On macOS, you may notice a file located at one of the following file paths:
- /Library/StagedExtensions/com.malwarebytes.mbam.rtprotection.kext
- /Library/StagedExtensions/Library/Application Support/Malwarebytes/MBAM/Kext/MB_MBAM_Protection.kext
The file above is not removed from your macOS after uninstalling Malwarebytes for Mac.
Cause
macOS copies files into the StagedExtensions folder. The macOS technology System Integrity Protection (SIP) protects the StagedExtensions folder and its contents from being modified or deleted. Malwarebytes for Mac does not have permission to delete files that are located in the StagedExtensions folder.
If you try to delete files in the StagedExtensions folder, the following error message appears:
For more information about System Integrity Protection, refer to Apple's article About System Integrity Protection on your Mac.
Workaround
Should you feel it is necessary to delete files in the StagedExtensions folder, you can temporarily disable System Integrity Protection. Malwarebytes does not recommend or instruct users to disable Security Integrity Protection. Disabling System Integrity Protection may be dangerous and leaving this feature disabled is a potential security risk.
It is not necessary to remove the leftover file and we recommend you leave it in the StagedExtensions folder. The leftover file is not active and occupies a small amount of disk space.