How can I login as a root user to remove extensions?

garryrev wrote:

when I try to delete them, I get the "you do not have permission" message, even with my admin login. This is driving me nuts. I thought Norton was invasive, this TotalAV is much worse.

This sounds like a System Extension. If you are really running macOS Sequoia as your signature says, then you can delete orphan System Extensions in System Settings > General > Login Items & Extensions > Extensions.

I don't have any extensions installed, so I can't remember if the button is the "i" button or the "…" button. But I do know it's tiny. Click on that to reveal yet another hidden menu which will have an option to remove the extension. Make sure to restart after removing extensions.

I'm sure you have other parts installed in various other locations. The Safari piece is probably a Safari extensions. Your EtreCheck report will show any other parts along with the path to find them.

There's a lot to unpack here, and it's not as straightforward as you might expect.

Generally, logging in as root is ill-advised. If you have to, consider using sudo in Terminal.app since it gives elevated privileges in a somewhat more contained manner.

Even that may not be sufficient, though, depending on the problem. For example, system-related files are actually stored on a read-only partition, so not even root can change them. You have to jump through a few hoops and reconfigure the system to disable SIP (System Integrity Protection) mode to change these files.

Without knowing the files you're trying to remove, it's hard to tell if that's what you'll need to do - it should be hard for malware to infect the system partition, so it should be unlikely that you need to do that, hence the question.

If your admin users can't remove the items, root can't either.

When you authenticate your admin account, it elevates your privileges to that of root, so there would be no difference logging in as root.

Where are the extensions located? There are many place you cannot modify, even as root.

Please run Etrecheck and post its full report here.

Use the “additional text” button and paste the report into the text box.

This should tell us where these files are, so we can better advise on how to eradicate them.

, deleted the app, and removed any hidden files I could find.

Why didn’t you use their uninstaller?

EtreCheck can't see into Safari or other web browsers. You will have to go to Safari > Settings > Extensions to review your extensions. I assume Brave has something similar.

etresoft wrote:

... I assume Brave has something similar.

FYI ... It does: "Hamburger" icon > Extensions > Manage Extensions

garryrev wrote:

couldn't find an uninstaller at the time.

That’s a failure from the start. If an app needs a password to install, you should determine if it has an uninstaller before you proceed.