How to Uninstall Norton from Mac Completely in 2026

Norton Antivirus is notoriously difficult to fully remove from a Mac. Even after dragging the app to the Trash, background agents like LiveUpdate, system extensions, and LaunchDaemons keep running — and keep nagging you with alerts. This guide walks through how to uninstall Norton from Mac completely, covering the official removal tool, what it misses, and how to mop up the leftovers by hand.

Why Dragging Norton to the Trash Is Not Enough

Norton installs components in several locations outside the application bundle itself:

• LaunchAgents and LaunchDaemons — background services that start automatically at login or boot, including the LiveUpdate scheduler
• System extensions (kexts) — kernel-level components that require a full reboot to unload and, on Apple Silicon Macs, may require disabling System Integrity Protection to remove
• Login Items — entries added to System Settings > General > Login Items that restart Norton UI components at login
• Application support folders — databases, quarantine logs, and subscription state files stored in ~/Library/Application Support/ and /Library/Application Support/
• Preference files — scattered across ~/Library/Preferences/ and /Library/Preferences/

Removing only the .app bundle leaves all of these behind. On macOS Sequoia (15) and macOS 26 (Tahoe), orphaned system extensions can trigger repeated "System Extension Blocked" prompts even after the parent app is gone.

Step 1 — Use Norton's Official Removal Tool First

Symantec/Norton ships a dedicated removal utility. Always start here — it handles the privileged teardown that a manual approach cannot do as cleanly.

1. Open Norton 360 (or whichever Norton product you have) and sign out of your Norton account if prompted.
2. Quit Norton completely: right-click the Norton menu-bar icon and choose Quit Norton.
3. Download the removal tool from Norton's support site. At the time of writing it is named RemoveSymantecMacFiles.zip. Search "Norton remove tool Mac" on Norton's official support pages to get the current version.
4. Unzip the archive, right-click RemoveSymantecMacFiles.sh, and choose Open with Terminal. Alternatively, run it directly:

sudo bash ~/Downloads/RemoveSymantecMacFiles.sh

5. Enter your administrator password when prompted. The script will stop services, unload kexts, and delete the main application files.
6. Restart your Mac when the script finishes.

Note: If the script exits with an error about a running process or a locked file, force-quit Norton through Activity Monitor first (Applications > Utilities > Activity Monitor), then re-run the script.

Step 2 — Remove Norton Manually After the Official Tool

The removal tool is thorough but not perfect. The following locations commonly contain orphaned Norton files after running it. Review each before deleting — this step is permanent and cannot be undone by an Undo command.

LaunchAgents and LaunchDaemons

Open Terminal and check for any remaining Norton-related plists:

ls ~/Library/LaunchAgents/ | grep -i norton
ls ~/Library/LaunchAgents/ | grep -i symantec
ls /Library/LaunchAgents/ | grep -i norton
ls /Library/LaunchDaemons/ | grep -i norton
ls /Library/LaunchDaemons/ | grep -i symantec

If any files appear, unload them before removing:

launchctl unload ~/Library/LaunchAgents/com.symantec.liveupdate.plist
rm ~/Library/LaunchAgents/com.symantec.liveupdate.plist

Repeat for each file found, adjusting the path and filename. Use sudo for items in /Library/LaunchDaemons/.

Application Support Folders

ls ~/Library/Application\ Support/ | grep -i norton
ls ~/Library/Application\ Support/ | grep -i symantec
ls /Library/Application\ Support/ | grep -i norton

Common leftovers include Norton, Symantec, and NortonSecurity folders. These hold quarantine databases and license files — safe to delete once Norton is fully removed.

rm -rf ~/Library/Application\ Support/Norton
sudo rm -rf /Library/Application\ Support/Symantec

Preferences

ls ~/Library/Preferences/ | grep -i norton
ls ~/Library/Preferences/ | grep -i symantec
ls /Library/Preferences/ | grep -i norton

Delete any matching .plist files with rm or move them to the Trash from Finder (press Shift+Cmd+G and type the path).

Caches

ls ~/Library/Caches/ | grep -i norton
ls ~/Library/Caches/ | grep -i symantec

Cache files are safe to delete. They will not be recreated once Norton is gone.

Step 3 — Check Login Items and System Extensions

Open System Settings > General > Login Items & Extensions. Look for any Norton or Symantec entries under both Open at Login and Allow in Background and remove them with the minus button.

For system extensions, scroll down to System Extensions in the same pane or run:

systemextensionsctl list | grep -i norton
systemextensionsctl list | grep -i symantec

If any are listed as activated enabled, they should have been deactivated by the removal tool. If they persist, you may need to boot into Recovery Mode and disable System Integrity Protection temporarily — this is an advanced step; consult Apple's documentation before proceeding, as it weakens macOS security while SIP is off.

Where Crumb Helps With Hidden Leftovers

The manual grep approach works, but it is easy to miss files nested inside subfolders or stored under a vendor name you did not think to search for (com.symantec, NortonLifeLock, Avira — Norton's parent company changed names). Crumb's Uninstall tab finds Norton's installed bundle, then scans the full Library tree for associated agents, login items, and support files that share the same bundle ID prefix or developer signature — the same files the drag-to-Trash method misses.

Crumb shows you the list before deleting anything, so you can confirm each item rather than running a blind sudo rm -rf. If you are unsure whether a specific folder is safe to remove, Crumb's built-in "Is this safe to delete?" AI explains what the folder contains and what removing it would break. Download Crumb if you prefer a visual approach over Terminal commands.

Method Comparison

After Removing Norton — What to Expect

• Reboot is required for kernel extensions to fully unload. Do not skip this step.
• macOS Gatekeeper and XProtect remain active after removing Norton — your Mac is not unprotected.
• If you still see "NortonSecurity wants access to control…" permission dialogs after rebooting, go to System Settings > Privacy & Security and revoke any remaining Norton permissions manually.
• On Apple Silicon Macs (M1/M2/M3/M4), system extensions are more strictly sandboxed and the removal tool typically handles them cleanly — you are less likely to need the SIP workaround.

Conclusion

Fully removing Norton from a Mac takes more than a simple drag-to-Trash. Run the official removal script first, then audit LaunchAgents, LaunchDaemons, Application Support, and Login Items for anything left behind. If you want a guided, visual alternative that surfaces hidden agents and leftover files without requiring Terminal fluency, Crumb handles the same scan in a few clicks — with a preview before anything is deleted.