How do I remove a kext added by 3rd party software?

Can anyone point me toward instructions for finding & removing kexts added by 3rd party software? The only resources I've found have been for older versions of MacOS, but the relevant features in System Preferences and Recovery Mode have been removed.


When I asked the developer, their reply was literally "Due to technical restrictions, it might be impossible to remove Mac system extension / kext in MacOS Ventura 13.2.1. I'm sorry we could not help you this time."


It just seems really weird that System Preferences required me to authorize that extension in Privacy & Security, but there's no way to undo that authorization. I feel like I'm missing something obvious somewhere, which is often the case with MacOS.


Thanks!

MacBook Air 13″, macOS 13.2

Posted on Mar 30, 2023 12:52 PM

Reply
Question marked as Top-ranking reply

Posted on Mar 30, 2023 01:04 PM

Any older third-party kernel extensions that remain in /System/Library/Extensions are there to stay as this is now on Ventura's read-only protected System volume. Neither csrutil, nor root will work there.

Similar questions

4 replies

Mar 30, 2023 01:55 PM in response to chasc

Once you authorize an app, you authorize anything from that developer.


To see what you are going to install, or what you have installed, you can use one of the apps from here: https://mothersruin.com/


Use Suspicious Package to inspect an installer package. Use Apparency to inspect an app. The Archaeology app is a new one. I have to download that one and try it out myself.


There is another app you can use to see what software is installed and running in the background, but I wrote that one so I can't give you a link to it here in the forums.

Mar 30, 2023 01:51 PM in response to etresoft

It was the Easeus Data Recovery Wizard. I tried reinstalling it to see if it would ask for those permissions again so I could get a little more detail on what it was that it installed the first time around. No luck - whatever I authorized to run via the Privacy & Security panel doesn't need to be authorized the second time around. I did open up the package contents and confirmed that there's no extension in there.

Mar 30, 2023 01:01 PM in response to chasc

Can you clarify that a bit? Which specific software are you asking about?


Unfortunately, this has gotten very difficult and confusing over the past couple of years. You specifically asked about a "kext". But that term usually refers to a "kernel extension". Apple confusingly calls this a "Legacy System Extension" or sometimes just a "System Extension". To uninstall a kernel extension, just drag it to the trash and restart. Easy peasy.


The problem is that Apple recently introduced a new type of "System Extension". These new extensions can only be removed by:

1) The software that installed them, or

2) By your dragging the containing application to the trash.


Otherwise, these new system extensions are baked into the operating system. If you try to remove them using any other method, not only will you fail, but you'll be unable to ever remove it again. You will have to erase the hard drive and reinstall the operating system. And you can't do a full restore from backup either. You have to make sure to avoid restoring software, system settings, or "other files". And don't you dare try an "app zapper" or "clean up" tool on one of these.


It is actually pretty easy to uninstall these by dragging the containing app to the trash. Unfortunately, said containing app is often located in some hidden directory. It is virtually never in /Applications.


Developers can also provide uninstaller to remove these extensions. But these days, they generally aren't doing that any more. Or if they do, their uninstallers simply don't work. If they are flat-out refusing to help, then that is probably the case.


There is another, super-secret method that is intended only for developers. You can find it on the internet but I can't mention it here in the forum due to security reasons.


So, no, you aren't missing anything. Always double-check when someone asks for extra permissions.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How do I remove a kext added by 3rd party software?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.