Slow performance on MacBook Pro M1 Max

Problems noted:

System Extensions

• networkextension - The Sophos app was deleted, but the uninstaller was not used leaving this remant file running.
• Cisco Secure Client - Use the uninstaller to remove and test. Directly related to network issues.
• com.sophos.endpoint.scanextension - Same as before with Sophos not properly uninstalled.
• WithSecure System Extension - Firewall blocking internet activity

Launch Daemons

• com.cisco.secureclient.vpn.service.agent.plist
• com.docker.vmnetd.plist - Docker has been the source of many problems. Remove and test, you can always install the latest version again to see if it causes trouble for you.
• com.sophos.sophoscbr.plist
• com.withsecure.licensetooldaemon.plist
• com.withsecure.sp.doormandaemon.plist
• com.withsecure.sp.securityclouddaemon.plist
• com.withsecure.sp.upstreamdaemon.plist
• com.withsecure.ultralight.wssmdaemon.plist
• com.withsecure.ultralight.wsulcoredaemon.plist
• com.withsecure.wsadmindaemon.plist
• com.withsecure.wsavd.dbhelperdaemon.plist
• com.withsecure.wsavdaemon.plist
• com.withsecure.wsesproviderdaemon.plist
• com.withsecure.wshotfixdaemon.plist
• com.withsecure.wsreputationdaemon.plist
• com.withsecure.wssettingsdaemon.plist
• com.withsecure.wsupdatedaemon.plist
• com.withsecure.wsupdatedownloaddaemon.plist
• com.withsecure.wsuplinkdaemon.plist
• com.withsecure.wsxfencedaemon.plist

Launch Agents

• com.cisco.secureclient.gui.plist
• com.cisco.secureclient.iseposture.plist
• com.cisco.secureclient.vpn.notification.plist
• com.withsecure.wsagent.plist

To be honest, my recommendation is to do a clean install to remove all those problematic files. It can be difficult to remove System Extensions, although the LaunchDaemons and LaunchAgents are easily removed. With a clean install, do not install any VPN or Antivirus apps. After that you can certainly test with installing one at a time, but those have been seen as problematic and the amount of system modifications with the processes running on startup is excessive consuming valuable resources.

I understand that the clean install route is not a preferred method for many. You can certainly try removing the System Extensions first by using the apps uninstaller. After those have been removed, then you will be able to remove the other files without a problem. Make sure you have a backup no matter what you do.

Restart your computer one more time and it should get rid of the WithSecure extension.

Now for Sophos, try using their Removal Tool found here. They still recommend removing with the uninstaller provided by the app, but it appears you have already deleted the app. That is why I suggested to install it again and use the uninstaller there, but you can try their removal tool without installing the app. It just needs to be downloaded from their page here and follow the instructions.

https://support.sophos.com/support/s/article/KBA-000003260?language=en_US

If you are able to remove those, that just leaves the Cisco Secure Client System Extension. Cisco does offer a little help here and notes that if it has not been fully removed it could cause issues. They recommend to open the Terminal app found in your Utilities folder and enter this command exactly. It may require your computer password after entering.

sudo /opt/cisco/secureclient/bin/cisco_secure_client_uninstall.sh

https://www.cisco.com/c/en/us/support/docs/security/umbrella/224782-uninstall-secure-client-from-macos.html

If those Extensions are able to be removed and no longer show in the EtreCheck report, then it will be much easier to remove the other files.

_Shevek_ wrote:

Thanks a lot to both of you. I uninstalled WithSecure and removed the leftover stuff of Sophos (it's so difficult to completely uninstall that guy from Mac, I did a clean Uninstall at the time but it failed). Performances immediately improved and another run of EtreCheckPro confirmed that (attached).

Until all its system-altering components are identified and completely eradicated the Mac's performance will remain less than optimal. Most people are astounded at how well their Macs work after they get rid of the junk.

However, those astounded users are the ones who actually come to this site seeking assistance, a minority that eliminates the overwhelming number of Mac users who don't. That majority of Mac users might contact Apple Support for help instead, but Apple will never tell someone to uninstall something they installed. They leave that decision to the user for sound reasons. It's their Mac and what they choose to install on it is their business.

It's a lose-lose situation for Apple because to fix a user's problems Apple have to convince the user whatever they bought / installed was junk, which always meets with resistance.

Worse, as a highly visible lucrative target, if they were to do that Apple would face the wrath of junk product developers who make a living selling garbage products that should never be installed to begin with. Apple's legal counsel would ensure they'd never, ever go down that road. It's a nonstarter. Instead, the hapless user becomes easily convinced their Macs are just too old and it's time to replace them. And the cycle continues. Win-win for Apple.

Macs work just fine, if you let them. It's also the reason I often state "rule 1 of Macs is don't install junk" because it never ends well.

Think before you click. Installing is easy. Recovery, if attempted long after the fact, becomes difficult and (short of completely erasing the Mac) can be impossible.

etresoft wrote:

OK. That makes sense. It isn't unusual for uninstallers to fail to work properly. Some developers just ignore uninstallation altogether.

When I installed the product in question a while ago, I determined its uninstaller was almost completely ineffective. Numerous components required manual deletion. Some (like the contents of its Application Support folder) just occupied needless space, while others continually attempted to launch apps or processes that no longer existed. Obviously, that Mac continued to operate poorly.

This is a typical characteristic of "junk" software. However, the converse is not always true. One notoriously bad product that continues to be marketed and sold has an uninstallation procedure that is completely effective. That does not mean it's "beneficial" software. It's still junk.

_Shevek_ wrote:

With clean uninstall I mean that I used the Uninstall feature of Sophos, but it failed to complete.

OK. That makes sense. It isn't unusual for uninstallers to fail to work properly. Some developers just ignore uninstallation altogether.

I tried installing it again and uninstalling, same outcome.

Yeah. Once it fails the first time, It's protected by macOS's own SIP security protections.

I did some search and it seems a well-known problem with Sophos on Mac. At any rate it seems like it's not affecting performances significantly anymore.

It's a well-known problem with any system extension. Just remember that when you decide to upgrade to Sequoia, Tahoe, or something afterwards, you should be able to remove it then. Go to System Settings > Login Items & Extensions (or whatever they call it then) and you should see it listed. There will be a tiny, tiny button labelled "..." that you can click on to display a menu of options. One option will be to remove the extension.

For trying to improve user awareness, I sometimes include this:

The idea that a third party, with no special knowledge of the inner workings of MacOS, can somehow find a simple way to protect or speed up your computer — that is not already being done by MacOS itself — suggests that the MacOS developers are somehow "holding out on you". That is absurd.

You should remove any and all (other than Apple built-in) virus scanners, speeder uppers, optimizers, cleaners, App deleters or VPN packages you installed yourself, or anything of that ilk.

Your exceptionally well-crafted Macintosh computer does not accumulate filth that needs any third-party anything to clean it. Everything needed to run it efficiently was included in the box, except ONE: a drive on which to store a second copy of your files in case the first copy is damaged or deleted by accident. The backup software, Time Machine, is already present -- integrated deeply into MacOS.

Security updates disabled - Security updates are disabled. This computer is at risk of malware infection.

and

Automatic Updates: Disabled

Security Updates: Disabled

That's bad.

Antivirus software: Malwarebytes

That entry should resemble exactly the following:

Antivirus software: Apple

... and nothing else.

Fix it. Start by following Mac Jim ID's instructions. Add "Bitwarden" to that list. More work is likely to be required.

_Shevek_ wrote:

removed the leftover stuff of Sophos (it's so difficult to completely uninstall that guy from Mac, I did a clean Uninstall at the time but it failed).

I don't know what you mean by a "clean uninstall". System extensions are tricky. If you don't uninstall them properly, they'll be baked into the operating system and virtually impossible to remove.

Apple did add a slightly more user friendly uninstall procedure for these orphan system extensions, but I think that's only available in Sequoia and later. This is one of those funny cases where you could spend years trying solutions from the internet and never succeed. I double-checked and found one of my own older posts where I had confirmed that this is only possible in Sequoia and later. You're on Sonoma, so no luck.

There does remain one last method for uninstalling this system extension short of completely erasing the hard drive. But it's one of those cases where I don't want to be responsible for trying to talk you through it. I didn't write this system extension. Not my problem.

If you've gotten the runtime down to 3.5 minutes, then you're doing pretty good. Might be best to leave well enough alone.

etresoft wrote:

Apple did add a slightly more user friendly uninstall procedure for these orphan system extensions, but I think that's only available in Sequoia and later.

Do you feel comfortable expanding on the more user friendly uninstall process for system extensions with Sequoia? The only way I am familiar with is using Terminal to disable SIP, get Bundle ID and Team ID of extension, and use those to remove the extension, while following up with enabling SIP.

I understand this is slightly off topic and not relevant with Sonoma. I would be more willing to assist in those cases on Sequoia or later if I knew there was an easier method.

John Galt--

You have often posted the [in my opinion] far too terse advice, "Don't install Junk"

But the Readers who need to internalize that message often believed the lies pushed by the sellers of those junky packages, and paid good money for those add-ons. They may have real trouble seeing something they believed in and paid money for as obvious junk.

What is often needed at that moment is a bit more advice for judging software as junk. I think that would be extremely helpful for the readers who are clearly unable to tell the difference (or they would not be having these dilemmas).

But Hold on, you already wrote up most of the advice needed.

Your excellent article on this closely-related subject should be cited, in addition to the "Don't Install Junk" mantra.

Effective defenses against malware and ot… - Apple Community