Home

Removing McAfee antivirus from a Mac

March 13, 2010

I needed to do this to see if it was causing an Eclipse slowdown — if I don’t check, everyone is just going to blame McAfee. Search on the net pointed to some dubious-looking sites. So I went DIY, with lots of as-root find commands, and looking at all the processes probing the internet for updates (Little Snitch) and running in “ps”.
I don’t know anyone who would willingly run this stuff on a Mac, so I assume that you got yours as a mandate from your employer, as I did, thus the warning, and thus the non-absolute paths. This must be run as root, at the root of a disk drive; in my case, a backup drive, so that the NSFW no-antivirus state is never applied to the disk on the laptop itself, and cannot be accidentally forgotten.

It’s also a pretty amusing tutorial in all the ways you could start something under MacOS — StartupItems, LaunchDaemons, LaunchAgents, and /etc

It ought to go without saying, that you run this script at your own risk. I have never applied it to a live system disk running antivirus, so I have no idea what would happen if you did that.

echo "DO NOT CONNECT TO CORPORATE NET BOOTED FROM THIS DRIVE TILL MCAFEE IS RESTORED."

mkdir -p Disabled/Library/StartupItems
mkdir -p Disabled/etc
mkdir -p Disabled/Library/McAfee
mkdir -p Disabled/Library/Application\ Support/McAfee
mkdir -p Disabled/usr/local
mkdir -p Disabled/Library/LaunchAgents
mkdir -p Disabled/Library/LaunchDaemons
mkdir -p Disabled/Library/Preferences

mv Library/StartupItems/cma Disabled/Library/StartupItems/

mv etc/cma.d                Disabled/etc/
mv etc/cma.conf             Disabled/etc/
mv Library/McAfee           Disabled/Library/
mv Library/.McAfee          Disabled/Library/
mv Library/Application\ Support/McAfee  Disabled/Library/Application\ Support/
mv usr/local/McAfee         Disabled/usr/local

mv Library/LaunchAgents/com.mcafee.menulet.plist        Disabled/Library/LaunchAgents/
mv Library/LaunchAgents/com.mcafee.reporter.plist       Disabled/Library/LaunchAgents/
mv Library/LaunchDaemons/com.mcafee.ssm.Eupdate.plist   Disabled/Library/LaunchDaemons/
mv Library/LaunchDaemons/com.mcafee.ssm.ScanManager.plist  Disabled/Library/LaunchDaemons/
mv Library/LaunchDaemons/com.mcafee.virusscan.fmpd.plist   Disabled/Library/LaunchDaemons/

mv Library/Preferences/.com.mcafee.antimalware.license Disabled/Library/Preferences/
mv Library/Preferences/com.mcafee.ssm.antimalware.plist Disabled/Library/Preferences/

# employer-specific to prevent accidental automated reinstall during benchmarking.
mkdir -p Disabled/opt
mv Library/StartupItems/mdc Disabled/Library/StartupItems/
mv opt/desktop              Disabled/opt/

Oddly enough, in the process of snooping through the code, I found what appears to be the uninstaller. However, it is rooted at an absolute path, and is not suitable for my needs, since I need to apply this to a backup, not the root.

2 Responses to “Removing McAfee antivirus from a Mac”

  1. Ric G Says:

    I can confirm that this does work. The uninstall.sh you found does not remove the LaunchAgents and LauchDaemons and leaves the system in a rather unstable state.

    I needed this info to troubleshoot some enterprise console communication and client deployment issues and, as far as I could find, it’s not documented anywhere else.

    Great work!

  2. Graham Ansell Says:

    Using this information and deleting the various files manually worked for me, thanks for sharing.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: