New or used? As far as I know that variant of Flashback has not been seen in the wild since late last year. Since you say you see 'Flash Player' underneath, it sounds like it's mounted and the Trojan is ready for installation. dmg it should tell you next to 'Write Status:' if it's not mounted. It should have been downloaded to a temp area which is normally emptied of everything on reboot, but it sounds to me like something may have gone wrong with that.ĭisk Utility has a habit of remembering files that it has mounted in the past and displaying them in an unmounted state. If it's actually still on your hard drive then it is capable of installing/reinstalling one of the older variants of Flashback. Underneath the name of my hard drive and SuperDrive is 'decryptedFile.dmg' and underneath that on a sub-level is 'Flash Player.' I researched online and found that 'decryptedFile.dmg' is a sign of the Flashback trojan, but I've also read that it is a harmless 'leftover' from installing Flash Player. I opened Disk Utility and noticed that a seemingly strange file was showing up.

It makes a big difference on how we approach this.įirst off, I am a new Mac user, so bear with me. Since you are posting to the iMac (Intel) forum, I know that much, but what OS X are you running. You haven't filled out your profile yet, so I don't know a lot about your setup. its_Targeted_Attacks_and_Possible_APT_linkĬrisis OS X Trojan is an effective spy tool…Ĭheck now whether your Mac is infected by Backdoor.Flashback.39! The most current flashback removal instructions are F-Secure's Trojan-Downloader:OSX/Flashback.K. Many malware programs use this behavior, as was seen in others such as the Tsunami malware bot. If these tools are found, then the malware deletes itself in an attempt to prevent detection by those who have the means and capability to do so.

Developer/Applications/Xcode.app/Contents/MacOS/Xcode In order to avoid detection, the installer will first look for the presence of some antivirus tools and other utilities that might be present on a power user's system, which according to F-Secure include the following: Your pic doesn't show, draging & dropping on this forum looks like it woirks until you submit, you have to use the Camera icon in a reply to actually upload it.ĭisable Java in your Browser settings, not JavaScript.įlashback - Detect and remove the uprising Mac OS X Trojan. Hi ABuck, and a warm welcome to the forums & Macdom! 🙂

Decryptedfile dmg