I started up Disk Utility to mount an external HD and noticed an image file
Any idea where this file could have come from
ls -l@ shows:-
-rw-r--r--@ 1 root wheel 15643651 17 Feb 11:21 /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/decryptedFile.dmg com.apple.diskimages.recentcksum 81
It appears the download was Flash Player. I never use this, but it is not my computer, and apparently Flash had automatic updates (and other undesirable privacy breaches) enabled. (I am very reluctant to open any .dmg I haven't actually downloaded.