Page 1 of 1

[Solved] Virus downloaded from extensions page

PostPosted: Wed Jun 24, 2020 8:33 am
by NWSailor
If this is the wrong place to post this plaintive post, please suggest a more appropriate place in the OO forums...

I've been using OO for a few years, love it!

However, I was looking to solve a problem (search and replace paragraph breaks) and readabout doing that in this forum:

https://extensions.openoffice.org/en/pr ... -altsearch

a post said that I could install a extension that would do what I need. I think I am pretty careful about what I download and the advice was from the openoffice.org site. So I went where it linked to:

https://extensions.openoffice.org/en/pr ... -altsearch

I downloaded the extension and opened my downloads folder and OMG! Found that another file had downloaded along with the extension file that is named "Unconfirmed 900640.crdownload" This seemed strange. It was downloaded at the exact same minute as the extension, it came right along with it. DAMN! How could this happen from the openoffice.org site? I did a search and it looks like a pretty nasty virus. I tried to delete it but it won't delete. DAMN. I will now be trying to solve this problem, any advice on how to go about that would be appreciated but most of all I want to know how a virus got on the openoffice.org site.

If someone has a suggestion regarding a better place to post this topic or where I may have gone wrong, I would appreciate knowing. Also, suggestions on where to go to find honest instructions on how to remove this virus would be appreciated. Thanks so much!

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 8:38 am
by RoryOF
I have just tried a download of that extension; it downloaded cleanly, no extra file. Perhaps you clicked inadvertently on one of the other items offered on the Sourceforge page, although Sourceforge take care that these are clean, there may have been an oversight.

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 8:50 am
by NWSailor
Thanks RoryOF, I may have freaked--my apologies (but still not sure. Further research shows that it might have been a Chrome temporary file that displays when downloading another file:
https://www.lifewire.com/crdownload-file-2622705
Thanks for your quick reply and checking on this.

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 8:54 am
by RoryOF
For your other problem, of removing unnecessary paragraph marks: how big is the file? Are real paragraphs spaced by blank lines (a backwards P on its own)?

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 9:13 am
by NWSailor
Thanks for your question. Actually, what I was trying to do was add a blank line between paragraphs. It is a fairly long text file with many line breaks (I guess they are called). In the old days in Word I would search for ^p and replace it with ^p^p. There does not seem to be an easy way to do this in Writer. I read a post that said to use regular expressions and it gave some codes, but they did not work. Then another post suggested the extension, that is when I went down the rabbit hole with the original post. Thanks for your help!

PS: I haven't installed the extension that was downloaded yet, I will give it a rest after my freak out!

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 9:26 am
by RoryOF
Linebreaks show as a left pointing hooked arrow. when /View /non printing characters is enabled. You can convert these to spaces or any character by using Find and Replace
Find \n
Replace <space> or chosen character (if you use \n in Replace, you will get Paragraph marks) I use <space> to indicate a space character.
Drop More options, select Regular Expressions.
Replace All.

Now, assuming you have replaced the line breaks with spaces,
Find $
Replace \n\n
Drop More options, select Regular expressions
Replace all.

But rather than use a double paragraph mark, don't do this last F&R pass; better to change the paragraph style to have Space below paragraph set to some non zero value in its Indents and Spacing tab.

Re: Virus downloaded from OO.org extension page

PostPosted: Wed Jun 24, 2020 4:58 pm
by Hagar Delest
NWSailor wrote:I may have freaked--my apologies (but still not sure. Further research shows that it might have been a Chrome temporary file that displays when downloading another file:
https://www.lifewire.com/crdownload-file-2622705

Indeed, I think that's it. You can easily check by downloading a rather big file, you should see the same kind of file appear and then disappear when download is complete.

I've tagged your topic as solved, it can be split if you want to discuss the find and replace question further.