2

After a very recent install-from-scratch of Mojave, I was installing a Safari extension and noticed one already there called "Download Video".

Unexpected extension in Safari

It claims to be version 1.0.0 and that it "Downloads video from a webpage". It was not active (i.e. its box in the Extensions manager was unchecked) but I've no idea how it got there. I certainly didn't knowingly do it myself

I did notice one other inactive extension -- "Open in Internet Explorer" -- that I also did not explicitly install myself. However, it says it came as part of Parallels Desktop and I did install that. So that leads me to conclude that the installation of certain apps may also involve installation of Safari extensions. And I certainly have installed some apps since after my clean Mojave install, so maybe the Download Video thing piggy-backed in off one of those? But most of what I've installed is fairly well-known, standard stuff -- MS Office, Emacs, and the like. Nothing I'd expect to have a sneaky video downloader hanging off it.

Any idea where in could have come from?

Safari 12.0.2
Mojave 10.14.2
MacBook Pro (Retina, 15-inch, Mid 2015)

2

If I had to guess on what this was there would be two things that I would guess that it might be:

Adware

  • You might have accidentally installed a package somewhere that installed this as an option in the installer, and this would install adware that could change your default search browser. The person who made the extension might have messed up and not made it so that it didn't activate it.

Real youtube downloader

  • At one point you might have installed a browser extension if you wanted to download a youtube video. These are everywhere and since youtube does not have a built in free system to download the videos officially, there are a ton of different 3rd party plugins that people have developed and this might be one. If you can remember that you installed it then you shouldn't worry.

Either way, I would uninstall it if you don't use it anymore as it could be anything

  • Oh! Well it just happens that the extension I was installing when I spotted "Download Video" was AdBlockPlus. Could that be the "culprit" – tkp Dec 18 '18 at 3:52
  • I doubt that AdBlockPlus is the culprit because it is a trusted extension but it probably made you look in the extensions settings. – James Singhal Dec 18 '18 at 4:38
  • Another possibility. Yes, at one point in the past I had been looking at YouTube download options, and so it's possible I did install one back then. But, that was a while ago and certainly prior to my install-from-scratch of Mojave, so at first thought I had excluded that as a possibility. HOWEVER, I'm now wondering exactly what iCloud now allows to persist through OS installs, even instals-from-scratch. If Safari extensions are subject to iCloud backup, then I guess it's possible that I'm seeing that old extension still hanging on in there, despite my from-scratch install. Sound plausible? – tkp Dec 18 '18 at 18:06
  • James, you were right. It got installed along with a bunch of other widgets as part of Parallels Toolbox. I've described the details in my own answer. Thanks for the pointers. – tkp Dec 19 '18 at 3:47
0

Turns out, as per commented suggestion by James Singhal, it's a browser extension associated with a component of Parallels Toolbox. Details are here. So overall not the sneaky malware I wondered that it might be.

Now I can't be 100% sure that I wasn't asked a generic "do you want us to install browser extensions" question when Toolbox was being installed (even it was a mere side effect of the thing I actually was consciously installing -- Parallels Desktop itself), but I'm 99% sure of it. So for that I guess I'll grant Parallels one slap on the wrist. These malware-fraught days, they really should know better than to drive-by install a piece of software -- without even a sign of provenance -- even if they at least had the grace not to activate it.

Anyway, back down to DEFCON 5. As you were.

P.S. FWIW, I figured this out by trying to uninstall the thing. I was told I'd have to do that by uninstalling its associated app, and when I accepted the offer to see where that app was in Finder, it was revealed that it was in the Parallel Toolbox.app package. A quick Google led me to the emails pointed to by the above link.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .