1

I started up Disk Utility to mount an external HD and noticed an image file decryptedFile.dmg

Any idea where this file could have come from ls -l@ shows:-

-rw-r--r--@ 1 root  wheel  15643651 17 Feb 11:21 /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/decryptedFile.dmg
    com.apple.diskimages.recentcksum          81

It appears the download was Flash Player. I never use this, but it is not my computer, and apparently Flash had automatic updates (and other undesirable privacy breaches) enabled. (I am very reluctant to open any .dmg I haven't actually downloaded.

Improve this question
3
  • you might have downloaded something and installed the app and the ".dmg" did not get deleted, it is in your Cache folder anyway, so if you restart it might go away, or you go and delete it
    – Ruskes
    Feb 17, 2015 at 2:07
  • 1
    After downloading Adobe Flash with the web-based downloader the Adobe Installer often mentions an encrypted disk. The size of the dmg would roughly fit... Open the dmg and have a look inside...
    – klanomath
    Feb 17, 2015 at 2:30
  • Or, open Disk Utility. At least in my case, the file was listed on the left side, and still mounted (as I had just updated Flash). Since the file is in the /T/ folder (which disappears every reboot), it's likely to still be mounted in the OP's case as well. FWIW, the size of this particular 16.0.0.305 updater was 15643651 bytes, but I couldn't find anything canonical to check whether it was correct or not.
    – Kent
    Feb 17, 2015 at 7:34

2 Answers 2

Reset to default
-5

I do not have that .dmg in my Mac and I have been doing Adobe Flash player update since years.

Here is a look in to my Folders:

T folder

The T folder is locked and unlocking it shows following:

content of T

Some say it is just a Adobe Flash Player left over ? Why would some Mac have it and others (like mine) not, it is not clear.

Regarding decryptedFile.dmg, that appears in Disk Utility following an Adobe Flash Player update. It is not a Trojan.

Best would be to Open that ".dmg" with something like "Pacifist" to see what is inside, that would reveal if it is from Adobe (which I doubt since I do not have it) or something else.

Improve this answer
4

Have you installed Flash Player recently? If so, it's just a harmless leftover. If not, it could be part of the Flashback Trojan.

Also keep in mind that programs like Google Chrome embed flash player, so you are correct to not trust dmg you don't really want to install. More digging might be needed if you don't want to make a backup and then just delete the files and see if/when they reappear.

Improve this answer
1
  • 1
    I think this file is also leftover if Flash auto-updates itself, so even if you don't remember doing the installation, it's likely come from Adobe.
    – Kent
    Feb 17, 2015 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .