Skip to main content
D
de.kc.mo
Participating Frequently
October 10, 2018
Answered

Mysterious Flash Installer

  • October 10, 2018
  • 2 replies
  • 1580 views

When I woke up my computer this morning I had two Flash Player installer icons that overnight had appeared on the desktop of my iMac. ( see pic Flash icons).  I highlighted and did a Get Info ( Command+I ) on the icons ( see pic Info Flash Player, Info Flash Player 1) One of the icons was named Flash Player Pepper, not knowing what is was I did a Google search, which lead me to a page (see pic Adobe Directions). I followed the directions and got the Terminal response"bundle format unrecognized, invalid, or unsuitable". (see pic Flash Terminal Response). Now I never clicked/opened the installer,  and always use a Standard Account rather than an Administrator Account, and never used my Administrator password like I do when installing software. But in the process of taking the screen shots and such my Desktop Settings got messed up and  I restarted my computer and the icons are gone. Have I been "Hacked"? How can I tell if their is malicious software on my computer?

This topic has been closed for replies.
Correct answer jeromiec83223024

You can definitely see that our silent auto-updater ran last night, but it looks like everything exited normally.

2018-10-09 20:15:59 -0500 SAU: verifySignatureWithData : Message Verified!

2018-10-09 20:16:04 -0500 IM: NPAPI 31.0.0.122 ---------- log start ----------

2018-10-09 20:16:04 -0500 IM: [install started]

2018-10-09 20:16:06 -0500 FIN: [finalizer started]

2018-10-09 20:16:06 -0500 FIN: Compression Output Path: '/Library/Internet Plug-Ins/Flash Player.plugin'.

2018-10-09 20:16:06 -0500 FIN: Compression Input Path: '/Library/Internet Plug-Ins/Flash Player.plugin.lzma'.

2018-10-09 20:16:07 -0500 FIN: Reading previous version file

2018-10-09 20:16:07 -0500 FIN: [finalizer succeeded]

installer: Package name is Adobe Flash Player

installer: Upgrading at base path /

installer: The upgrade was successful.

2018-10-09 20:16:09 -0500 IM: [install succeeded]

2018-10-09 20:16:09 -0500 IM: Install succeeded with exit code: 0.

2018-10-09 20:16:09 -0500 IM: NPAPI 31.0.0.122 ---------- log end ----------

2018-10-09 21:16:20 -0500 SAU: verifySignatureWithData : Message Verified!

2018-10-09 21:16:24 -0500 IM: PPAPI 31.0.0.122 ---------- log start ----------

2018-10-09 21:16:24 -0500 IM: [install started]

2018-10-09 21:16:25 -0500 FIN: [finalizer started]

2018-10-09 21:16:25 -0500 FIN: Compression Output Path: '/Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin'.

2018-10-09 21:16:25 -0500 FIN: Compression Input Path: '/Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin.lzma'.

2018-10-09 21:16:26 -0500 FIN: Reading previous version file

2018-10-09 21:16:26 -0500 FIN: [finalizer succeeded]

installer: Package name is Adobe Pepper Flash Player

installer: Upgrading at base path /

installer: The upgrade was successful.

2018-10-09 21:16:30 -0500 IM: [install succeeded]

2018-10-09 21:16:30 -0500 IM: Install succeeded with exit code: 0.

2018-10-09 21:16:30 -0500 IM: PPAPI 31.0.0.122 ---------- log end

I'll ask the installer folks about whether or not they have any theories about why those disks show as mounted.

Is there anything in those mounted disks?

2 replies

jeromiec83223024
jeromiec83223024Correct answer
Inspiring
October 10, 2018

You can definitely see that our silent auto-updater ran last night, but it looks like everything exited normally.

2018-10-09 20:15:59 -0500 SAU: verifySignatureWithData : Message Verified!

2018-10-09 20:16:04 -0500 IM: NPAPI 31.0.0.122 ---------- log start ----------

2018-10-09 20:16:04 -0500 IM: [install started]

2018-10-09 20:16:06 -0500 FIN: [finalizer started]

2018-10-09 20:16:06 -0500 FIN: Compression Output Path: '/Library/Internet Plug-Ins/Flash Player.plugin'.

2018-10-09 20:16:06 -0500 FIN: Compression Input Path: '/Library/Internet Plug-Ins/Flash Player.plugin.lzma'.

2018-10-09 20:16:07 -0500 FIN: Reading previous version file

2018-10-09 20:16:07 -0500 FIN: [finalizer succeeded]

installer: Package name is Adobe Flash Player

installer: Upgrading at base path /

installer: The upgrade was successful.

2018-10-09 20:16:09 -0500 IM: [install succeeded]

2018-10-09 20:16:09 -0500 IM: Install succeeded with exit code: 0.

2018-10-09 20:16:09 -0500 IM: NPAPI 31.0.0.122 ---------- log end ----------

2018-10-09 21:16:20 -0500 SAU: verifySignatureWithData : Message Verified!

2018-10-09 21:16:24 -0500 IM: PPAPI 31.0.0.122 ---------- log start ----------

2018-10-09 21:16:24 -0500 IM: [install started]

2018-10-09 21:16:25 -0500 FIN: [finalizer started]

2018-10-09 21:16:25 -0500 FIN: Compression Output Path: '/Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin'.

2018-10-09 21:16:25 -0500 FIN: Compression Input Path: '/Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin.lzma'.

2018-10-09 21:16:26 -0500 FIN: Reading previous version file

2018-10-09 21:16:26 -0500 FIN: [finalizer succeeded]

installer: Package name is Adobe Pepper Flash Player

installer: Upgrading at base path /

installer: The upgrade was successful.

2018-10-09 21:16:30 -0500 IM: [install succeeded]

2018-10-09 21:16:30 -0500 IM: Install succeeded with exit code: 0.

2018-10-09 21:16:30 -0500 IM: PPAPI 31.0.0.122 ---------- log end

I'll ask the installer folks about whether or not they have any theories about why those disks show as mounted.

Is there anything in those mounted disks?

D
de.kc.moAuthor
Participating Frequently
October 10, 2018

That's great news. I kind of figured it would be something like that. That

was from the console right? Because if it ever happens again I will know

what to look for that way.

I don't know if there was anything in those disks. I didn't open them, not

being sure what they were. And during the process of collecting the screen

shots and composing the forum letter ( In writing the forum post in

TextEdit a plain text editor) I grabbed the TextEdit window to far to the

right to move it out of the way to see behind it. An Apple (at least on my

machine) has this thing where if you let go of a window and the cursor is

off the screen, it just disappears and I can't figure how to get it back.

So I had to restart my machine to get the TextEdit Window back. When it

Restarted they were gone, unmounted. So I don't know.

THANKS A LOT. I feel much better that it's been shown to be nothing. I'm

going to delete those DropBox files and kill that link. Have a great day

you've been a lot of help.

On Wed, Oct 10, 2018 at 2:45 PM jeromiec83223024 <forums_noreply@adobe.com>

jeromiec83223024
jeromiec83223024
Inspiring
October 10, 2018

No problem.  You might think about running First Aid from the disk utility on MacOS (after making good backups), including scanning for and fixing any file system permission issues.  My guess is that it's a permission thing with the temporary files that were created when we did the usually-silent install.

jeromiec83223024
jeromiec83223024
Inspiring
October 10, 2018

I'm pretty sure that your IT department pushed out an update last night, and that the disks failed to unmount.  Our automatic updater doesn't use the DMGs, and wouldn't have left them mounted like this.

Had you actually downloaded the files from the Internet, you'd see a URL in the More Info: section, which makes me think that those disks are mounted to a network image.  If the volume was actually mounted to a disk image, you'd see Disk Image listed, with a path back to the originating .dmg file.  That doesn't seem to be the case, either.  This makes me think that it was mounted to a network resource by an administrative script.

As far as the codesign tool goes, you're trying to validate the signature on a mount point, which isn't going to work.  You'd need to run that command on the corresponding .dmg, but I don't see a good way to track the disk image back to the source in your scenario.  (I suppose you could run a packet sniffer and see what host lights up when you attempt to copy from the mounted disk...)

I'm pretty sure that if you took a look through your system logs that you'll find a good explanation for the activity.

D
de.kc.moAuthor
Participating Frequently
October 10, 2018

Thank you for your quick response. I know that it was not from the  "IT department pushed out an update last night". That is because there is no IT department. It is my personal computer at home. It is connected to the internet through a Wi-Fi connection to basic ATT service. I have four external hard drives connected through USB Hubs and that is all the network that there is.I do have Adobe allowed to update turned on.

But as far as running " a packet sniffer" I can only guess what that is, and no idea how to do that. I would like to "look through your system logs" but once again have no idea how to do that (Activity Monitor???). My computer knowledge is basically limited to basic internet, Adobe CC apps, and Blender. I can change the Administrative password if that would help. Thanks again.

jeromiec83223024
jeromiec83223024
Inspiring
October 10, 2018

Sorry, you tricked me with the codesign tool.  I figured you were an IT professional or something.  Most people don't know about cryptographic signatures and code signing. 

We did push an update last night, and when I download the NPAPI player manually, the vitals match yours.  Same date (I assume you're on central or eastern time), same filesize. I'd really like a cryptographic hash of it to be 100% certain that the bits are identical, but I don't know where the original file is mounted from..

Could you share the contents of /User/<you>/Library/Logs/FlashPlayerInstallManager.log?  I'm guessing that you'll see some activity from overnight that would explain those mounted disk images at the bottom of the file.  /var/log/install.log (you can view it from the commandline or with the Console application) should also show some evidence that an installation was kicked off.  The most recent stuff is at the bottom.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices