Removing McAfee antivirus from a Mac
March 13, 2010
I needed to do this to see if it was causing an Eclipse slowdown — if I don’t check, everyone is just going to blame McAfee. Search on the net pointed to some dubious-looking sites. So I went DIY, with lots of as-root find commands, and looking at all the processes probing the internet for updates (Little Snitch) and running in “ps”.
I don’t know anyone who would willingly run this stuff on a Mac, so I assume that you got yours as a mandate from your employer, as I did, thus the warning, and thus the non-absolute paths. This must be run as root, at the root of a disk drive; in my case, a backup drive, so that the NSFW no-antivirus state is never applied to the disk on the laptop itself, and cannot be accidentally forgotten.
It’s also a pretty amusing tutorial in all the ways you could start something under MacOS — StartupItems, LaunchDaemons, LaunchAgents, and /etc
It ought to go without saying, that you run this script at your own risk. I have never applied it to a live system disk running antivirus, so I have no idea what would happen if you did that.
echo "DO NOT CONNECT TO CORPORATE NET BOOTED FROM THIS DRIVE TILL MCAFEE IS RESTORED." mkdir -p Disabled/Library/StartupItems mkdir -p Disabled/etc mkdir -p Disabled/Library/McAfee mkdir -p Disabled/Library/Application\ Support/McAfee mkdir -p Disabled/usr/local mkdir -p Disabled/Library/LaunchAgents mkdir -p Disabled/Library/LaunchDaemons mkdir -p Disabled/Library/Preferences mv Library/StartupItems/cma Disabled/Library/StartupItems/ mv etc/cma.d Disabled/etc/ mv etc/cma.conf Disabled/etc/ mv Library/McAfee Disabled/Library/ mv Library/.McAfee Disabled/Library/ mv Library/Application\ Support/McAfee Disabled/Library/Application\ Support/ mv usr/local/McAfee Disabled/usr/local mv Library/LaunchAgents/com.mcafee.menulet.plist Disabled/Library/LaunchAgents/ mv Library/LaunchAgents/com.mcafee.reporter.plist Disabled/Library/LaunchAgents/ mv Library/LaunchDaemons/com.mcafee.ssm.Eupdate.plist Disabled/Library/LaunchDaemons/ mv Library/LaunchDaemons/com.mcafee.ssm.ScanManager.plist Disabled/Library/LaunchDaemons/ mv Library/LaunchDaemons/com.mcafee.virusscan.fmpd.plist Disabled/Library/LaunchDaemons/ mv Library/Preferences/.com.mcafee.antimalware.license Disabled/Library/Preferences/ mv Library/Preferences/com.mcafee.ssm.antimalware.plist Disabled/Library/Preferences/ # employer-specific to prevent accidental automated reinstall during benchmarking. mkdir -p Disabled/opt mv Library/StartupItems/mdc Disabled/Library/StartupItems/ mv opt/desktop Disabled/opt/
Oddly enough, in the process of snooping through the code, I found what appears to be the uninstaller. However, it is rooted at an absolute path, and is not suitable for my needs, since I need to apply this to a backup, not the root.