How to Uninstall Kernel Extensions

Asya Karapetyan
Content marketer, who specializes in Mac how-to guides
September 19, 2023
7 minutes to read

When you are removing applications using the uninstaller from Nektony, you may face an error with deleting some service files and folders.
This happens because specific applications, mostly antiviruses, can create kernel extensions which are able to protect themselves and some related files from being removed. Kext files are usually stored in the Extensions folder is deep subfolders. If you try to remove such a file to Trash, you will face a situation when Finder ignores the removal command. So in this article, we are going to explain how to remove the kernel extensions.


  1. Remove kernel extensions when FileVault is disabled.
  2. Remove kernel extensions when FileVault is enabled.

To check whether the FileVault option is turned on or turned off do the following:

  1. Open System Settings.
  2. Click Privacy & Security in the sidebar.
  3. Scroll down and find the FileVault section.
  4. Check the status whether it’s turned on or turned off.
FileVault section in system settings

A guide for earlier versions of macOS:

  1. Go to System Preferences
  2. Click Security & Privacy.
  3. Switch to the FireVault tab.

FileVault tab in Security & Privacy window showing FileVault is turned off for the disk

Remove kernel extensions when FileVault is disabled

  1. First, write down the path of the kernel file. Then restart your Mac and press Command+R key shortcut while the reboot is in progress. You will see an unusual startup window – this is the recovery mode.

    MacOS Utilities window with selected Disk Utility option

  2. In the Menu bar click Utilities → Terminal. Selected Terminal option in Utilities tab of Menu bar
  3. Type the following command and click Enter:

    [the path=”” of=”” the=”” kernel=”” fil=””][/the]

    Terminal window with command for kernel extensions removal

    If there is a space sign in the path name, you should replace it with the backslash sign.

  4. Then type this command:

    rm -rf
    [extension name=””][/extension]

    Kernel extensions removal command in Terminal window

  5. The last step is to restart your Mac.

Remove kernel extensions when FileVault is enabled

When the FileVault is enabled on your Mac and your disk is encrypted, your system will not allow you to remove any kext file from your disk using Terminal in the recovery mode. In this case, you will have to disable SIP and remove a kext file manually:

  1. Repeat the first two steps from the text above and go to the recovery mode → Terminal.
  2. Type in Terminal the next command:
    csrutil disable
    Terminal window with command for disabling SIP
  3. Press the Return key to disable System Integrity Protection.
  4. Restart your Mac in the usual way.
    Choosing Restart option in Mac Menu bar
  5. Find the kext file in Finder and remove it from there.
  6. Empty your Trash bin.
  7. Then re-enable the System Integrity Protection again. For this, again restart your Mac → use Command+R shortcut → open Terminal and this time type the command csrutil enable Terminal window with command for enabling SIP
  8. Again restart your Mac.

After these steps, the kext file will finally be completely removed.

Scroll to Top