installed a phising program meetone.gg ?

Avast Free Antivirus / Premium Security
1

I fear I may have accidentally downloaded phishing software: httpx://meetone.gg/

Avast said “Threat secured - We’ve put sleeve in Quarantine because it was infected with malware: MacOS:Stealer-AB [Trj].”
I checked the whois of the domain, and it says “Registered on 09th April 2024”.

I’m now worried that by initially opening the program, some malware has already been installed.
Avast says “all threats are gone” - what can I do to do a more thorough check?

2

Please make the link unclickable as we don’t want people accidentally clicking on malware links, change https to hxxps.

Posting this in the virus and worms forum board would be advisable https://forum.avast.com/index.php?board=4.0

3

Thanks Craig and Jaames, I modified the link so that it is no longer workable.
I will follow your advice @Jaames.
After Avast informed me about the malware, I canceled the installation.
Another window opened up, asking me to enter a password to grant access to system preferences.
Of coz I did not touch it, but could also not close the window. Tried all sort of ways. Then did a restart and it was gone.
Now, as I did not enter the password, is there a chance that I am still sort of in the clear?
Some other ppl on forums proposed to install Malwarebytes Premium, but I believe Avast has already done what it would do, or?
Thanks for your input - helps tremendously!

4

I wouldn’t be following any advice that was posted by Jaames, it was spam and has now been banned and removed

There would be no harm in running Malwarebytes, the free version is fine for a second opinion.

5

Thanks Craig.
What would be the safest option for me? For example, can/should I install a fresh/clean version of MacOS? Or should I be fine after I had Avast + Malwarebytes run several times?

6

If you have Avast Mac product you may be better asking on Mac sub-forum here: https://forum.avast.com/index.php?board=5.0

7

To be honest I’d recommend posting your issue on the Malwarebytes forum if you suspect you are infected, there is very limited help regarding malware removal on this forum.

8

Hi Craig, I heard back from the guys at malwarebytes:
“What you downloaded is a Stealer malware disguised as an app called Meetone.App. It tries to steal your data if you enter your system password.
Since you didn’t enter the password and restarted, you should be safe after deleting Meetone.App.”
I am 100% positive that I did not enter my system password - since then I deleted it, and so far there is nothing abnormal to report!
Thanks again for your input!

9

Thanks for letting us know, I’m glad it’s sorted for you now :slight_smile: