Mac tip: find outdated system extensions (kernel extensions) and remove them

The macOS information page reveals rather superficial things.

As of macOS Catalina 10.15.4, the operating system has issued individual warning messages immediately after booting, indicating outdated system extensions that will no longer be supported in the future. The exact wording of the notification is as follows:

Legacy Extension - Software on your system loaded an extension signed by "Developer's Name" that will not be compatible with future versions of macOS. Contact the developer for assistance.

The first few times I ignored the hints, but they are slowly getting on my nerves and I wanted to get down to work to remove the system extensions or kernel extensions that will no longer be compatible from macOS 10.16 onwards.

Note window on the Mac: Older system extensions are not compatible with future versions of macOS.

Note window on the Mac: Older system extensions are not compatible with future versions of macOS.

Note from macOS not very helpful

The first thing that strikes me: the hint from the system, in which the outdated system extensions are pointed out, is almost completely for the feet. The name of the developer is mentioned, but the program to which the extension belongs cannot be found in the window.

There is also no indication of the path where the system extension can be found. So all that remains is to search for it yourself with the vague information.

The website linked by Apple on the subject of "outdated system extensions" doesn't really help you either.

The website linked by Apple on the subject of "outdated system extensions" doesn't really help you either.

Tools like CleanMyMac X cannot find the extensions

My first glimmer of hope for the search was the CleanMyMac X tool, which I usually use to clear out startup items and the like. Unfortunately, it doesn't show the extensions macOS chalked up in any of the lists I clicked through.

Unfortunately, this means that a simple way via a Klickibunti program is apparently impossible and you have to look for other ways to find what you are looking for here.

Update January 05.01.2020th, XNUMX: MacUpdater in Pro version finds .kext files

A reader has just pointed out to me that the software "MacUpdater"in the new, purchased version 2 can also search for outdated software in the system and thus also find kernel extensions. I clicked on the software directly and it actually shows me four kext files that need an update. You just have to first select the setting "All software types" in the options under "Scan". This is not possible with the demo version.

MacUpdater 2 now also finds kernel extensions that are no longer up to date - but only in the purchase version of the software.

MacUpdater 2 now also finds kernel extensions that are no longer up to date - but only in the purchase version of the software.

Search for the kernel extensions using the terminal command

After searching some forums, I came across a terminal command with which you can display the kernel extensions that are NOT from Apple. To do this, open the "Terminal" utility program and enter the following command:

mdfind 'kMDItemKind == "Kernel Extension"'

Update: A reader just wrote me that this command did not return anything to him. However, by entering this line he was able to generate a list of third-party KEXTs:

kextstat | grep -v com.apple

The Mac will then spit out a list of extensions that you should take a closer look at. The practical thing about this list is that you can see directly in which folders the files are located.

The list of kernel extensions found on my Mac also shows the MalwareBytes hit that macOS Catalina listed in the warning when booting.

The list of kernel extensions found on my Mac also shows the MalwareBytes hit that macOS Catalina listed in the warning when booting.

In which folder are system extensions and kernel extensions located?

To make a list of the folders in which the KEXTs (abbreviation for Kernel Extensions) are located, I just looked in my results to see where they are. Here are the "usual suspects" I found on myself:

  • / Library / StagedExtensions / Library / Extensions /
  • / Library / StagedExtensions / System / Library / Extensions /
  • / Library / Application Support /
  • / System / Library / Extensions /
  • / Library / Extensions /

What are "StagedExtensions"?

MacOS moves all kernel extensions into the "StagedExtensions" folder that wanted to install third-party programs, but this was prevented by the system for security reasons. Usually, after installing such extensions, the System Preferences> Security> General for a short time a note that allows you to authorize the installation. To do this, you have to enter the admin password and the kernel extension goes into the "Extensions" folder, in which it is then also executed.

If you don't miss anything at the moment, you can usually empty the "StagedExtensions" folder with the following terminal command:

sudo kextcache --clear-staging

Important: backup before deleting the extensions

Before you diligently push all kinds of files into the trash, you should familiarize yourself with Carbon Copy Cloner, Smart backup or SuperDuper make a 1: 1 backup with which you can also start again. When working in system folders, you can break a lot, so in the worst case, you won't even be able to boot your Mac from the volume.

It should also be noted that some manufacturers use extensions with multiple programs. So if you only use certain parts of Adobe CC or Microsoft Office, you usually still need all the system extensions that install the programs. If you remove this anyway, the software sometimes no longer works properly.

If you have any questions about the system extensions, please feel free to leave them here as a comment.

 

-
Do you like my blog? Then I would be happy to receive a short review on Google. Easy leave something here for a moment - that would be great, thank you!

29 comments

  1. Thomas says:

    Thanks for the tip????! Corona-free weekend desired ????.

  2. Klaus says:

    The order didn't find anything on me. With "kextstat | grep -v com.apple" I was able to find the kernel extensions that are not from Apple

  3. Marcel says:

    After calling the command "kextstat | grep -v com.apple" I get the following information:

    Index Refs Address Size Wired Name (Version) UUID
    149 0 0xffffff7f81047000 0x1d000 0x1d000 com.kaspersky.kext.klif (3.4.0a25) 60A1E118-2531-354D-BD36-2FA6ADC11C07
    150 0 0xffffff7f80edf000 0x5b000 0x5b000 com.kaspersky.nke (2.3.0a7) 245493BB-B11C-3C84-9051-A2E51E4D01C0

    I assume that these are the reason for the message "Out of date system extensions (kernel extensions)". Does any of you know how to fix that?

    • sir appleot says:

      Hello Marcel! Yes, these could be old Kaspersky program parts. So either try the Kaspersky Deinstaller or use the instructions you just wrote the comment about. : D

  4. Toxitec says:

    With the console command I get the following answer, but unfortunately I absolutely cannot find the files ... Help would be great!

    Index Refs Address Size Wired Name (Version) UUID

    174 0 0xffffff7f84705000 0x13000 0x13000 com.kaspersky.kext.kimul (46) A8797394- 1582-3199-B848-57168A700E56

    175 0 0xffffff7f84718000 0x1e000 0x1e000 com.kaspersky.kext.klif (3.6.12a2) 6BA1AFA7-F84D-3C69-9E56-0C3E21139D2E

    176 0 0xffffff7f84736000 0x5b000 0x5b000 com.kaspersky.nke (2.4.0a6) 45D3BCC3-2FB1-37A1-8148-801CBB1D353B

  5. Caroline says:

    What does this mean? Are these extensions to delete? And he asks for a password? I don't have any ………… Thank you very much. I deleted my name …….
    The default interactive shell is now zsh.
    To update your account to use zsh, please run `chsh -s / bin / zsh`.
    For more details, please visit https://support.apple.com/kb/HT208050.

    /Library/StagedExtensions/Library/Extensions/ATTOExpressSASRAID2.kext
    /Library/StagedExtensions/Library/Extensions/ATTOCelerityFC8.kext
    /Library/StagedExtensions/Library/Extensions/HighPointRR.kext
    /Library/StagedExtensions/Library/Extensions/CalDigitHDProDrv.kext
    /Library/StagedExtensions/Library/Extensions/HighPointIOP.kext
    /Library/StagedExtensions/Library/Extensions/ATTOExpressSASHBA2.kext
    –Clear staging
    Password:
    ??

    • Jen Kleinholz says:

      Hello Caroline! Yes, these extensions can all be removed. You can delete them in the terminal with this command: sudo kextcache –clear-staging
      It is normal for him to ask for the password. After all, not everyone is allowed to tinker around in the system folder. : D

  6. michael says:

    Hello.
    Unfortunately, I can't see where to put your command.

    For laymen, please: if the Mac is switched on, what then?

    Thank you very much

    • Jen Kleinholz says:

      Hi Michael! Ah, ok ... I'll give it a try: Mac is switched on, then you go to the Applications> Utilities folder and open the "Terminal" program. In this you then enter the command. LG, Jens

  7. Dirk says:

    Hi all!
    Some time ago I recommended the MacUpdater program.
    There is now a new version 2.0, which not only finds outdated apps but also outdated plugins, screensavers, kernel extensions, etc. and can update them automatically / manually.
    You can also configure the app in such a way that the storage location of the outdated .kext is displayed in the system with a double click, if you so wish.
    Maybe this can help one or the other.
    The search "beyond the apps" is reserved for the Pro version ... but I can recommend the program with a clear conscience.

    • Jen Kleinholz says:

      Ah, that's a great tip! I'll build it into the post above and try it out too. Sounds like a helpful function in any case.

  8. Dirk says:

    .... have one more addition. Tried both terminal commands as a trial.
    The first gives me 8 kernel extensions. The second doesn't give me the 8th .kext, but it does give me another one.
    Then I started version 2.0 of MU and it showed me an outdated printer USB kext. By double-clicking the folder was shown to me, in which there are other various .kext ... but here I find the 8 + 1 + another 7 !! .kext
    - strange.

    • Jen Kleinholz says:

      Hello Dirk! Yes, I don't quite understand why different information is given here. Probably the truth is somewhere in between ...: D

  9. D Wettstein says:

    Thank you tried it with your commands. After that, I get this huge list of system extensions and still have crashes. What can i do there?
    Executing: / usr / bin / kmutil clear-staging
    clearing all staged extensions ...
    dweib @ Ds-iMac-2 ~% mdfind 'kMDItemKind == "Kernel Extension"'
    /Library/Extensions/EPSONUSBPrintClass.kext
    /Library/Extensions/EyeTVVoyagerAudioBlock.kext
    /Library/Extensions/EyeTVCinergyXSAudioBlock.kext
    /Library/Extensions/EyeTVEmpiaAudioBlock.kext
    /Library/Extensions/HighPointIOP.kext
    /Library/Extensions/SoftRAID.kext
    /Library/Extensions/EyeTVAfaTechHidBlock.kext
    /Library/Extensions/EyeTVCinergy450AudioBlock.kext
    /Library/Extensions/HighPointRR.kext
    [...]
    /System/Library/Extensions/AGXFirmwareKextG11GRTBuddy.kext
    /System/Library/Extensions/AGXFirmwareKextG13GRTBuddy.kext
    /System/Library/Extensions/AGXFirmwareKextRTBuddy64.kext
    /System/Library/Extensions/AFKACIPCKext.kext

  10. Dominik Wettstein says:

    I don't need the Eye TV extensions anymore, how do I get rid of them?
    /EyeTVCinergyXSAudioBlock.kext /Library/Extensions/EyeTVEmpiaAudioBlock.kext /Library/Extensions/HighPointIOP.kext /Library/Extensions/SoftRAID.kext /Library/Extensions/EyeTVAfaTechHidBlock.kext / Extensions / HighAudio / Library .kext
    /EyeTVAfaTechHidBlock.kext /Library/Extensions/EyeTVCinergy450AudioBlock.kext /Library/Extensions/HighPointRR.kext

    • Jen Kleinholz says:

      Hello Dominik! You can find the Kernel Extensions in the "Library / Extensions /" folder. You can go to the folder and then throw the files in the trash. Here is a guide, how to get into the Library folder.

      Then I found the following instructions:
      1. Remove extensions from / Library / Extensions
      2. Boot in recovery mode (hold CMD + R when restarting)
      3. Call up the terminal
      4. Enter this command: kmutil invoke-panic-medic
      5. Restart your Mac
      6. Follow the instructions and open the system settings and switch to "Security & Privacy"
      7. Follow the instruction and restart

      I haven't tried this guide, but you might get along with it.

  11. Dominik Wettstein says:

    One more remark: I've had the problems since I updated to big sur. Are there other commands for this OS?

  12. Ali says:

    I downloaded a program from the Internet to share my Mac screen with the Ipad. Unfortunately, despite several warnings, I ignored the security warnings and allowed access rights. I deleted the program but the search remained "YamDisplayDriver.kext". And I couldn't delete this either. I entered the command "sudo kextcache –clear-staging" and hope that this will delete everything from this file (probably virus or spy program). Can someone confirm it for me?

    • Jen Kleinholz says:

      Hello Ali! It would be helpful if you could say the name of the program you loaded. If - judging by the kernel extension - around Yam display it doesn't seem to be a spy app. It is possible that the program will no longer run under Big Sur anyway because Apple no longer wants to allow kernel extensions from third-party providers.

  13. Rene99 says:

    What is the command if you only want to delete a .kext file in the StagedExtensions directory?

    • Jen Kleinholz says:

      Hello Rene! Usually you delete files in the terminal with rm /path-to-file/filename.kext
      But I have no idea whether that actually throws out a kernel extension. I always say that trying makes you smell. : D

      • rene99 says:

        Unfortunately, this order has not been fruitful. The system reports

        rm: /Library/StagedExtensions/Library/Extensions/SamsungPortableSSDDriver.kext: is a directory

        The date remains

        • Jen Kleinholz says:

          Hello Rene! You delete directories with
          rm -r /Library/StagedExtensions/Library/Extensions/SamsungPortableSSDDriver.kext/
          Maybe it will work

          • Rene99 says:

            That was the system answer:

            override rw-r – r– root / wheel restricted for /Library/StagedExtensions/Library/Extensions/SamsungPortableSSDDriver.kext//Contents/_CodeSignature/CodeResources?

            Unfortunately still unsuccessful. Seems to be difficult (too) for me. Even with a script from Samsung it didn't work.

          • René 99 says:

            Even moving to the trash is not fruitful. The file remains….

  14. Ed Walf says:

    Why is Apple making it so difficult to update its operating system? I'm not a programmer and it shouldn't be that hard! I know something will go wrong if I try these instructions. I am sorry to venture here and thank you for the tips. Unfortunately I will probably stick with OS 10.14.6.

Leave a Comment

Your e-mail address will not be published. Required fields are marked with * .