6

How can i delete the Falcon app. I've tried running

sudo rm -rf /Applications/Falcon.app

in the terminal but that didn't work.

enter image description here

Improve this question
0

4 Answers 4

Reset to default
8

The padlock icon indicates that the file is locked.

enter image description here

This could be for two reasons…

  1. Someone used Get Info… on the file & specifically locked it. This is simply reversible by the same method.

  2. However, it's more likely that the application needs an uninstaller to remove and therefore locks itself to prevent partial uninstall by simply removing it from Finder (or in this case, Terminal).

    It would be unwise to try override that. There are likely to be components installed elsewhere in the system that would misbehave - also be hard to find and/or delete.

  3. The third alternative - having now looked up what Falcon actually is - is that your organisation's admin/IT department don't want you to be able to uninstall it without their permission. You need to log to your faculty's site & get an uninstaller ID.

Full information on how to deinstall are on the Crowdstrike Falcon site.

Improve this answer
2
  • 5
    It wouldn't be very good at protecting your computer from malware if the malware could just delete the application :)
    – mhopeng
    Commented Aug 1, 2022 at 17:48
  • 1
    @mhopeng - Too true. Antiviruses are about the most difficult things to remove without authorisation - that's kinda… their job ;))
    – Tetsujin
    Commented Aug 1, 2022 at 17:52
2

If the computer is provided by your employer or by the school, then very likely you don't have permission to delete it, and you might get in all sorts of trouble if you attempt it.

If you bought the system second-hand, and it's not stolen, you'll have to do a factory reinitialization, i.e. wipe the media and reinstall the OS.

Generally speaking, such systems are intrusive enough that without proper support in place to remove them, the only way of "removing" them is a wipe+reinstall.

Improve this answer
-2

If you ever get permission denied errors with sudo on a Mac, the problem is almost certainly SIP. Reboot into recovery and turn that off (ignoring the overly-alarmist warnings), and then try running the command again. If it still doesn't work, then it's probably using a malware technique itself (ironic how often anti-malware does that, isn't it?), so try doing the removal itself from recovery or from another computer via Target Disk Mode.

Improve this answer
1
  • 2
    Accurate in general, but definitely not applicable in this case. SIP only applies to first-party (Apple) software, and Crowdstrike Falcon is third-party.
    – JakeRobb
    Commented Aug 2, 2022 at 14:12
-3
  1. remove from login items
  2. Disable full-disk access
  3. sudo rm -rf /Applications/Falcon.app
  4. sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t
Improve this answer
2
  • 2
    See point 3 of the accepted answer apple.stackexchange.com/a/444614/237 why this is not correct in this case
    – mmmmmm
    Commented Nov 29, 2023 at 9:06
  • How would you expect step 4 to work if you removed the command in step 3?
    – nohillside ♦
    Commented Nov 30, 2023 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .