Mac OS X 10.11, aka El Capitan, includes a feature called System Integrity Protection (SIP), which prevents modifications from being made to some key locations in the system. This is very powerful protection against malware installing into certain places.
However, it's possible to turn SIP off, and worse, to turn it back on later after some kind of malware has been installed into one of these protected locations. In such a case, Malwarebytes Anti-Malware for Mac will not be able to remove components of the malware from those locations until SIP has been turned off again.
To turn off SIP, follow these instructions:
- Restart the computer.
- Hold down command-R as soon as the chime sounds, and continue to hold until the Apple logo appears.
- Once the machine has entered recovery mode, click Utilities
- Click Terminal
- In Terminal, type: csrutil disable
- Press return. You should see a message saying SIP was disabled.
- Restart the computer normally.
Once this is done, scan the computer again with Malwarebytes Anti-Malware and remove the files it was unable to remove previously.
Afterwards, for security purposes, you should re-enable SIP. To do so, repeat the steps above, except enter the command csrutil enable instead of csrutil disable.