Virus / Spyware in plugins or actions

[visnew]

Hi:

I'm not sure if I'm posting in the right place, but since the previous "Virus" thread was posted here, I thought it was best not to change.

In the original thread, Gary warned us not to download stuff from unknown or dangerous sites. However, I'm wondering if it is safe to download Photoshop plugins & actions from unknown sites? Can those files like .8bf, .8bx contain keyloggers, trojans, etc.?

Thanks

[pixelzombie]

considering that jpegs could once be used to carry a virus(could still be for all i know) i would make sure to scan every download...

[BobJones]

Plugins and actions are two very different things.

Plugins are native executable files and can easily be written to contain malicious code. Actions are more like compiled scripts that are interpreted by the action player built into Photoshop. It would be much harder to craft an action file that would pass muster with first, the action loader, and second, the action player and still take advantage of any possible Photoshop security holes and there would probably be version dependancies to deal with as well. You didn't mention scripting, but Photoshop is scriptable and scripts could potentially be malicious. Actions are probably the safest of the three.

I've never heard of a malicious photoshop plugin, script, or action. But, I'd recommend caution. The advice to not download from unknown or suspicious sites is valid for any type of download.

[visnew]

Thanks for the replies / info. I never knew there was a difference between plugins, scripts and actions.

I think I know the difference between a plugin (found under the FILTER menu) and action (found under Actions). But I have no idea what a Photoshop script would be. Can you give me an example?

Since I'm new to all this, most Photoshop sites are "unknown" to me. However I'm beginning to think actions from Adobe and ATN Central are clean. Would that be a safe assumptions? While I run an antivirus and several antispyware programs, I was told no single antivirus program is effective, yet I shouldn't run more than 1 antivirus program on my PC - thus my concern and paranoia

[plugsnpixels]

Although I'm Mac-based, I also download and try all sorts of imaging apps and plug-ins for Windows (running on the Mac using Parallels), and not once so far have I come across any malicious product.

[Kraellin]

i dont run actions and very few scripts, but i have hundreds of plugins and have never found one to contain anything as malicious as a virus/trojan. some may be poorly crafted and a few are downright junk but it's not likely you'd find anything truly malicious in an .8bf. it's certainly not impossible, but it's the scope of the thing. it's too limited. virus makers want big audiences and we small group of .8bf'ers just dont warrant the effort for the most part. then again, never say never.

[DannyRaphael]

While scripts and actions do not "contain" viruses per se, a script or action author could craft one that could do damage. For example it would take about 20 seconds to record an action that:
* Flattens a file
* Fills the resulting background with black
* Saves and closes the file, thereby totally hosing the original

Those handy with scripting (programming) could do much more damage.

Like Craig, I've never run across a damaging plugin (.8bf file), but since plugins are a result of programming there's the possibility one could be crafted that does not-so-nice things, which virus protect software would never catch.

If nothing else a simple Google search on the source site, action, script and/or plugin name would quickly reveal any problems.

[Gary Richardson]

The real danger with downloading from an unknown source is not that you'll download an infected plugin, or a malicious script or action, it's that you may download something entirely different from what you're expecting.

Just because a link says it's for a Photoshop plugin, that does not mean that it's not to an entirely different (and malicious) download.

Caution should always be taken when downloading and installing anything (even from reputable sources), but particularly when it's from a source you don't know.

Whenever possible download from a manufacturer's website, and always scan anything before you install it.

[visnew]

Thanks for input everyone. Guess I was too naive to hope for a definitive answer that it was safe to download 8bf, etcs. I'll just have to temper my enthusiasm for free plugins and actions.

[TommyO]

All good advise. Also, don't forget to visually check the name of files you may download to ensure they appear valid for the type of file you are looking for.

For example, you may want to download a plug-in called "filter.8bf".
Check the file that is presented during the download and ensure it is not renamed to something like "filter.8bf.xxx", where xxx could be a number of executable extensions.

Also, if the file is packaged as a self-installing file like "filter.exe", then be sure you scan during the download and install process.

Like the others have said, it is best to download from reputable sites !