone help me. Am I safe? Should I factory reset?

Improve this question
3
  • 7
    I upvoted this question because I think others should see this and it should serve as a warning to others. NEVER, NEVER, NEVER pirate software. Besides being both illegal and unethical you open yourself up to malware. Google "ransomware" and see how people are having their data held hostage.
    – Allan
    Commented Mar 28, 2016 at 13:22
  • 1
    The question is unclear. When did the (green) Terminal window appear? After opening/installing FinalCut Pro or while downloading? Which torrent client do you use? Did you have to enter an admin password at some point of time?
    – klanomath
    Commented Mar 28, 2016 at 14:17
  • When I first open the Final Cut Pro, the terminal window appeared. The downloading process was normal. Luckily I just reseted my Mac a last week, no information was on it.
    – 31i45
    Commented Mar 28, 2016 at 14:21

3 Answers 3

Reset to default
9

You are not safe. Your personal documents, contacts, and private information are at risk.

The behaviour you are seeing is not part of Apple's Final Cut Pro. The odd terminal like behaviour suggests you do have a rogue process or application on your Mac.

Search for a guide about how to remove malware and viruses from your Mac.

Improve this answer
2

The same behavior happened to me even though it was a validly signed copy of Final Cut Pro.

Run spctl on the app using spctl --assess --verbose /path/to/app in Terminal. If it outputs "Mac App Store", you are safe, because the file hasn't been tampered with.

Improve this answer
1

Downloading a torrent is never a good move. It's highly likely your computer's been compromised. Here are some steps to take (in listed order) to take cautionary action.

  1. Delete the torrent and all of its files from your computer.
  2. Put up a firewall by going to System Preferences > Security and Privacy > Firewall > Turn On Firewall (you may have to get access with an administrator username and password).
  3. Enable FileVault, which encrypts your hard drive, by navigating to System Preferences > Security and Privacy > FileVault. Again, administrator keys may be required. Be sure to remember the password you use to encrypt the disk.
  4. If your computer is actively being jeopardized, a factory reset is in order. Follow this guide to restore your computer. You'll need your FileVault password, and administrator keys.
Improve this answer
8
  • Is it safe to plug in my passport (storage device) with my yesterday time machine backup and reset it back to that day?
    – 31i45
    Commented Mar 28, 2016 at 14:13
  • 4
    @31i45, I'd say NO, do not attach anything while the system is actively infected and your should have disconnected from the Internet immediately when the issue occurred. You should reboot the system to Recovery HD and wipe the drive and reinstall OS X, then restore your user data from Time Machine.
    – user3439894
    Commented Mar 28, 2016 at 14:18
  • 2
    @ Angelplayer, I have to disagree with your order of steps to take. There is no way I'd ever start an encryption process on a system that may be compromised by a virus or malware! 1. Disconnect immediately from the Internet before shutting down the system. 2. Reboot to Recovery HD, or better yet an OS X USB Installer created on a known good uninfected working system, wipe the HDD and reinstall OS X. Then if you want to encrypt the drive, okay.
    – user3439894
    Commented Mar 28, 2016 at 14:21
  • I'm not that worry about information being taken out, as my computer, reseted last week, has no information in it. All I want is to restore back to yesterday state.
    – 31i45
    Commented Mar 28, 2016 at 14:23
  • 2
    Point 2 and 3 are not recommended/not helpful. Point 2 should be modified to "Disconnect from internet completely". Enabling the firewall doesn't help for outgoing calls. Enabling FileVault doesn't help much either because the content is available in the user context (= any rogue process runs in the same context!) even if the whole disk is encrypted.
    – klanomath
    Commented Mar 28, 2016 at 14:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .