https://www.theregister.co.uk/2017/10/2 ... r_account/Eset found malware being injected into Eltima downloads, such as Elmedia Player and Folx.
It installs a root level back door and steals passwords, encryption keys etc.
Eset noticed the problem on the Thursday afternoon and Eltima had eliminated the problem by Friday evening.
If any of the following exist, you are infected with Proton:
/tmp/Updater.app/
/Library/LaunchAgents/com.Eltima.UpdaterAgent.plist
/Library/.rand/
/Library/.rand/updateragent.app/
The only reliable method to clear the infection is a reinstall of the system.