Ghost icon of Firefox.app reappears in Applications Folder after deleting

[UH50]

I'm using a 2020 Mac mini M1 running Monterey 12.4.

I have a Firefox.app icon that shows 0 bytes, although when I Show Applications Content there are the path, Contents/MacOS/distribution/bundles. None of these have any other content.

I can delete this icon and it immediately reappears. This issue started in Feb. 2019 when I was running Mojave on a 2015 MacBook Air and when installing newer OS or migrating to a new machine the problem has followed me.

I have used 3rd party software to find anything related to Firefox and Mozilla and have deleted any files associated with Firefox...at least, that I could find.

I've revealed hidden files and used Funter to find Firefox and Mozilla hidden files and, again, deleted all I could find.

I've deleted the user where Firefox was initially installed.

I've tried deleting in Terminal using sudo command. It still comes back.

I've asked on Apple Community Forums and don't have an answer.

I've asked on Firefox support and followed several suggestions some involving Terminal and again, it still comes back.

I've reinstalled Firefox twice and used Application Cleaner to uninstall. The icon came back.

Hopefully, there is some help here.

TIA,

Howard

 

[bogdanw]

See if there is anything suspicious in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons
Or use KnockKnock “See what's persistently installed on your Mac.” https://objective-see.org/products/knockknock.html

 

[UH50]

Thanks for the suggestion. I looked at all three and there is nothing there suspicious. I will also try Knock knock, although I use a malware/virus checker often.

 

[unrigestered]

See if there is anything suspicious in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons
Or use KnockKnock “See what's persistently installed on your Mac.” https://objective-see.org/products/knockknock.html

noob question:

/System/Library/LaunchAgents/
/System/Library/LaunchDaemons/

are out of question and can't be occupied by anything else than Apple's own content?




OCD question:

how much of knocknock is running in the background if one should desire to run it for on-demand scans only and no continuous system monitoring?

 

[UH50]

I did find files from a source I am not familiar with and named cleverfiles.plist. I also cleaned up some Microsoft Auto Update files while there.

I used the time to delete leftover google files and a few others. I try not to ever use google. To get rid of all the google and clever files, I had to delete my Time Machine backups, but I'll run another in the morning.

I also downloaded and ran KnockKnock.app and it did not reveal anything spurious.

Thanks for the hint. The ghost Firefox.app icon is gone right now but I have not restarted. Let me restart and see how it goes. Will advise. Thanks again.

 

[DeltaMac]

Cleverfiles develops the disk recovery app Disk Drill. Legitimate stuff, there.

 

[q64ceo]

Open up terminal and copy/paste

sudo rm -rf /Applications/Firefox.app

Press enter. Go back into Applications and see if Firefox is still there.

 

[bogdanw]

noob question:
/System/Library/LaunchAgents/
/System/Library/LaunchDaemons/
are out of question and can't be occupied by anything else than Apple's own content?

Yes, they are only for Apple’s services.

OCD question:
how much of knocknock is running in the background if one should desire to run it for on-demand scans only and no continuous system monitoring?

KnockKnock doesn’t run in the background, it’s only on-demand.
BlockBlock runs in the background, but its impact is minimal, as “BlockBlock utilizes Apple's new Endpoint Security Framework (to monitor for persistence)” https://objective-see.org/products/blockblock.html

 

[unrigestered]

Yes, they are only for Apple’s services.

thanks, good to know, as there is only one single plist in my /Library/LaunchDaemons/ for my audio interface, which is quite manageable to monitor myself i guess 😇

KnockKnock doesn’t run in the background, it’s only on-demand.

i was asking since i was misreading one sentence in the description of KnockKnock.
Now reading it again it clearly says it's the Malware that ensures it is being launched at system start up
first time i was somehow reading it as KnockKnock ensures being launched during start up 😳 👍

 

[UH50]

Open up terminal and copy/paste

sudo rm -rf /Applications/Firefox.app

Press enter. Go back into Applications and see if Firefox is still there.

I've done that many times. Still reappears.

 

[q64ceo]

I've done that many times. Still reappears.

Hmm

Try this:

sudo rm -rf /Applications/Firefox.app && sudo mkdir /Applications/Firefox.app && sudo chmod -R 0 /Applications/Firefox.app

See if it's become a generic folder after that. If it has then just delete the generic folder.

 

[UH50]

Cleverfiles develops the disk recovery app Disk Drill. Legitimate stuff, there.

I did find that out when I was looking around. None=the-less, after restarting, the ghost Firefox.app icon is back this morning.

Hmm

Try this:

sudo rm -rf /Applications/Firefox.app && sudo mkdir /Applications/Firefox.app && sudo chmod -R 0 /Applications/Firefox.app

See if it's become a generic folder after that. If it has then just delete the generic folder.

I ran the above in Terminal and nothing changed. Here are the results for Terminal.

Mac-mini:~ hdc$ sudo rm -rf /Applications/Firefox.app && sudo mkdir /Applications/Firefox.app
Password:
mkdir: /Applications/Firefox.app: File exists
Mac-mini:~ hdc$

Thanks again, it's still here.

 

[DeltaMac]

Maybe you have a disk image for FireFox, somewhere on your drive. Mounts when you reboot, and you have some OTHER app that needs Firefox for whatever purpose, which moves the app back into place in /Applications.
( double-check in the Downloads folder, maybe there is a disk image (such as FireFox.dmg, or maybe firefox.pkg) hidden in plain sight.
That being said, all you seem to get is an icon, and not the FireFox app. Does anything happen when you double-click on that icon? That is, does FireFox actually launch when you try to open what you see on your Mac?

 

[q64ceo]

I did find that out when I was looking around. None=the-less, after restarting, the ghost Firefox.app icon is back this morning.

I ran the above in Terminal and nothing changed. Here are the results for Terminal.

Mac-mini:~ hdc$ sudo rm -rf /Applications/Firefox.app && sudo mkdir /Applications/Firefox.app
Password:
mkdir: /Applications/Firefox.app: File exists
Mac-mini:~ hdc$

Thanks again, it's still here.

...what the?

I'd say it's most likely a bug in Apple's File System. You should report it because if you are suffering from it then others are, too.

 

[UH50]

...what the?

I'd say it's most likely a bug in Apple's File System. You should report it because if you are suffering from it then others are, too.

I did that when I first discovered it in 2019 in Mojave. It has migrated to each of the OS upgrades. Just seems to me if it was in Apple's file system that when I upgraded it would be removed.

Again thanks for the recommendations.

...what the?

I'd say it's most likely a bug in Apple's File System. You should report it because if you are suffering from it then others are, too.

Maybe you have a disk image for FireFox, somewhere on your drive. Mounts when you reboot, and you have some OTHER app that needs Firefox for whatever purpose, which moves the app back into place in /Applications.
( double-check in the Downloads folder, maybe there is a disk image (such as FireFox.dmg, or maybe firefox.pkg) hidden in plain sight.
That being said, all you seem to get is an icon, and not the FireFox app. Does anything happen when you double-click on that icon? That is, does FireFox actually launch when you try to open what you see on your Mac?

No, I do not have a disk image for Firefox. I keep such things on a separate USB drive. But, I will search for .dmg files and see what turns up.

When I double click on the icon I get the message:

The package contents show the following path: Firefox.app/Contents/MacOS/distribution/bundles.

I can delete anything in the above path individually and it also returns. By the way, that's the only thing that the ghost icon does—just returns. It's not malicious that I know of.

Again thanks.