Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

A McAfee Nightmare

As referenced in disinespic (.com) - New Malware? - Apple Community, I've had a lot of trouble on my iPhone and on my Macs that were brought on by the McAfee software I'd installed.


I deleted the app on two phones and used their uninstaller to get rid of it on three Macs. The "uninstaller" finished with a notification of what it had added.



It took some effort but in each case there were many parts left behind that I searched out and deleted myself. On the Macs I was unable to remove com.mcafee.CMF.networkextension.systemextension or com.mcafee.CMF.networkextension because I lack permission to access them.


Today, weeks after deleting all else, my wife's computer suddenly could connect to our wifi but could not connect to anything on the internet. After trying everything I could think of I discovered that McAfee VPN had enabled itself, creating the very issue I dealt with before. Its self-reenabling had been the source of my iPhone trouble.


On all of our Macs I discovered that each has hundreds of entries in the Diagnostics Reports regarding McAfee. So it's far from gone.


How do I get rid of this cursed software!!


Posted on Apr 5, 2023 1:02 PM

Reply
Question marked as Top-ranking reply

Posted on Apr 5, 2023 3:55 PM

Looks like this is what it is going to take to get the job done. If you don't want to go down this path, I totally understand. You will have to boot into recovery mode, disable SIP, reboot, delete extension, reboot into recover, enable SIP, reboot. Here are detail steps.


  • BOOT INTO RECOVERY MODE

On Intel Mac, hold down Command - R on reboot. On Apple Silicon, hold power button while starting up until Options button appears. Click the button and continue, you may be asked to choose your startup drive.

  • DISABLE SIP

In the menu bar of the Recovery Mode, choose Utilities > Terminal.

Enter the command "csrutil disable"

Quit Terminal by going to Terminal > Quit

  • RESTART
  • OPEN TERMINAL

Enter the command "systemextensionsctl list". This will give you a list of the extensions. You will want to look for the Team ID and Bundle ID (which start with "com." and use them in the next command.

Type "systemextensionsctl uninstall TEAMID BUNDLEID" substituting the TEAMID and BUNDLEID with the ones from above. Do the uninstall command on all extensions you want removed. Quit Terminal.

  • BOOT INTO RECOVERY MODE
  • ENABLE SIP

In the menu bar of the Recovery Mode, choose Utilities > Terminal.

Enter the command "csrutil enable"

Quit Terminal by going to Terminal > Quit

  • RESTART



16 replies
Sort By: 
Question marked as Top-ranking reply

Apr 5, 2023 3:55 PM in response to James Cook2

Looks like this is what it is going to take to get the job done. If you don't want to go down this path, I totally understand. You will have to boot into recovery mode, disable SIP, reboot, delete extension, reboot into recover, enable SIP, reboot. Here are detail steps.


  • BOOT INTO RECOVERY MODE

On Intel Mac, hold down Command - R on reboot. On Apple Silicon, hold power button while starting up until Options button appears. Click the button and continue, you may be asked to choose your startup drive.

  • DISABLE SIP

In the menu bar of the Recovery Mode, choose Utilities > Terminal.

Enter the command "csrutil disable"

Quit Terminal by going to Terminal > Quit

  • RESTART
  • OPEN TERMINAL

Enter the command "systemextensionsctl list". This will give you a list of the extensions. You will want to look for the Team ID and Bundle ID (which start with "com." and use them in the next command.

Type "systemextensionsctl uninstall TEAMID BUNDLEID" substituting the TEAMID and BUNDLEID with the ones from above. Do the uninstall command on all extensions you want removed. Quit Terminal.

  • BOOT INTO RECOVERY MODE
  • ENABLE SIP

In the menu bar of the Recovery Mode, choose Utilities > Terminal.

Enter the command "csrutil enable"

Quit Terminal by going to Terminal > Quit

  • RESTART



Reply

Apr 5, 2023 2:05 PM in response to James Cook2


Find Any File can help in removing leftover components of apps that have been deleted.  Do the following:  


#1 - boot into Safe Mode according to Start up your Mac in safe mode - Apple Support

NOTE: Safe Mode boot can take up to 10 minutes as it's doing the following:• Verifies your startup disk and attempts to repair directory issues, if needed

• Loads only required kernel extensions (prevents 3rd party kernel/extensions from loading)
• Prevents Startup Items and Login Items from opening automatically

• Disables user-installed fonts 
• Deletes font caches, kernel cache, and other system cache files

#2 - download and run the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the McAfee software you'd do the following search(es): 


1 - Name contains mcafee

2 - Name contains "name of app or whatever you see in the other reports"


Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.


FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  


#3 - reboot normally.


Reply

Apr 5, 2023 2:38 PM in response to James Cook2

Here are some things to try:

  • Go to  > System Settings > Privacy & Security > Extensions > Added Extensions. Disable any extensions related to McAfee.
  • Go to  > System Settings > General > Login Items. Remove related files there as well as the background processes below.
  • Startup in Safe Boot mode.
  • Paste these file locations one at a time in the Go to Folder window and delete any related files. Finder > Go > Go to Folder.

~/Library/Application Support

~/Library/LaunchAgents

~/Library/LaunchDaemons

~/Library/PreferencePanes

~/Library/Preferences

~/Library/StartupItems

  • If those 2 files you mentioned earlier still won't delete your can delete them in Terminal. There are no second chances doing it this way, so make sure deleting is what you want. Go to Terminal in the Utilities folder and type "sudo rm -rf ". Make sure you have a space BEFORE and AFTER the "-rf" and don't hit return yet. Now drag the problem file to the terminal window and it will fill in the path to the file. Now hit return.


You might also want to look through Safari settings to see if it installed any Notifications, Pop Ups, or Extensions. If you are unsure about a file, ask before deleting.


I agree a re-install would be a last resort and this process would be a lot to do on several Mac, but you may just find a couple of files like you have already identified that needs to be trashed. The booting in Safe Mode should not load the Extensions and make them easier to delete. Restarting is necessary to see the results when complete.

Reply

Apr 5, 2023 1:36 PM in response to IdrisSeabright

I did not reinstall the software as they suggest in the event of problems uninstalling. Their message that it was Successfully Uninstalled suggested that there were no problems. Nor have I contacted their tech support, I've been that route before and it was more time-consuming than it was helpful. The last time the technician even suggested that I'd find Malware Bytes more useful after asking me not to quote him.


As for browsers, this much later I can't say for sure but I did refer to their uninstall info, so I probably did have my browsers closed. On one of my Macs I very rarely use it for browsing and the results have been identical.


Regardless, on all three Macs, I'm stuck with com.mcafee.CMF.networkextension.systemextension or com.mcafee.CMF.networkextension and can't get rid of them.

Reply

Apr 5, 2023 1:43 PM in response to James Cook2

I feel your pain as I had a similar nightmare with Norton many years ago. That's way this sort of software gets no where near my Macs.


I would consider the re-install/un-install route. Obviously, the uninstall was not successful. I don't know that Malwarebytes would be useful in this situation but it's trustworthy software and there is a free version that works fine if you don't need something always scanning your computer. I download it when I need it, use it, and then delete it. It certainly wouldn't hurt to try.


Hopefully someone with more knowledge of this specific application will drop by.

Reply

Apr 5, 2023 1:50 PM in response to IdrisSeabright

The re-install/un-install route may be necessary but on three Macs that's a lot of trouble to get rid of those culprits.


For the moment I'll continue to look for other means to get rid of them, but fully aware of the possible need to go with the Full Monty.


BTW, Malwarebytes did do the job in removing some debris my wife had picked up. It was the reason I bought McAfee in the first place and then it didn't even do the job. Thus the whispered recommendation.

Reply

Apr 5, 2023 2:23 PM in response to Old Toad

I've been able to search the computers thoroughly using EasyFind so I hoped that Safe Mode was somehow the answer to being unable to delete the files. Not so. I chose to try it with Find Any File in the hope that it had some such capability. The searching is impressive but deleting remains limited.

Reply

Apr 5, 2023 2:20 PM in response to James Cook2

The company I worked for required McAfee on all company laptops. McAfee caused the vast majority of IT Support issues on the company Macs. Between performance issues, system panics, network disconnects, etc....


Eventually, then switched away from McAfee. They still require an A/V product, which for most users does not cause the same pain (but some employees still experience performance issues), but I'm not going to give them free advertising, as personally, as I think it is just there to Cover the company's Corporate @$$, in case of a lawsuit.


My personal Macs do not run any 3rd party anti-virus or malware. I depend on Apple's built-in protections, and my own common-sense.

Reply

Apr 5, 2023 2:51 PM in response to James Cook2

This discussion should be flagged for every user looking for advice on installing anti-virus software. We see it every day here in these forums. It usually does not end well and when things seem ok, the next OS update could cause unexpected results. Stick with your Firewall, you can monitor and deny incoming connections, and maintain safe browsing practices. Your good!


To James Cook2: We are here for you and will help in any way we can to get you up and running.

Reply

A McAfee Nightmare

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.