When I woke up my computer this morning I had two Flash Player installer icons that overnight had appeared on the desktop of my iMac. ( see pic Flash icons)
. I highlighted and did a Get Info ( Command+I ) on the icons ( see pic Info Flash Player, Info Flash Player 1
) One of the icons was named Flash Player Pepper, not knowing what is was I did a Google search, which lead me to a page (see pic Adobe Directions)
. I followed the directions and got the Terminal response"bundle format unrecognized, invalid, or unsuitable". (see pic Flash Terminal Response)
. Now I never clicked/opened the installer, and always use a Standard Account rather than an Administrator Account, and never used my Administrator password like I do when installing software. But in the process of taking the screen shots and such my Desktop Settings got messed up and I restarted my computer and the icons are gone. Have I been "Hacked"? How can I tell if their is malicious software on my computer?
1 Correct answer
You can definitely see that our silent auto-updater ran last night, but it looks like everything exited normally.
...
2018-10-09 20:15:59 -0500
SAU: verifySignatureWithData : Message Verified! 2018-10-09 20:16:04 -0500 IM: NPAPI 31.0.0.122 ---------- log start ----------
2018-10-09 20:16:04 -0500 IM: [install started]
2018-10-09 20:16:06 -0500 FIN: [finalizer started]
2018-10-09 20:16:06 -0500 FIN: Compression Output Path: '/Library/Internet Plug-Ins/Flash Player.plugin'.
2018-10-09 20:16:06 -0500 F
9
Replies
I'm pretty sure that your IT department pushed out an update last night, and that the disks failed to unmount. Our automatic updater doesn't use the DMGs, and wouldn't have left them mounted like this.
Had you actually downloaded the files from the Internet, you'd see a URL in the More Info: section, which makes me think that those disks are mounted to a network image. If the volume was actually mounted to a disk image, you'd see Disk Image listed, with a path back to the originating .dmg file. That doesn't seem to be the case, either. This makes me think that it was mounted to a network resource by an administrative script.
As far as the codesign tool goes, you're trying to validate the signature on a mount point, which isn't going to work. You'd need to run that command on the corresponding .dmg, but I don't see a good way to track the disk image back to the source in your scenario. (I suppose you could run a packet sniffer and see what host lights up when you attempt to copy from the mounted disk...)
I'm pretty sure that if you took a look through your system logs that you'll find a good explanation for the activity.
Thank you for your quick response. I know that it was not from the "IT department pushed out an update last night". That is because there is no IT department. It is my personal computer at home. It is connected to the internet through a Wi-Fi connection to basic ATT service. I have four external hard drives connected through USB Hubs and that is all the network that there is.
I do have Adobe allowed to update turned on.
But as far as running " a packet sniffer" I can only guess what that is, and no idea how to do that. I would like to "look through your system logs" but once again have no idea how to do that (Activity Monitor???). My computer knowledge is basically limited to basic internet, Adobe CC apps, and Blender. I can change the Administrative password if that would help. Thanks again.
Sorry, you tricked me with the codesign tool. I figured you were an IT professional or something. Most people don't know about cryptographic signatures and code signing. 
We did push an update last night, and when I download the NPAPI player manually, the vitals match yours. Same date (I assume you're on central or eastern time), same filesize. I'd really like a cryptographic hash of it to be 100% certain that the bits are identical, but I don't know where the original file is mounted from..
Could you share the contents of /User/<you>/Library/Logs/FlashPlayerInstallManager.log? I'm guessing that you'll see some activity from overnight that would explain those mounted disk images at the bottom of the file. /var/log/install.log (you can view it from the commandline or with the Console application) should also show some evidence that an installation was kicked off. The most recent stuff is at the bottom.
AdChoices