Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
OSX McAfee Removal

Removal of McAfee from OSX

Note: This was written in 2015, it may be out of date now.

There are a lot of commands here which I use sudo if you don't know what you're doing with sudo, especially where I rm you can severely screw up your system.

There are many reasons which you would want to remove a piece of software such as McAfee, such as not wanting it to hammer your CPU during work hours which seems like primetime for a virus scan.

I intend this to be a living document, I have included suggestions from peoples' replies.

Uninstall

You can attempt to uninstall, but it may not work randomly. There's an uninstaller you can download, it never worked properly for me.

Per @ryenus try:

/Library/McAfee/agent/scripts/uninstall.sh
/usr/local/McAfee/fmp/bin/unInstallFMP

Per @mirnujAtom try:

sudo /usr/local/McAfee/uninstall EPM

Per @javaswinger try any or all of the following:

All Modules

sudo /usr/local/McAfee/uninstall EPM

Threat Prevention Module

sudo /usr/local/McAfee/uninstall ThreatPrevention

Firewall Module

sudo /usr/local/McAfee/uninstall Firewall

Web Control Module

sudo /usr/local/McAfee/uninstall WebControl

launchd Services

There are both local and root level launchd services. Thanks @rynosoft for finding some more which I missed.

Local User Level

launchctl stop com.mcafee.menulet
launchctl stop com.mcafee.reporter

launchctl remove com.mcafee.menulet
launchctl remove com.mcafee.reporter

Root Level

sudo su -

launchctl stop com.mcafee.virusscan.fmpd
launchctl stop com.mcafee.ssm.ScanManager
launchctl stop com.mcafee.virusscan.ssm.ScanFactory
launchctl stop com.mcafee.ssm.Eupdate
launchctl stop com.mcafee.agent.macompat
launchctl stop com.mcafee.agent.ma
launchctl stop com.mcafee.agent.macmn

launchctl remove com.mcafee.virusscan.fmpd
launchctl remove com.mcafee.ssm.ScanManager
launchctl remove com.mcafee.virusscan.ssm.ScanFactory
launchctl remove com.mcafee.ssm.Eupdate
launchctl remove com.mcafee.agent.macompat
launchctl remove com.mcafee.agent.ma
launchctl remove com.mcafee.agent.macmn

Finding More Services

As this document may be out of date by the time you find it, try these to find more mcafee garbage.

launchctl list | grep mcafee
sudo launchctl list | grep mcafee

You can use similar steps as above to stop and remove them.

Files

Aside from the services, there will be a shit-ton of files left on the file system.

You can search and destroy mcafee stuff with this:

find / -name "com.mcafee*" -exec rm {} \; -print

You may not have access to all of those files, you can sudo find... to elevate your privileges.

Per @jlevy if you are using TimeMachine, you'll want to ignore those back-ups.

sudo find / -name "*MobileBackup*" -prune -or -name "com.mcafee*" -print > /tmp/to-delete

You can cat /tmp/to-delete to show what you should delete.

Per @javaswinger consider finding just *mcafee* instead of com.mcafee* for a more complete list.

sudo find / -type f -name '*mcafee*' -print

Fix McAfee Runaway Process

Per @TimLethbridge you can fix mcafee's runaway process by modifying some permissions.

cd /usr/local
sudo chown -R root McAfee
sudo reboot

Block Corp Policies

@alexellis asked how to block corp policies from re-installing McAfee.

This is outside of the scope of this document. If you are on a corporate network screwing around with policies may result in a strong lecture or even cost you your job, depending on your field.

I have some theories involving setting up non-domain level users on the system, but I don't have a lab to do the testing and I primarily use Linux now, so I don't care enough try it.

Conculsion

Fuck McAfee.

@pjobson

This comment has been minimized.

Copy link
Owner Author

@pjobson pjobson commented Apr 22, 2014

How to remove McAfee from OSX from the commandline.

@ericjsilva

This comment has been minimized.

Copy link

@ericjsilva ericjsilva commented Oct 7, 2014

Thank you. Thank you.

@wyleung

This comment has been minimized.

Copy link

@wyleung wyleung commented Nov 19, 2014

Thank you! McAfee was running crazy on Yosemite...

@carkmorwin

This comment has been minimized.

Copy link

@carkmorwin carkmorwin commented Jan 29, 2015

I ❤️ you @pjobson

@MrP

This comment has been minimized.

Copy link

@MrP MrP commented Jan 30, 2015

This is gold

@pjobson

This comment has been minimized.

Copy link
Owner Author

@pjobson pjobson commented Jun 24, 2015

Glad you enjoyed.

Today McAfee randomly re-appeared... no clue how, I didn't reinstall it. Re-running the commands made it go away again.

Added a find and delete. On my system the following were found:

/Library/LaunchAgents/com.mcafee.menulet.plist
/Library/LaunchAgents/com.mcafee.reporter.plist
/Library/LaunchDaemons/com.mcafee.agent.cma.plist
/Library/LaunchDaemons/com.mcafee.ssm.Eupdate.plist
/Library/LaunchDaemons/com.mcafee.ssm.ScanFactory.plist
/Library/LaunchDaemons/com.mcafee.ssm.ScanManager.plist
/Library/LaunchDaemons/com.mcafee.virusscan.fmpd.plist
/Library/Preferences/com.mcafee.ssm.antimalware.plist
/private/var/db/receipts/com.mcafee.mscui.bom
/private/var/db/receipts/com.mcafee.mscui.plist
/private/var/db/receipts/com.mcafee.ssm.fmp.bom
/private/var/db/receipts/com.mcafee.ssm.fmp.plist
/private/var/db/receipts/com.mcafee.virusscan.bom
/private/var/db/receipts/com.mcafee.virusscan.plist
/Users/pjobson/Library/Caches/com.apple.helpd/SDMHelpData/Other/English/HelpSDMIndexFile/com.mcafee.virusscanhelp
/Users/pjobson/Library/Preferences/com.mcafee.console.plist
/Users/pjobson/Library/Preferences/com.mcafee.McAfeeReporter.plist

Had to manually remove this one as it is a directory and I didn't want to -rf in the instructions.

rm -rf /Users/pjobson/Library/Caches/com.apple.helpd/Generated/com.mcafee.virusscanhelp

@fxstein

This comment has been minimized.

Copy link

@fxstein fxstein commented Aug 20, 2015

Thank you!

FYI Would suggest to exclude Time Machine Backups data from the deletes:

/Volumes/MobileBackups/Backups.backupdb/...

@tomichal

This comment has been minimized.

Copy link

@tomichal tomichal commented Aug 30, 2015

Thank you.

@zacparker

This comment has been minimized.

Copy link

@zacparker zacparker commented Sep 29, 2015

Thanks!

@ryenus

This comment has been minimized.

Copy link

@ryenus ryenus commented Oct 9, 2015

Some related scripts:

/Library/McAfee/agent/scripts/uninstall.sh
/usr/local/McAfee/fmp/bin/unInstallFMP
@akeschmidi

This comment has been minimized.

Copy link

@akeschmidi akeschmidi commented Oct 20, 2015

Thx great!

@bashcoder

This comment has been minimized.

Copy link

@bashcoder bashcoder commented Feb 4, 2016

Very thankful for this. El Capitan completely broke McAfee, including the uninstaller. And guess what upgrading to the latest version does first? It tries to uninstall the old version and fails. Meanwhile the daemons still tried to hog all system resources. The only reason I used McAfee on OSX was to pass muster with a client's VPN gateway, but I'll find another way. Thanks again!

@mirnujAtom

This comment has been minimized.

Copy link

@mirnujAtom mirnujAtom commented Mar 22, 2016

sudo /usr/local/McAfee/uninstall EPM
helped me.

@jlevy

This comment has been minimized.

Copy link

@jlevy jlevy commented Jun 28, 2016

Thanks! For the find and remove part, I'd instead suggest:

sudo find / -name "*MobileBackup*" -prune -or -name "com.mcafee*" -print > /tmp/to-delete

and looking at the list before removing the items in it. Seems you really need to exclude Time Machine stuff like /.MobileBackups, if you don't want to freak out mtmfs: http://apple.stackexchange.com/questions/18846/mtmfs-consuming-an-entire-cpu-core-and-fans-running-full-bore-with-lion

@TimLethbridge

This comment has been minimized.

Copy link

@TimLethbridge TimLethbridge commented Sep 17, 2016

If you are doing this it might be because you have a runaway process and/or McAfee won't launch. For me that was caused by following directions whereby homebrew told me to change ownership (recursively) to my userid. It turns out following those instructions causes McAfee to fail to relaunch after the next reboot, and fmpd to run at 100%

I was able to fix McAfee by doing
cd /usr/local; sudo chown -R root McAfee
and then reboot

@rynosoft

This comment has been minimized.

Copy link

@rynosoft rynosoft commented Nov 11, 2016

I still had 3 processes being launched so I added the following to the "su" section:

stop com.mcafee.agent.macompat
launchctl remove com.mcafee.agent.macompat
launchctl stop com.mcafee.agent.ma
launchctl remove com.mcafee.agent.ma
launchctl stop com.mcafee.agent.macmn
launchctl remove com.mcafee.agent.macmn

@alexellis

This comment has been minimized.

Copy link

@alexellis alexellis commented Jul 11, 2017

Is there a good way to prevent corporate policy from re-installing McAfee on the Mac? Any ports we can block or re-route to 127.0.0.1?

@javaswinger

This comment has been minimized.

Copy link

@javaswinger javaswinger commented Aug 25, 2017

this is absolutely wonderful ❤️

I used this command to make sure everything was removed after I rebooted:

sudo find / -type f -name '*mcafee*' -print

Which pointed out more files that need to be removed:

/Library/Application\ Support/McAfee
/Library/Preferences/com.mcafee*
/Library/Preferences/.com.mcafee*
~/Library/Caches/com.apple.helpd/Generated/com.mcafee*
/Users/Shared/.mcafee
/usr/local/McAfee

I just discovered that all of these steps did not really remove McAfee as it should have. The McAfee product guide suggests running these commands (of course these must be done before deleting /usr/local/McAfee:

  • All modules: sudo /usr/local/McAfee/uninstall EPM
  • Threat Prevention: module sudo /usr/local/McAfee/uninstall ThreatPrevention
  • Firewall module sudo: /usr/local/McAfee/uninstall Firewall
  • Web Control module: sudo /usr/local/McAfee/uninstall WebControl

You can turn off the "McAfee Web Control" in Safari at Preferences > Security > Plug-In Settings

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/26000/PD26509/en_US/ensm_1020_pg_0-00_en-us.pdf

@vidanovic

This comment has been minimized.

Copy link

@vidanovic vidanovic commented Oct 25, 2017

Thank you!

@stran12

This comment has been minimized.

Copy link

@stran12 stran12 commented Nov 28, 2017

Thank you!!

@jbherman

This comment has been minimized.

Copy link

@jbherman jbherman commented Dec 15, 2017

thanks!

@pjobson

This comment has been minimized.

Copy link
Owner Author

@pjobson pjobson commented Feb 4, 2018

I'm so happy that so many people are enjoying this gist!

@MarqueIV

This comment has been minimized.

Copy link

@MarqueIV MarqueIV commented Mar 20, 2018

You have no idea, my friend! I develop for iOS and Android and McAfee seems as if it's personally trying to stop me from being able to be productive. Even turning it off, moments later it would come right back on again. This however seems to have done the trick. It's odd being able to use your CPU to it's true capacity for actual compilation and not checking yet again the same $@#@#% files to see if there's a virus every freaking time I try and build.

TLDR: Thank you, kind sir. Thank you a thousand times over.

@lynndixon

This comment has been minimized.

Copy link

@lynndixon lynndixon commented May 15, 2018

Love it.!

@mqharrisa

This comment has been minimized.

Copy link

@mqharrisa mqharrisa commented Dec 17, 2018

If you just want to stop McAfee without uninstalling (i.e. it's not yours to uninstall) but have root access you can do the following:

sudo launchctl unload /Library/LaunchDaemons/*mcafee*
sudo /usr/local/McAfee/AntiMalware/VSControl stopoas

The important part is that you unload all the daemons not just stop them. Unloading will disable them until you restart.

One of those daemons is the McAfee agent, which is the daemon the listens to the enterprise server (if you have an enterprise deployment) and will restart everything according to the server's instructions. If you don't stop this, all the services will reactive when it checks again.

@kahluagenie

This comment has been minimized.

Copy link

@kahluagenie kahluagenie commented Mar 6, 2019

The fact this exists brings my hope in humanity back. Thank you!
I modified the find command a bit to be case insensitive and look for all mcafee occurrences to find things like /usr/local/McAfee
It will fail on directories, but will output the message that you can then use to rm -rf manually.

sudo find / -iname "*mcafee*" -exec rm {} \; -print

@ryanbrady1027

This comment has been minimized.

Copy link

@ryanbrady1027 ryanbrady1027 commented Aug 29, 2019

You have done a great service for the world. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.