0

I downloaded a 1.5 MB dmg file from a inauthentic site and despite suspicion, opened it and opened the app inside it. Assume that the game I wanted was game, so it was named game.dmg. It mounted installer and showed the icon of installer.app. It didn't install the expected software ofc, but displayed the privacy policy of InstallCore and then two software recommendations which I denied. After which, it showed a link which let me download real software. Back to Finder, it showed completed Installation.

I have the dmg and I can open it again but I need to know where to look to find all the installations, files it wrote etc. I checked in System Report-> installations sorted by date. Only Adobe Flash Player was something I don't remember installing on that day. It was pre-installed. I have removed it for now.

MalwareBytes scan didn't show anything.

Feel free to ask for package contents, screenshots, system logs, activity monitor details etc. MacOS Mojave on MacBook Air.

Improve this question
3
  • Where did you download this from, a legitimate site? What was the name of the software package? Have you tried Malwarebytes to see if finds anything malware related? It is quite a powerful tool. Note: You can use the free scanning feature - no need to purchase anything.
    – IconDaemon
    Jul 18, 2019 at 10:19
  • @IconDaemon updated the question. I know it was foolish to do so. I have denied such pkg installations a lot in the past. but this game had good reviews.
    – anki
    Jul 18, 2019 at 10:21
  • @IconDaemon I am sorry for the confusion, if any, of PKG vs .app. It was installer.app.
    – anki
    Jul 18, 2019 at 16:27

2 Answers 2

Reset to default
3

In general it is not possible to figure out after the fact what was done - unless you have backups.

If you have a recent backup from just before the installation, you can do a comparison with your current system to locate the differences. This is the “safest” method (I.e. least likely to miss something).

It is also possible to analyze the installer file itself - but modern malware tend to receive instructions from a server on what to do on the target system. Such instructions might have changed since you installed.

Improve this answer
1
2

I recommend Pacifist from Charlessoft. This will open any .pkg file and show you the files, and where they will be installed to. You can also inspect pre- and post- install shell scripts, if present, and see what they do.

Improve this answer
5
  • I could see the package contents using right-click->show package contents. One additional info I got was that the install location was / which I suppose is default and developer didn't want to change it. I don't know if I missed something in the usage info, but I couldn't find any option to inspect shell scripts. Also, please see the update, it was .app, not .pkg
    – anki
    Jul 18, 2019 at 16:25
  • An application could store data for installation in any kind of format, so simply browsing the package contents won't help you. If you launched the app, you don't know what it's done. Malwarebytes has found nothing, but the safest course is to assume the disk is compromised, wipe it and restore your data.
    – benwiggy
    Jul 18, 2019 at 16:36
  • Sadly, I don't have backup. And trying not to sound harsh, this was informative, but still unsatisfactory.
    – anki
    Jul 18, 2019 at 16:50
  • It's a good time to put a backup plan in place. It would be best to do a complete backup of your system. I'd reformat drive. Make two partitions. Next make one partition. Re-install macos. Manually copy files back to your new installation. Reload all third party apps. Assume there compromised on your old system.
    – historystamp
    Jul 18, 2019 at 20:34
  • Once this happens or you have a hardware problem with a drive, you get serious about backup. Set time machine on. Get a cloner and clone startup drive. Keep a drive offsite like in a safe deposit box.
    – historystamp
    Jul 18, 2019 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .