Leftover Malwarebytes file in StagedExtensions folder

Document created by asmith Employee on Jan 31, 2018Last modified by jyamada on Feb 7, 2018
Version 4Show Document
  • View in full screen mode

On macOS 10.13 High Sierra, you may notice a file located at the following file path:

 

/Library/StagedExtensions/com.malwarebytes.mbam.rtprotection.kext

 

The file above is not removed from your macOS after uninstalling Malwarebytes for Mac.

 

Cause

macOS copies files into the StagedExtensions folder.  The macOS technology System Integrity Protection (SIP) protects the StagedExtensions folder and its contents from being modified or deleted.  Malwarebytes for Mac does not have permission to delete files that are located in the StagedExtensions folder.

 

If you try to delete files in the StagedExtensions folder, the following error message appears:

 

"com. malwarebytes.mbam.rtprotection.kext" can't be modified or deleted because it’s required by macOS.

 

For more information about System Integrity Protection, refer to Apple's article About System Integrity Protection on your Mac.

 

Workaround

Should you feel it is necessary to delete files in the StagedExtensions folder, you can temporarily disable System Integrity Protection.  Malwarebytes does not recommend or instruct users to disable Security Integrity Protection.  Disabling System Integrity Protection may be dangerous and leaving this feature disabled is a potential security risk.

 

It is not necessary to remove the leftover file and we recommend you leave it in the StagedExtensions folder.  The leftover file is not active and occupies a small amount of disk space.

 

Additional information

Attachments

    Outcomes