Is it normal for there to be a bunch of really bizarre .plist files under the /Library/Apple/Library/Bundles directory?

Hello!


I have a 13" Macbook Air from Early 2015 running macOS Monterey version 12.2.1. I was backing up my entire hard drive when I noticed a bunch of really strange and spammy-looking files in the log, all with the filepath "/Library/Apple/Library/Bundles/InputAlternatives.bundle/Contents/Resources/___," with the last part being a really sketchy looking file name, such as "com.flamingogamestudio.basketballlife3d.plist" which... I have never heard of before. None of the seemingly game-related names actually relate to any of the applications I have installed, or have ever installed for that matter.


I'd like to believe that it's just some innocuous in-built thing related to the App store but I can't imagine why Apple would ever have such seemingly unnecessary and strange files. Take a look;



I was completing the backup through IDrive, I never ever use the actual App Store, and I have no clue what it could be or why it is there. Apps I currently have installed that I could see possibly having something to do with it are Steam and Origin. In the past I've downloaded PlayOnMac, Bluestacks, CrossOver, Wine (I was desperate if you can't tell), the XP-Pen Tablet Driver and an Xbox 360 Controller Driver. I have no games currently installed however, unless Sims 4 Studio and the shortcut for RPG Maker MZ count.


That wasn't all of them, I don't know how many there are but I figure the people who can answer the question will be able to tell whether it's obvious malware or not at first glance. I know it's silly but I'm too nervous to look up the actual file names incase I somehow make it worse.


My computer runs totally fine, I never have issues with pop-ups, or ads, or data-theft, or corruption, or anything (touch wood). It can run a bit slow and get a little hot sometimes, but I feel like that's to be expected for a 7 year old Mac with a lot of time on it.


So, what's up with those files?

Posted on Aug 30, 2022 2:51 AM

Reply
8 replies

Aug 30, 2022 2:57 AM in response to kurt–kurt

Q - " I have a 13" Macbook Air from Early 2015 running macOS Monterey version 12.2.1. "


A - The current stable version of Monterey as of August 17, 2022 is version 12.5.1


A - This may be related to your other issues above and it is always a good idea to keep the computer up-to-date


Feb 10, 2022 Monterey macOS 12.2.1( 21D62 )

Mar 14, 2022 Monterey macOS 12.3 ( 21E230 )

Mar 31, 2022 Monterey macOS 12.3.1 ( 21E258 )

May 16, 2022Monterey macOS 12.4 ( 21F79 )

July 20, 2022 Monterey macOS 12.5 ( 21G72 )

Aug 17, 2022 Monterey macOS 12.5.1 ( 21G83 )

Aug 30, 2022 7:46 AM in response to Luis Sequeira1

Thank you, although I hope you can understand why I would feel reasonably sketched out by the fact that 400+ files I didn't download and can't find any reference to online with names such as "kr.co.smartstudy.babysharkrun.plist" exist within my library. The issue isn't that there's system files I've never seen before, that would be silly. The issue is that they look like such obvious adware and there is no reference online that would say otherwise. So let me elaborate;



I feel like seeing hundreds of files named after a combination of terrible quality mobile games, untrusted developers and absolute gibberish suddenly appear on your Mac and reacting with "Well I don't know what ordinary system files are, 'Baby Shark Run.plist' is more likely a normal official thing Apple decided everyone needed on their system than adware!" would be insane. I searched across the internet to find evidence of them being supposed to exist for hours and found nothing before I decided to ask, literally only one website even mentions the "InputAlternatives.bundle" file.



The most information I could therefore figure out is that that specific filepath has something to do with Marzipan/Project Catalyst, which lessens the cause for concern but still doesn't tell me all I need to know to be certain that they're not malicious. I know, for example, that Twitter is/has a Catalyst app– so it can't just be "inbuilt .plists for all the possible catalyst apps," which is the only non-malicious reason I could think of them being there, because Catalysts like Twitter are nowhere to be seen, big name apps in general are nowhere to be seen and I cannot reasonably fathom why it would be this way if those files were meant to be there and aren't the result of some underlying issue.


I know .plist files aren't inherently harmful, but "hundreds of .plist files for bizarre apps you didn't install suddenly showing up in your library" is kinda the definition of adware on Mac, these files inarguably look untrustworthy, and it's very rational to be concerned about a phenomenon you cannot find information on and want to get a concrete answer before deciding what to do about them.


Seeing as there is absolutely no easily accessible information online about this dilemma, I just wanted to open up a discussion as to whether anyone is familiar with these specific files (etc. "com.abc.carparking.game3d.plist" "com.banditmovie.slotsofvegas.plist") and can confirm that they're not out of the ordinary– because they very clearly look like spam, and there is nowhere online that mentions that they even exist. If they are ordinary files for a person who's never downloaded any of those apps to have, then it's good for there to be a question online that confirms that. If this is a sign of malware, then it's good to make that known as well.


Thank you.

Aug 30, 2022 8:01 AM in response to kurt–kurt

Understand, we are all working Remotely from all around the world. 


Therefore, we do not have the On-Hands experience the User ( you ) has with this computer.


The next best thing for us to having a semi - actual On-Hand experience on this computer is to follow the steps below


Download the Application Etrecheck directly from the Developer.


The application is free or paid from added features. 


It will take a Snap Shot -  both the hardware and software.


 The Report will Not Reveal Any Personal Information. 


Post back the Full Report - copy and paste - using the Additional Text Icon ( 3rd Icon to last )


We can have a look at the report for possible issues and may have possible suggestions to resolve the issues.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is it normal for there to be a bunch of really bizarre .plist files under the /Library/Apple/Library/Bundles directory?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.