Worried that I downloaded malware from a disk image

.

Download and run the free version of Malwarebytes. It was developed by a long time contributor to these forums and a highly respected member of the computer security community. 

Malwarebytes will tell you if it found anything. Also you can download and run Etrecheck.  The free version is sufficient. Be sure to give it Full Disk Access.

Copy the report as shown in this animated screenshot

and use the Additional Text button to paste the report in your reply.

Then we can examine the report and see if AMOS is mentioned anywhere in the report.

First, there is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  

There are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   

Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.

There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it.  The free version is more than adequate for most users.  

Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint. 

The anti-virus apps very often give false positives. The only real way to confirm that the malware has been installed is to run Etrecheck and look for the malware name.

You should install Avast and Sophos according to the developers' instructions. Then you can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For software mentioned you'd do the following search(es): 

1 - Name contains avast

2 - Name contains sophos

3 - Name contains amos

4 - Name. contains virus or virustotal

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.

Note:  if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode.  This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.

gandalf1414 wrote:

I ran the disk image through VirusTotal and confirmed that it had the AMOS trojan. I already deleted the disk image from my computer and I ran Sophos/Avast and it didn't find anything so I think it's already been removed. What i'm worried about is if the malicious script already ran, and if Gatekeeper was able to block it

Gatekeeper doesn't block malware. Gatekeeper checks the signature and notarization status of a file. It uses that information to display a dialog informing the user of the status of the file. It can be one of:

1) Downloaded and check for malware (none having been found); or

2) Could not check for malware. (But the user can override and install.)

(There's another hidden layer of Gatekeeper here that checks the runtime and entitlements and may prevent the file from running.)

Even after all of this, if XProtect detects actual malware, it may prevent an executable from running.

All of this runs in the background and/or displays a dialog altering the user to that which Apple wants the user to know. Nobody really knows what any of the log messages mean.

Old Toad wrote:

.

What does that mean? I don't use e-mail notifications. So if that's an edit, it's just a dot for me.

It was a reply in error. I edited it to a period.