Problem with Removal of Norton 360 from iMac Ventura 13.4

Question

Level 1

7 points

Problem with Removal of Norton 360 from iMac Ventura 13.4

Can anyone help with this problem?

I was running Norton 360 successfully on iMac Ventura 13.3. When I upgraded to 13.4 it stopped working, stuck in a ‘paused’ state. (My iMac was taking a long time to boot, and crashing a couple of times during booting and rebooting, so I wanted to eliminate Norton from the equation and completely remove).

I followed instruction from Norton on how to remove the installation – here:

https://support.norton.com/sp/en/us/home/current/solutions/v105332768

The uninstall didn’t run quite as the article said it should – I didn’t get the uninstall prompt or asked to click on uninstall helper. But app was binned.

I then ran the Norton remove tool in terminal and it removed the system files.

Norton is no longer installed.

However, my mac is still taking a very long time to reboot so checked the logs and ran EtreCheckPro version: 6.8.1 . It reports that Symantec is still installed and a system extension still running, although the app is no longer there.

This is the clip from that report:

Security:

Gatekeeper: App Store and identified developers

System Integrity Protection: Enabled

Antivirus software: Apple, Symantec, and CleanMyMac

System Extensions:

[Running] SymantecEndpointSecurity - version 9.1.0 (NortonLifeLock, Inc.)

Application: /Applications/Norton Security.app - version 9.1.0 (Not found!)

Description: [placeholder]Symantec Endpoint Security system extension[placeholder]

Diagnostics Information (past 7-30 days):

2023-05-20 14:37:28 com.symantec.mes.systemextension - Crash (50 times)

I then found this solution relating to the problem and the com.symantec.mes.systemextension:

How to remove com.symantec.ms.systemexten… - Apple Community

As this article is old and requires running some terminal commands, I wondered if anyone has any advice on whether this will likely work or any other suggestions to remove the Symantec system extension.

Might it be better to try and re-install Norton again and then remove, following the Norton kb at the top of this article?

Any advice welcome before I waste more time on this.

Thanks

iMac 24″, macOS 13.4

Posted on May 20, 2023 10:32 AM

Reply

Answer 1

Top-ranking reply

Mac Jim ID

Level 9

62,288 points

May 20, 2023 12:12 PM in response to Tosh.SE1

Along with removing Norton/Symantec files you will also want to remove all files related to CleanMyMac. This is based on multiple user reports and problems you have encountered when trying to uninstall. For CleanMyMac, you can start with the uninstaller provided, but it will not remove all of the files like you have discovered with Norton. Norton does install a System Extension that can only be removed by disabling SIP as described in the second article you linked. The article calls it SPI, but it is System Integrity Protection (SIP). The process to do that are the same in Terminal, but the team ID names may be different. Of course you will want a backup of your system before attempting any action that changes system files.

Assuming a Clean Install is not an option for you and you want to try to remove them, I can offer these steps and welcome input from other users.

Start with trying to remove the system extension using the link in your second article. It does require starting in recovery mode and entering the terminal command "csrutil disable". As I said the Team ID might not match what is in the article, so you can enter "systemextensionsctl list" into Terminal to get the Team ID and Bundle ID of the file, followed by "systemextensionsctl uninstall TEAMID BUNDLEID" where the TEAMID and BUNDLEID are the ones from the previous command. Make sure you have the spaces in the command. Also make sure you enable SIP again with the "csrutil enable" command.
Start up Mac in Safe Mode. How to use safe mode on your Mac - Apple Support
Go to each of these locations by copying and going to Finder > Go > Go to Folder and pasting the location. Delete any file or folder that includes the name Symantec, Norton, MacPaw, and CleanMyMac. Include the "~" character when shown.

~/Library/Application Support/

~/Library/LaunchAgents/

/Library/Application Support/

/Library/LaunchAgents/

/Library/LaunchDaemons/

/Library/StartupItems/

Remove CleanMyMac from Application folder if still there after running their uninstaller
Restart computer and run EtreCheck again to see if all files removed

Reply

Answer 2

Tosh.SE1 Author

Level 1

7 points

May 21, 2023 4:24 AM in response to Mac Jim ID

Thanks for the helpful advice and comments.

I followed all the steps outlined in the posts and have successfully removed the offending Norton/Symantec system extension and related files. Etrecheck confirms Norton is no longer registered as an anti-virus programme.

A couple of clarifications in case anyone else does this:

1) The csrutil command can only be run in RECOVERY mode. Also be aware that to access the TERMINAL window in the recovery mode, you have to select the TOOLS option from the menu at the top of the recovery screen and then select TERMINAL. Type csrutil disable, enter your password, answer 'y' to the question and when complete shutdown and restart Mac as normal.

2) When rebooted normally open the TERMINAL application and type systemextensionsctl list to get the Team ID and Bundle ID of the symantec extension. Next type the command "systemextensionsctl uninstall TEAMID BUNDLEID" where TEAMID and BUNDLEID are taken from the earlier list command .

In my case systemextensionsctl uninstall 9PTGMPNXZ2 com.symantec.mes.systemextension. Enter your password and wait till it finishes.

3) Run EtreCheck again to confirm the system extension has gone and the Mac no longer sees it as an AV application.

4) Search for files containing Norton, Symantec as OPs suggest. FindanyFile is a great tool to do this. Move to TRASH.

The next step is ESSENTIAL so don't forget it:

5) Shutdown and reboot again in RECOVERY mode. Run TOOLS and then TERMINAL and type csrutil enable, accept the question with 'y'. Wait till complete and then shutdown again. Restart as normal.

Norton has now been completely removed from my iMac.

I will shortly repeat the above with CleanMyMac.

Thanks for all the help.

Reply

Answer 3

Old Toad

Level 10

215,718 points

May 20, 2023 2:27 PM in response to Tosh.SE1

Antivirus software: Apple, Symantec, and CleanMyMac

As Mac Jim ID recommended remove CMM and Symantec files. You can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name. For the software mentioned you'd do the following search(es):

1 - Name contains norton

2 - Name contains symantec

3 - Name contains cleanmymac

4 - Name contains macpaw

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.

Note: if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode. This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.

Reply

Answer 4

Owl-53

Level 10

103,081 points

May 21, 2023 1:57 AM in response to Tosh.SE1

As the computer has both Norton AV software and CleanMyMac installed and used on this machine.

The user can spend a great deal of time trying to Fix the issue caused by Both Applications.

Though, this could be like trying to Disable a Land Mine. It could blow up in your face at any time.

Specific to CleanMyMac aka “ BrickMyMac “

The steps in #1 below is predicated on the Offending Applications has been Removed as per the Developers Specific Instruction

# 1 Some Contributors suggest restarting in Recovery Mode and choosing to Reinstall the Operating System over the existing installation.

This may or may not replace elements of the Entire Operating System including the Home Folder ( User Account ) and replace any corrupted or removed elements of the Operating System and make thing right.

#2 - Then there are Other Contributors ( like myself ) would suggest from this link Use Disk Utility to erase a Mac with Apple silicon.

For Intel computer >> Use Disk Utility to erase an Intel-based Mac followed by How to reinstall macOS

Thereafter to start from scratch and install all Required Application directly from the Apple Apps Store or Directly from the Developer.

If going this route - I suggest Not using Startup Assist to migrate things back as this will probably Re-Introduce the existing issue that existed when the TM Backup was made

Reply