Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed Symantec Antivirus on my Mac (mid-2009 MacBook Pro) running Snow Leopard (10.6.2) via a work-provided software gizmo - along with some other software. I've had nothing but trouble since the installers ran into some problem while unpacking Firefox 3.5.7, which I also tried to install via the same work-provided software at the same time. I removed the Symantec software folders because it was not clear that anything had worked, but the Symantec scanner still managed to start up after a reboot - and still shows up in System Preferences.

I went to the Symantec site via a Google search and found a page about removing Symantec Antivirus from the Mac. I downloaded the uninstaller '.sit' file, and I've run it, but it can't find the Symantec software on the disk. Neither can I - it isn't in /Applications or /Applications/Utilities that I can see. But the O/S can - it runs the program.

  • Any ideas on how to actually get rid of it?
  • Do I need to reinstall it so that the correct uninstaller is available after all?

I also found a directory in /private/tmp belonging to 'the software gizmo' - but I can't remove it, not even with root privileges, because it is mounted on a 'read-only file system' (according to the error messages). Actually, it is part of the root (and only) file system, which is not generally read-only. Any ideas on what needs to be done to be able to get rid of the stuff (like a dubious copy of Firefox 3.5.7) from under there? Or how an area of the file system can be marked 'read-only'?

It is my Mac - I paid for it because I couldn't get the company to buy me one, even though we needed some Macs to get our software running on Mac. They bought some for builds etc, but were not willing to let me have one to show to customers, etc.

share|improve this question
up vote 2 down vote accepted

Are you able to right click on the System Preference and choose remove? That's the easiest way to get rid of it.

The startup scripts might be scattered in a handful of locations:

  • ~/Library/LaunchDaemons
  • ~/Library/LaunchAgents
  • /Library/LaunchDaemons
  • /Library/LaunchAgents
  • /Library/StartupItems
  • /System/Library/LaunchDaemons
  • /System/Library/LaunchAgents
  • /System/Library/StartupItems

When you find them, take a look at the files as they likely have the path to the binaries in them.

Alternatively to typing the following commands, you can trash the files and reboot.

However, to avoid an unnecessary reboot …

If the software is in any of the Launch-named directories, you should use this to disable them:

sudo launchctl unload -w /path/to/launchd/plist

This will shutdown the software and mark it to never startup automatically. You can safely trash the plist after you've unloaded it.

If it was in a StartupItems folder you'll use:

sudo SystemStarter stop SERVICE

Once stopped you can trash the files.

share|improve this answer
Right click is equivalent to Control-Click - so I can do that, and was able to remove the System Preference items. I found one of the (other) bits of software that I want to get rid of in /Library/LaunchDaemons; I think I found the Symantec ones in /Library/StartupItems - the other directories looked clean. Thanks for the excellent assistance. – Jonathan Leffler Jan 14 '10 at 7:14

Because your question is one of the top hits for "disabling" it (ie, one time) I'm going to add this here for other future googlers.

You can also disable it (until next reboot) using launchctl

See this script by @steve-jansen

Archived below just incase gets deleted:


# relaunch with sudo if we aren't root
if [[ $EUID -ne 0 ]]; then
   echo "$0: relaunching as sudo $0 $1 $USER"
   sudo "$0" $1 $USER
   exit $?

if [ -n "$2" ]; then

stop() {
  echo $0: unloading Symantec Endpoint Protection daemon
  launchctl unload /Library/LaunchDaemons/

  echo $0: unloading Symantec Endpoint Protection shared settings daemon
  launchctl unload /Library/LaunchDaemons/

  echo $0: closing Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl unload /Library/LaunchAgents/

start() {
  echo $0: loading Symantec Endpoint Protection daemon
  launchctl load /Library/LaunchDaemons/

  echo $0: loading Symantec Endpoint Protection shared settings daemon
  launchctl load /Library/LaunchDaemons/

  echo $0: launching Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl load /Library/LaunchAgents/

case "$1" in
    echo "Usage: $0 [start|stop]"
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .