How do you remove Norton SystemExtension?

Question

Level 1

8 points

How do you remove Norton SystemExtension?

Norton SystemExtension 9.0.2 created May 13, 2020 has crashed my MacBook Pro 60 times in the past three weeks according to the attached EtreCheck report. I'm running Catalina 10.15.6.

I've run the RemoveNortonMacFiles.command 8.0.2 to remove all Norton files but the file wasn't removed.

https://support.norton.com/sp/en/us/home/current/solutions/kb20080427024142EN

EtreCheck Pro Report 07.16.20

Norton SystemExtension 9.0.2 is an executable located at: /Library/SystemExtensions/*/com.symantec.mes.systemextension

I cannot manually delete it.

I rue the day that I ever purchased and installed Norton Security and Norton 360.

Any suggestions are appreciated.

Posted on Jul 16, 2020 10:10 PM

Reply

Answer 1

Top-ranking reply

Newsmaster Author

Level 1

8 points

Jul 17, 2020 7:59 PM in response to Newsmaster

Barney,

The solutions in the Fireebok document that I had found didn't help so I went back to your message to find out about SIP (system integrity protection). Then restarting the Mac in recovery mode, I opened Terminal, and issued the command csrutil disable and then restarted with my admin credentials. Then I was able to give myself Read & Write permissions in order to delete the Norton folders and files. That ended up being a simple solution. Thank you for getting me on the right track.

Reply

Answer 2

etresoft

Level 9

51,016 points

Jul 17, 2020 8:08 PM in response to Newsmaster

Did that really work? As far as I know, you also have to run “systemextensionsctl uninstall” as described in this thread: https://developer.apple.com/forums/thread/129250

EtreCheck should detect and report a zombie system extension. Although I have tested a scenario where the system extension was not properly removed, I did not try manually deleting the file from recovery. The only proper way to remove the file is with the terminal command above. At this time, it must be run with SIP disabled. So run EtreCheck again and make sure it doesn’t report any system extension.

It is unfortunate that Norton would publicly release software like this without knowing how to properly remove it.

Reply

Answer 3

Barney-15E

Level 10

116,746 points

Jul 17, 2020 7:03 AM in response to Newsmaster

That directory isn't protected by SIP or anything else. It is owned by root, so you would need to elevate your privileges by authenticating when it asks.

What error do you get when you try to delete it?

Reply

Answer 4

Newsmaster Author

Level 1

8 points

Jul 17, 2020 2:58 PM in response to Barney-15E

Thank you, sir. The error I get when I try to delete the file and/or parent directory is "The operation can't be completed because you don't have permission to access some of the items."

When I try to give myself the necessary permissions, as administrator, it responds with "The operation can't be completed because you don't have the necessary permission."

I wasn't quite sure what you meant by elevating my privileges; I thought that was what I was doing in the Info view under "Sharing & Permissions" when I tried to give myself permissions, but that didn't work.

I next went to this site "How to fix when you don't have the necessary permission on Mac?"

https://www.fireebok.com/resource/how-to-fix-when-you-do-not-have-the-necessary-permission-on-mac.html

There I followed the author's instructions to reset user permissions running the command using Terminal to verify and repair permissions on the Macintosh HD. This script has been running for a few hours so I don't know yet if I'll be successful in changing the permissions. I'll post an addendum once the script is finished running.

Reply

Answer 5

Newsmaster Author

Level 1

8 points

Jul 23, 2020 12:05 PM in response to etresoft

Thank you, etresoft.

The Etrecheck reports had always suggested that kernel panics could be due to hardware failures, and finally one report clued me to a "failing hard drive." The original crashes that I was experiencing back in May with less than 20GB of free space had led me to replace my original 500GB drive with a new OWC Aura Pro X2 1.0TB drive. This new drive worked well for three weeks and then kernel panics emerged suggesting problems with the Norton "zombie" kext files and system extension.

After replacing the failed Aura SSD with the original drive and cleaning that drive of all Norton files I've had no more crashes.

Reply

How do you remove Norton SystemExtension?

Similar questions