You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Delete System Extension

I found a System Extension in my Library folder with this name:


com.macpaw-labs.snitch.filter-extension.systemextension


At first I thought it would be part of the app LittleSnitch. It is not. I found, that it belongs to Spybuster, an app for iOS. However there is this System Extension sitting in my system and I don't know, what it does. And: I never installed Little Snitch, CleanmyMac or something else from MacPaw.


Unfortunately I am not able to delete this extension. Wether in Terminal, nor in Safe Mode.


Any suggestions how to get rid of it? Or can anyone tell me, why this extension is needed? when I check the information of the file, it has a copy right of Apple 2019. But again, why is it a Macpaw Extension?


I hope you can help.

MacBook Pro Apple Silicon

Posted on Oct 24, 2022 2:24 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 24, 2022 8:14 AM

allesroger wrote:

Unfortunately not everything is answered. Mainly the inital question, how this system extension can be deleted. But it seems, I have to wait for an answer from MacPaw if no one else has a suggestion.

P. Phillips seems to have seen through my little joke. Well played, P. Phillips, well played.


Unfortunately, the jokes on you. Once an app has been incorrectly uninstalled, leftover System Extensions can be very difficult to remove. Here are some things you can try:


1) Reinstall the software. Make sure to install and authorize all features in System Preferences/Settings. Try using the official uninstaller, if one is provided.

2) If that didn't work, try reinstalling the software yet again. Same as before. Only this time, instead of using the official uninstaller, manually drag the "SpyBuster" app to the trash. In theory, it should ask if you want to remove the included System Extension. You do.


Unfortunately, neither of these methods may work once a System Extension has been orphaned like this. I need to fix those profiles, so I'll go ahead and try this again. But they are definitely something to try.


3) Erase your hard drive and reinstall the operating system. When you restore from backup, make sure to restore only your "user accounts" and user files. Do not restore any applications, software, or "other files".


[Edited by Moderator]

Similar questions

16 replies
Question marked as Top-ranking reply

Oct 24, 2022 8:14 AM in response to allesroger

allesroger wrote:

Unfortunately not everything is answered. Mainly the inital question, how this system extension can be deleted. But it seems, I have to wait for an answer from MacPaw if no one else has a suggestion.

P. Phillips seems to have seen through my little joke. Well played, P. Phillips, well played.


Unfortunately, the jokes on you. Once an app has been incorrectly uninstalled, leftover System Extensions can be very difficult to remove. Here are some things you can try:


1) Reinstall the software. Make sure to install and authorize all features in System Preferences/Settings. Try using the official uninstaller, if one is provided.

2) If that didn't work, try reinstalling the software yet again. Same as before. Only this time, instead of using the official uninstaller, manually drag the "SpyBuster" app to the trash. In theory, it should ask if you want to remove the included System Extension. You do.


Unfortunately, neither of these methods may work once a System Extension has been orphaned like this. I need to fix those profiles, so I'll go ahead and try this again. But they are definitely something to try.


3) Erase your hard drive and reinstall the operating system. When you restore from backup, make sure to restore only your "user accounts" and user files. Do not restore any applications, software, or "other files".


[Edited by Moderator]

Oct 24, 2022 5:01 AM in response to allesroger

Have reviewed the report and the finding below pertain Specifically to the Original Question


Q1 -  Configuration profiles found - This computer may have configuration profiles installed. These are sometimes used by malware.


Q2 - Configuration Profiles:  com.apple.applicationaccess,  allowAddingGameCenterFriends,  allowMultiplayerGaming,   com.apple.applicationaccess


    allowNews,   com.apple.applicationaccess ,   allowScreenRecording


A1 & A2 - There is Adware & Malware which will affect the computer and is generally downloaded from “ Shady “ Websites or Developers who Inject this software into the download.


Should “ Certain & Specific Software “ referenced from above be installed - it will negatively impact macOS. It is suggested, download directly from the Developer , the application Malwarebytes for Mac


It is free or paid for added features. 


Run the Application and it should remove the malware / adware. Once done, restart computer and test.


Q3 -System Extensions:


  [Running] SimpleFirewallExtension - version 2.9.45 (MacPaw Labs LTD - 2022-04-07)


A3 - Same company that makes CleanMyMac which I / we do not trust This will include CleanMyMac Read some of the posting and arrive at your own conclusions.


Q4  -  Application: /Applications/SpyBuster.app - version 2.9.45 (Not found!)


    Description: Detect potentially unwanted software


A3 & A4  - https://macpaw.com/news/data-protector-spy-buster


A 4 - Do not actually see the File Path to offer a Removal. Perhaps if it were Removed as Per the Developers Instruction ? 


Q5 -   [Not Loaded] MacUpdaterLaunchHelper (CoreCode Limited - installed 2022-10-06)


  /Applications/MacUpdater.app/Contents/Library/LoginItems/MacUpdaterLaunchHelper.app


A5 - https://www.corecode.io/macupdater/ Not sure on this one but if correct this could be the part of the Source of this issue 


Q6 - [Not Loaded] coconutBattery Menu (Christoph Sinai - installed 2022-10-22)


    Modern Login Item


    /Applications/coconutBattery.app/Contents/Library/LoginItems/coconutBattery Menu.app


A6 - https://www.coconut-flavour.com/coconutbattery/ It has recently been updated for Newer iOS devices like the iPhone 14 PLUS to be compatible with the pending release of macOS 13 Ventura

Oct 24, 2022 6:40 AM in response to allesroger

As Previous Contributor rightly asked and a good question - think that the supplied suggestion earlier seems to have answered that to be best of my Ability.


Maybe to not a total solution but as least something was constructive offered


Barring that, the user may consider waiting for the Developer of Etrecheck Application to make an appearance in your question and offer more insights on this matter.


The Developer does, from time to time, make appearance on these Forums and has a vast knowledge and experience in many matters


If in a hurry suggest contact the Developer Directly https://etrecheck.com/en/index.html as explain this situation and supply a copy of the Report seeking additional Insight. Who knows what may that outcome may yield



etresoft

User level:

Level 8

(42,700 points)

Oct 24, 2022 8:19 AM in response to P. Phillips

P. Phillips wrote:

Q3 -System Extensions:

  [Running] SimpleFirewallExtension - version 2.9.45 (MacPaw Labs LTD - 2022-04-07)


But how to remove it?

Oct 24, 2022 2:53 AM in response to allesroger

Download the Application Etrecheck directly from the Developer.


The application is free or paid from added features. 


It will take a Snap Shot -  both the hardware and software.


 The Report will Not Reveal Any Personal Information. 


Post back the Full Report - copy and paste - >>>> using the Additional Text Icon ( 3rd Icon to last ) <<<<


We can have a look at the report for possible issues and may have possible suggestions to resolve the issues.

Oct 24, 2022 5:27 AM in response to PRP_53

Thank you. So let's go through this:


I don't have any profiles installed according to the Profiles Tab in Peferences. So the question is, where are these configuration profiles located to delete them?

com.apple.applicationaccess,  allowAddingGameCenterFriends,  allowMultiplayerGaming,   com.apple.applicationaccess

The only thing I found was a .plist for com.apple.applicationaccess


I already did a malwarebytes scan. Nothing was found.


Yeah, the spybuster app. I didn't install it knowingly and as far as I am informed, it ist only an iOS app. The path to that extension is /Library/SystemExtensions/723BEC79-5A1E-41D2-BE1E-A2CF18144974/com.macpaw-labs.snitch.filter-extension.systemextension and it is still there. Not deletable. And yes, I am totally with you about CleanmyMac, I have never installed it on that system.


I completely wiped MacUpdater. Didn't see any danger in that, because it just checks version numbers.


So the question stays: how can I remove this system extension? And now I have another question about how I can delete those profiles...



Oct 24, 2022 5:44 AM in response to PRP_53



Q1 -  Configuration profiles found - This computer may have configuration profiles installed. These are sometimes used by malware.

Q2 - Configuration Profiles:  com.apple.applicationaccess,  allowAddingGameCenterFriends,  allowMultiplayerGaming,   com.apple.applicationaccess

    allowNews,   com.apple.applicationaccess ,   allowScreenRecording

One more thing: Aren't these profiles set by screentime?

I just deactivated screentime, and Etrecheck won't find them anymore.

Oct 24, 2022 7:15 AM in response to PRP_53

Unfortunately not everything is answered. Mainly the inital question, how this system extension can be deleted. But it seems, I have to wait for an answer from MacPaw if no one else has a suggestion.


Oh, ands meanwhile I installed Spybuster, just check, if I can delete it completely. Apparently it WAS installed before (I am not the only user here). Spybuster has indeed a function to delete System Extension, but that didn't work.

Delete System Extension

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.