Mac OS X,  Mac Security,  Mass Deployment

Removing Norton AntiVirus with a Script

For some reason the uninstaller from Symantec doesn’t work in removing Norton (NAV 10). My guess, without delving into their uninstaller too deeply is that they ran into what I ran into, which is that the com.symantec.* processes are prefixed by a bracketed alphanumeric sequence. To get around this I listed them and used grep to grab each one, then awk to grab the label and did a launchctl stop against the label name once I had it. The rest of this script is pretty straight forward forcing the rm of each of the contents of the items from the snapshot plus the items from the pkg BoM.  Here’s the script, or you can download it here:

#! /bin/bash
launchctl stop `launchctl list | grep com.symantec.SymSecondaryLaunch | awk ‘{print $3}’`
launchctl stop `launchctl list | grep com.symantec.scanNotification | awk ‘{print $3}’`
launchctl stop `launchctl list | grep com.symantec.diskMountNotify | awk ‘{print $3}’`
launchctl stop `launchctl list | grep com.symantec.quickmenu | awk ‘{print $3}’`
kextunload -b com.Symantec.SymEvent.kext
kextunload -b com.Symantec.SymOSXKernelUtilities.kext
kextunload -b com.Symantec.kext.KTUM
rm /etc/liveupdate.conf
rm /etc/Symantec.conf
rm /usr/bin/symsched
rm /usr/bin/navx
rm ~/Library/Preferences/com.Symantec.Scheduler.plist
rm /Users/Shared/snorosx
rm -rfd /Library/Contextual Menu Items/NAVCMPlugin.plugin
rm -rfd /Applications/Symantec Solutions
rm -rfd /Applications/Norton AntiVirus
rm -rfd /Library/Receipts/NAVContextualMenu.pkg
rm -rfd /Library/Receipts/NAVEngine.pkg
rm -rfd /Library/Receipts/Norton AntiVirus.pkg
rm -rfd /Library/Receipts/SymEvent.pkg
rm -rfd /Library/Receipts/SymOSXKernelUtilities.pkg
rm -rfd /Library/Receipts/NortonQuickMenu.pkg
rm -rfd /Library/Receipts/SymSharedFrameworks.pkg
rm -rfd /Library/Receipts/Norton AutoProtect.pkg
rm -rfd /Library/Recepits/Symantec Scheduled Scans.pkg
rm -rfd /Library/Recepits/Symantec Scheduled Scans.pkg
rm -rfd /Library/Recepits/Symantec Scheduled Scans.pkg
rm -rfd /Library/Receipts/navx.pkg
rm -rfd /Library/Receipts/LiveUpdate.pkg
rm -rfd /Library/Receipts/Symantec Scheduler.pkg
rm -rfd /Library/Receipts/Stuffit.pkg
rm -rfd /Library/Receipts/SymInstallExtras.pkg
rm -rfd /Library/Receipts/SymHelpScripts.pkg
rm -rfd /Library/Receipts/SymantecUninstaller.pkg
rm -rfd /Library/Receipts/Symantec Alerts.pkg
rm -rfd /Library/Application Support/Norton Solutions Support
rm /Library/Application Support/NAV.history
rm -rfd /Library/Application Support/Symantec
rm -rfd /Library/PreferencePanes/SymantecQuickMenu.prefPane
rm -rfd /Library/PreferencePanes/APPrefPane.prefPane
rm -rfd /Library/PrivateFrameworks/SymAppKitAdditions.framework
rm -rfd /Library/PrivateFrameworks/SymBase.framework
rm -rfd /Library/PrivateFrameworks/SymNetworking.framework
rm -rfd /Library/PrivateFrameworks/SymSystem.framework
rm -rfd /Library/PrivateFrameworks/SymScheduler.framework
rm -rfd /Library/StartupItems/NortonAutoProtect
rm -rfd /Library/StartupItems/NortonMissedTasks
rm -rfd /Library/Documentation/Help/Norton Help Scripts
rm -rfd /Library/Widgets/Symantec Alerts.wdgt
rm -rfd /System/Library/Extensions/SymEvent.kext
rm -rfd /System/Library/Extensions/SymOSXKernelUtilities.kext
rm -rfd /System/Library/Extensions/KTUM.kext
rm /System/Library/Extensions.mkext.NxdE

Oh, since most everything I do on this site requires elevated privileges I usually forget to mention it, but this script will require those…