You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How do you remove Norton SystemExtension?

Norton SystemExtension 9.0.2 created May 13, 2020 has crashed my MacBook Pro 60 times in the past three weeks according to the attached EtreCheck report. I'm running Catalina 10.15.6.


I've run the RemoveNortonMacFiles.command 8.0.2 to remove all Norton files but the file wasn't removed.

https://support.norton.com/sp/en/us/home/current/solutions/kb20080427024142EN


Norton SystemExtension 9.0.2  is an executable located at: /Library/SystemExtensions/*/com.symantec.mes.systemextension

I cannot manually delete it.


I rue the day that I ever purchased and installed Norton Security and Norton 360.


Any suggestions are appreciated.



Posted on Jul 16, 2020 10:10 PM

Reply
Question marked as Top-ranking reply

Posted on Jul 17, 2020 7:59 PM

Barney,


The solutions in the Fireebok document that I had found didn't help so I went back to your message to find out about SIP (system integrity protection). Then restarting the Mac in recovery mode, I opened Terminal, and issued the command csrutil disable and then restarted with my admin credentials. Then I was able to give myself Read & Write permissions in order to delete the Norton folders and files. That ended up being a simple solution. Thank you for getting me on the right track.

5 replies
Question marked as Top-ranking reply

Jul 17, 2020 7:59 PM in response to Newsmaster

Barney,


The solutions in the Fireebok document that I had found didn't help so I went back to your message to find out about SIP (system integrity protection). Then restarting the Mac in recovery mode, I opened Terminal, and issued the command csrutil disable and then restarted with my admin credentials. Then I was able to give myself Read & Write permissions in order to delete the Norton folders and files. That ended up being a simple solution. Thank you for getting me on the right track.

Jul 17, 2020 8:08 PM in response to Newsmaster

Did that really work? As far as I know, you also have to run “systemextensionsctl uninstall” as described in this thread: https://developer.apple.com/forums/thread/129250


EtreCheck should detect and report a zombie system extension. Although I have tested a scenario where the system extension was not properly removed, I did not try manually deleting the file from recovery. The only proper way to remove the file is with the terminal command above. At this time, it must be run with SIP disabled. So run EtreCheck again and make sure it doesn’t report any system extension.


It is unfortunate that Norton would publicly release software like this without knowing how to properly remove it.

Jul 17, 2020 2:58 PM in response to Barney-15E

Thank you, sir. The error I get when I try to delete the file and/or parent directory is "The operation can't be completed because you don't have permission to access some of the items."


When I try to give myself the necessary permissions, as administrator, it responds with "The operation can't be completed because you don't have the necessary permission."


I wasn't quite sure what you meant by elevating my privileges; I thought that was what I was doing in the Info view under "Sharing & Permissions" when I tried to give myself permissions, but that didn't work.


I next went to this site "How to fix when you don't have the necessary permission on Mac?"

https://www.fireebok.com/resource/how-to-fix-when-you-do-not-have-the-necessary-permission-on-mac.html


There I followed the author's instructions to reset user permissions running the command using Terminal to verify and repair permissions on the Macintosh HD. This script has been running for a few hours so I don't know yet if I'll be successful in changing the permissions. I'll post an addendum once the script is finished running.



Jul 23, 2020 12:05 PM in response to etresoft

Thank you, etresoft.


The Etrecheck reports had always suggested that kernel panics could be due to hardware failures, and finally one report clued me to a "failing hard drive." The original crashes that I was experiencing back in May with less than 20GB of free space had led me to replace my original 500GB drive with a new OWC Aura Pro X2 1.0TB drive. This new drive worked well for three weeks and then kernel panics emerged suggesting problems with the Norton "zombie" kext files and system extension.


After replacing the failed Aura SSD with the original drive and cleaning that drive of all Norton files I've had no more crashes.

How do you remove Norton SystemExtension?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.