# Removal of McAfee from OSX

Note: This was written in 2015, it may be out of date now.

> There are a lot of commands here which I use `sudo` if you don't know what you're doing with `sudo`, especially where I `rm` you can severely screw up your system.

There are many reasons which you would want to remove a piece of software such as McAfee, such as not wanting it to hammer your CPU during work hours which seems like primetime for a virus scan.

I intend this to be a living document, I have included suggestions from peoples' replies.

## Uninstall

You can attempt to uninstall, but it may not work randomly. There's an uninstaller you can download, it never worked properly for me.

### Per @ryenus try:

	/Library/McAfee/agent/scripts/uninstall.sh
	/usr/local/McAfee/fmp/bin/unInstallFMP

### Per @mirnujAtom try:

	sudo /usr/local/McAfee/uninstall EPM
	
### Per @javaswinger try any or all of the following:

**All Modules**

	sudo /usr/local/McAfee/uninstall EPM

**Threat Prevention Module**

	sudo /usr/local/McAfee/uninstall ThreatPrevention

**Firewall Module**

	sudo /usr/local/McAfee/uninstall Firewall
	
**Web Control Module**

	sudo /usr/local/McAfee/uninstall WebControl
	

## `launchd` Services

There are both local and root level launchd services. Thanks @rynosoft for finding some more which I missed.

### Local User Level

	launchctl stop com.mcafee.menulet
	launchctl stop com.mcafee.reporter
	
	launchctl remove com.mcafee.menulet
	launchctl remove com.mcafee.reporter
	
### Root Level

	sudo su -
	
	launchctl stop com.mcafee.virusscan.fmpd
	launchctl stop com.mcafee.ssm.ScanManager
	launchctl stop com.mcafee.virusscan.ssm.ScanFactory
	launchctl stop com.mcafee.ssm.Eupdate
	launchctl stop com.mcafee.agent.macompat
	launchctl stop com.mcafee.agent.ma
	launchctl stop com.mcafee.agent.macmn
	
	launchctl remove com.mcafee.virusscan.fmpd
	launchctl remove com.mcafee.ssm.ScanManager
	launchctl remove com.mcafee.virusscan.ssm.ScanFactory
	launchctl remove com.mcafee.ssm.Eupdate
	launchctl remove com.mcafee.agent.macompat
	launchctl remove com.mcafee.agent.ma
	launchctl remove com.mcafee.agent.macmn

### Finding More Services

As this document may be out of date by the time you find it, try these to find more mcafee garbage.

	launchctl list | grep mcafee
	sudo launchctl list | grep mcafee

You can use similar steps as above to stop and remove them.

## Files

Aside from the services, there will be a shit-ton of files left on the file system.

You can search and destroy mcafee stuff with this:

	find / -name "com.mcafee*" -exec rm {} \; -print

You may not have access to all of those files, you can `sudo find...` to elevate your privileges.

Per @jlevy if you are using TimeMachine, you'll want to ignore those back-ups.

	sudo find / -name "*MobileBackup*" -prune -or -name "com.mcafee*" -print > /tmp/to-delete

You can cat `/tmp/to-delete` to show what you should delete.

Per @javaswinger consider finding just `*mcafee*` instead of `com.mcafee*` for a more complete list.

	sudo find / -type f -name '*mcafee*' -print


## Fix McAfee Runaway Process

Per @TimLethbridge you can fix mcafee's runaway process by modifying some permissions.

	cd /usr/local
	sudo chown -R root McAfee
	sudo reboot

## Block Corp Policies

@alexellis asked how to block corp policies from re-installing McAfee. 

This is outside of the scope of this document. If you are on a corporate network screwing around with policies may result in a strong lecture or even cost you your job, depending on your field.

I have some theories involving setting up non-domain level users on the system, but I don't have a lab to do the testing and I primarily use Linux now, so I don't care enough try it.

## Remove Provisioning Tool

Per @dneto82

	rm /Applications/Utilities/McAfee\ ePO\ Remote\ Provisioning\ Tool.app/

## Conculsion

Fuck McAfee.