Removing Symantec Antivirus from a Mac?

Question

I installed Symantec Antivirus on my Mac (mid-2009 MacBook Pro) running Snow Leopard (10.6.2) via a work-provided software gizmo - along with some other software. I've had nothing but trouble since the installers ran into some problem while unpacking Firefox 3.5.7, which I also tried to install via the same work-provided software at the same time. I removed the Symantec software folders because it was not clear that anything had worked, but the Symantec scanner still managed to start up after a reboot - and still shows up in System Preferences.

I went to the Symantec site via a Google search and found a page about removing Symantec Antivirus from the Mac. I downloaded the uninstaller '.sit' file, and I've run it, but it can't find the Symantec software on the disk. Neither can I - it isn't in /Applications or /Applications/Utilities that I can see. But the O/S can - it runs the program.

• Any ideas on how to actually get rid of it?
• Do I need to reinstall it so that the correct uninstaller is available after all?

I also found a directory in /private/tmp belonging to 'the software gizmo' - but I can't remove it, not even with root privileges, because it is mounted on a 'read-only file system' (according to the error messages). Actually, it is part of the root (and only) file system, which is not generally read-only. Any ideas on what needs to be done to be able to get rid of the stuff (like a dubious copy of Firefox 3.5.7) from under there? Or how an area of the file system can be marked 'read-only'?

---

It is my Mac - I paid for it because I couldn't get the company to buy me one, even though we needed some Macs to get our software running on Mac. They bought some for builds etc, but were not willing to let me have one to show to customers, etc.

Answer 1

Are you able to right click on the System Preference and choose remove? That's the easiest way to get rid of it.

The startup scripts might be scattered in a handful of locations:

• ~/Library/LaunchDaemons
• ~/Library/LaunchAgents
• /Library/LaunchDaemons
• /Library/LaunchAgents
• /Library/StartupItems
• /System/Library/LaunchDaemons
• /System/Library/LaunchAgents
• /System/Library/StartupItems

When you find them, take a look at the files as they likely have the path to the binaries in them.

Alternatively to typing the following commands, you can trash the files and reboot.

However, to avoid an unnecessary reboot …

If the software is in any of the Launch-named directories, you should use this to disable them:

sudo launchctl unload -w /path/to/launchd/plist

This will shutdown the software and mark it to never startup automatically. You can safely trash the plist after you've unloaded it.

If it was in a StartupItems folder you'll use:

sudo SystemStarter stop SERVICE

Once stopped you can trash the files.

Answer 2

Because your question is one of the top hits for "disabling" it (ie, one time) I'm going to add this here for other future googlers.

You can also disable it (until next reboot) using launchctl

See this script by @steve-jansen

Archived below just incase gets deleted:

#!/bin/bash

# relaunch with sudo if we aren't root
if [[ $EUID -ne 0 ]]; then
   echo "$0: relaunching as sudo $0 $1 $USER"
   sudo "$0" $1 $USER
   exit $?
fi

real_user=$USER
if [ -n "$2" ]; then
  real_user=$2
fi

stop() {
  echo $0: unloading Symantec Endpoint Protection daemon
  launchctl unload /Library/LaunchDaemons/com.symantec.symdaemon.plist

  echo $0: unloading Symantec Endpoint Protection shared settings daemon
  launchctl unload /Library/LaunchDaemons/com.symantec.sharedsettings.plist

  echo $0: closing Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl unload /Library/LaunchAgents/com.symantec.uiagent.application.plist
}

start() {
  echo $0: loading Symantec Endpoint Protection daemon
  launchctl load /Library/LaunchDaemons/com.symantec.symdaemon.plist

  echo $0: loading Symantec Endpoint Protection shared settings daemon
  launchctl load /Library/LaunchDaemons/com.symantec.sharedsettings.plist

  echo $0: launching Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl load /Library/LaunchAgents/com.symantec.uiagent.application.plist
}

case "$1" in
  start)
    start
    ;;
  stop)
    stop
    ;;
  *)
    echo "Usage: $0 [start|stop]"
    ;;
esac