MacOS – Where did this file come from

macos

I started up Disk Utility to mount an external HD and noticed an image file decryptedFile.dmg

Any idea where this file could have come from ls -l@ shows:-

-rw-r--r--@ 1 root  wheel  15643651 17 Feb 11:21 /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/decryptedFile.dmg
    com.apple.diskimages.recentcksum          81

It appears the download was Flash Player. I never use this, but it is not my computer, and apparently Flash had automatic updates (and other undesirable privacy breaches) enabled. (I am very reluctant to open any .dmg I haven't actually downloaded.

Best Answer

I do not have that .dmg in my Mac and I have been doing Adobe Flash player update since years.

Here is a look in to my Folders:

T folder

The T folder is locked and unlocking it shows following:

content of T

Some say it is just a Adobe Flash Player left over ? Why would some Mac have it and others (like mine) not, it is not clear.

Regarding decryptedFile.dmg, that appears in Disk Utility following an Adobe Flash Player update. It is not a Trojan.

Best would be to Open that ".dmg" with something like "Pacifist" to see what is inside, that would reveal if it is from Adobe (which I doubt since I do not have it) or something else.

Related Question