[neslinesli93]

In spite of account hijacking, GIMP was still downloaded by almost 15k people this week. Six days ago they took over Audacity project as well, which was downloaded by more than 150k this week[0].

[0] http://sourceforge.net/projects/audacity/

[omegafail]

What will happen if I run Audacity installer from sourceforge?

I have done that an hour ago. Should I be concerned?

[barrystaes]

If you have ignored the crapware dialogs of the installer, you should be. But even then there is no telling what they could install without prompting first.

[kefka]

If this is a windows install, do as you would normally do for a spyware infestation.

1. Go through installed programs and uninstall any that you don't want/ didn't know about. Google any you have questions about. (Clicking on date in upper right will sort from newest to oldest.)

2. Get rid of Audacity. We can only assume that this binary is infected as well as the installer.

3. Run something like malware bytes. Do be careful to get the right installer, as the website has many misleading links. Run this.

4. Install in browser: ad block edge for Firefox, or ad block plus for chrome or safari. Quit using IE if you use that.

That should take care of 99% of all problems on your windows machine. I have no clue if you should or should not be worried regarding bad binaries from scamforge. I haven't analyses the binaries.

[JohnTHaller]

You got the same download as you'd get from Audacity itself. SourceForge is acting as a mirror. Unfortunately, the Audacity installers are not digitally signed, but they are bit-for-bit identical on the SourceForge download to the Audacity website download.

SourceForge never modified installers of projects. Even of ones like FileZilla participating in the program. They push "download offer installers". So, if you try to download FileZilla, you get a 750K download that shows you offers when run and downloads the actual FileZilla installer in the background and runs that after you accept or decline the offers.

[Qantourisc]

Well assume you now have some malware/spyware/adware on your pc now, and assume you need to clean it off. Or check the hash of the installer with some reference bin from a trusted source.

[omegafail]

The hash matched the official installer. I doubt they are crazy enough to deliberately hide malware without prompting.