Mystery Software mounted - Help!

[Bandit27]

Hi,
Was erasing a HDD with disk utility today, and saw that there is a "decrypted file" mounted with Flash Player as a virtual drive. Is this really flash player? why can't I find the file to delete it. I have unmounted it, and it re-mounts itself. Is this some kind of trojan?
Thanks in advance. screenshot included.

Tyler

 

[Apple_Robert]

It looks like you have the Flashback trojan.

http://www.toolfarm.com/blog/entry/mac_users_beware_flashback_osx_trojan_600000_macs_are_infected

Removal Tool

https://www.f-secure.com/weblog/archives/00002346.html

http://support.apple.com/en-us/HT202458


When was the last time you updated your Mac?

 

[chrfr]

It looks like you have the Flashback trojan.

http://www.toolfarm.com/blog/entry/mac_users_beware_flashback_osx_trojan_600000_macs_are_infected

Removal Tool

https://www.f-secure.com/weblog/archives/00002346.html

Flashback has been blocked by OS X for several years.
These are sloppy leftovers from the Adobe Flash Player updater. They'll disappear on reboot, or just eject them from within Disk Utility. Nothing to worry about here.

----------

Is this really flash player? why can't I find the file to delete it. I have unmounted it, and it re-mounts itself.

It's not a trojan. Click on the decrypytedfile.dmg in Disk Utility and you'll see a link to the path where it's located. (It'll be in /private/var/folders/random characters.) You can manually delete it or just leave it and it'll go away on its own at reboot.

 

[Apple_Robert]

Flashback has been blocked by OS X since an update for 10.5.x.
These are sloppy leftovers from the Adobe Flash Player updater. They'll disappear on reboot, or just eject them from within Disk Utility. Nothing to worry about here.

Ok. The guy said it keeps remounting itself, which is why I thought it might be the trojan. It seems it has made a resurgence lately according to what i read. Apple updated their support page for it on November 2014.

 

[chrfr]

Ok. The guy said it keeps remounting itself, which is why I thought it might be the trojan. It seems it has made a resurgence lately according to what i read.

There's other malware/adware around, and lots of security updates for Flash Player recently (3 in the past 2 weeks), but this isn't malware. Just bad programming.

 

[Apple_Robert]

There's other malware/adware around, and lots of security updates for Flash Player recently (3 in the past 2 weeks), but this isn't malware. Just bad programming.

This is one of those time I will gladly be wrong.

Thank you for the correction.

As a side note...

http://arstechnica.com/security/201...-flashback-trojan-still-infecting-22000-macs/

 

[Bandit27]

Solved!

Thanks everyone.
Was exactly where the path said, after I got the machine to show invisible files. Deleted it, and all is well again.
Thanks for the help.

Cheers,

Tyler