MacOS – Possibility of viruses from opening dmg file

Applications don't have to live in /Applications. If you have a clone of your system mounted, that can account for some duplicates, but certainly not what you are observing. The list of programs for Open with… is maintained in the Launch Services database. If the list contains many duplicates as yours does, the database looks like it needs rebuilding.

Macworld Hints offers a suggestion as to how you can fix this:

The lsregister command, found at System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister, can tell the database to reset. Macworld recommends running the command thusly: /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user

Note that utilities like Onyx or Cocktail can also reset this database for you. Do note that Finder won't re-read the new database so you will either have to log out and in again or issue a killall Finder if you don't mind just killing it for any users on your Mac to avoid a log out and in.

This is the downloaded disk image. Many applications downloaded from the internet will come as an internet ready disk image, which means that it mounts and opens when the downloaded file is opened.

A disk image is a mountable image of any volume. Disk images can be images of physical volumes or virtual disks. Like a zip, dmg disk images can be compressed (and usuall are, especially internet ready disk images such as the disk images used to install software from the internet) or can be read/write like an actual disk. They are mounted in the same mount point as physical disks, but are virtual. When unmounting, the disk is ejected and the mount point deleted like a physical disk. As the disk image is a disk, it will be shown on the desktop if you have the relevant option selected in Finder preferences:

Copy the app to your /Applications folder (or wherever else you desire) then eject the disk image by right-clicking and selecting Eject (or through Finder). The mounted disk image is the .dmg that you downloaded, therefore can be deleted by deleting this disk image after unmounting.