Background Service is Offline

[ChrisV]

Just installed Malwarebytes for Mac 3.0.  I can't get the interface to load.  All I get is a window with Background Service is Offline.  Running MacOS 10.12.6.

 

[treed]

Chris,

We've seen a few other similar cases, but haven't tracked down the cause yet. Did the install appear to work without any errors, but then this was the result? Or did the installer say the installation had failed?

[ChrisV]

The install completed normally without any errors

[jpl1953]

Im getting the same problem also install went OK and Im also running MacOS 10.12.6.

[Hawaii]

I reinstalled it again the problem went away.

[ChrisV]

I just tried reinstalling but I am still having the issue

[betterlifebywonder]

I'm getting the same problem also install went OK and I'm also running MacOS 10.12.6. I have reinstalled twice.

 

[Secesh1861]

I got the same message and reinstalled it  with no results.

Edited August 23, 2017 by Secesh1861

[gibannaz]

I have the same problem. Running MacOS 10.12.6.  Try several times. No results !  What to do ? Help please. 

[Chucky46]

Just got off the phone with Apple support who advised me to install Malwarebytes. Getting the same message that Background Service is offline. Running Mac OS 10.12.6. What do I do ? Install went okay with no errors, did it 3x.....twice with Apple support on the line.

Edited August 26, 2017 by Chucky46

[robertleeblairjr]

On 8/20/2017 at 11:28 AM, ChrisV said:

Just installed Malwarebytes for Mac 3.0.  I can't get the interface to load.  All I get is a window with Background Service is Offline.  Running MacOS 10.12.6.

 

This can be caused by the 'RTProtectionDaemon' process being disabled and not actively persistent in memory, not present in the install, was corrupted, third-party program conflict, etc. It's possible that the problem is caused by another component of the Malwarebytes program. I can mimic this exact problem whenever disabling the load and persistence of 'RTProtectionDaemon' process by 'launchd'. I don't like the developer's choice to make the Malwarebytes GUI dependent upon 'RTProtectionDaemon' process being active since it's primary function is Real-Time Protection, which is a service component of the Trial and Premium subscription models. You could attempt the following commands in terminal to determine if this resolves the issue.

0. Issue the commands 'sudo launchctl enable system/Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

1. Issue the commands 'sudo launchctl load /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

[ChrisV]

I ran both commands.  It changed nothing.  I am still getting the same error.

[Macidc]

This is BS. I successfully installed this software twice trying to get it to work. Both times I keep getting the same as Chris "background service is offline" - this has been a huge waste of time and money. Malwarebytes support is unreachable. Will be disputing this charge and heading to the Apple Store to find a different malware provider. 

[CDF]

I am also getting this error.  I attempted to install the software (OS 10.12.6) and got an unspecified error (see my prior post).  Then attempted to uninstall MWB and start over but got the same unspecified error.  Then I saw the MWB icon in the application folder and attempted to launch the program but just got the "background service is offline" error.  So I can't install, uninstall or launch... and the only way to eliminate MWB from the applications folder is to move it to the trash, which I'm sure is leaving bits and pieces all over the place that need to be cleaned up.  Tried this several times... no different outcomes.

[robertleeblairjr]

On 8/26/2017 at 0:29 PM, ChrisV said:

I ran both commands.  It changed nothing.  I am still getting the same error.

Open the "Activity Monitor" program. Is the 'RTProtectionDaemon' process active in the memory tab? Which OS version are you currently using and is it being booted from the internal drive? Are you using any other anti-malware, anti-virus, or app monitoring programs which would restrict the process from being launched by root?

[ChrisV]

Yes, RTProtectionDaemon is present.  I am running 10.12.6 on a MacBook Pro (15-inch, Late 2016) being booted from the internal HDD.  I am not using any other anti-malware, anti-virus, or app monitoring programs

[robertleeblairjr]

2 minutes ago, ChrisV said:

Yes, RTProtectionDaemon is present.  I am running 10.12.6 on a MacBook Pro (15-inch, Late 2016) being booted from the internal HDD.  I am not using any other anti-malware, anti-virus, or app monitoring programs

Select the 'RTProtectionDaemon' process under the memory tab and select the "i" tab to display information related to this process which will open in another window. From this window, select "Sample" which will open another window. Alternatively, the drop down menu with the sprocket has the same command to perform a 'Sample Process' of the highlighted running process. This command will take some time to perform iterations on this before it dumps a sample text in the window which you can save to a text file for uploading to the thread. I've attached a sample text of the 'RTProtectionDaemon' process, which you can feel free to download and compare with yours.

Sample of RTProtectionDaemon.txt

[ChrisV]

10 minutes ago, robertleeblairjr said:

Select the 'RTProtectionDaemon' process under the memory tab and select the "i" tab to display information related to this process which will open in another window. From this window, select "Sample" which will open another window. Alternatively, the drop down menu with the sprocket has the same command to perform a 'Sample Process' of the highlighted running process. This command will take some time to perform iterations on this before it dumps a sample text in the window which you can save to a text file for uploading to the thread. I've attached a sample text of the 'RTProtectionDaemon' process, which you can feel free to download and compare with yours.

Sample of RTProtectionDaemon.txt

 

Sample of RTProtectionDaemon CV.txt

[robertleeblairjr]

18 minutes ago, ChrisV said:

 

Sample of RTProtectionDaemon CV.txt

BTW. Is this the actual installed OS and not a virtualization of the OS? The initial errors in the sample maybe related to the touch control interface and I can't say that this doesn't cause a conflict. Change the the touch bar strip to "Expanded Control Strip" to test the app. This feature should resort to just the static function buttons; ie F1, F2, etc. I would suggest going, as far as, changing the function of the touch bar strip, uninstalling Malwarebytes with the uninstaller, removing any files created by Malwarebytes under /Library/, rebooting, and reinstalling Malwarebytes. If this doesn't work, then you may need someone to connect remotely to your system for providing assistance.

[JRM]

Same problem here,    OS 10.12.5.    RTProtection Daemon running   Shows memory and CPU.    The RTProtection Daemon actually keeps restarting as I See the PID change about 10 seconds

system log shows

 

Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[474]): Service exited with abnormal code: 69
Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug 30 12:07:25 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.rtprotection.daemon[471]): Service exited with abnormal code: 69
Aug 30 12:07:33 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[476]): Service exited with abnormal code: 69

 

Shows this over and over and over

[robertleeblairjr]

On 8/30/2017 at 11:31 AM, JRM said:

Same problem here,    OS 10.12.5.    RTProtection Daemon running   Shows memory and CPU.    The RTProtection Daemon actually keeps restarting as I See the PID change about 10 seconds

system log shows

 

Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[474]): Service exited with abnormal code: 69
Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug 30 12:07:25 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.rtprotection.daemon[471]): Service exited with abnormal code: 69
Aug 30 12:07:33 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[476]): Service exited with abnormal code: 69

 

Shows this over and over and over

The directory com.apple.xpc.launchd contains *.plist files that will contain entries for disabled daemons for different users. The location of the directory is '/private/var/db/com.apple.xpc.launchd/'. You can determine the numeric code for your User ID by entering the command 'id' in terminal. This will list the groups you're a member of, as well. So, the file '/private/var/db/com.apple.xpc.launchd/disabled.x.plist' whereby the "x" in 'disabled.x.plist' will be the User ID numeric code and is used for disabling the launching of daemons. Check the disabled files for any entries, which are in pairs of <key><value>, that contain strings referencing to Malwareybytes. You can use any program that will read/edit *.plist files, such as, Xcode or use 'cat' in terminal. If you find any entries for Malwarebytes in the *.plist files, except disabled.plist, then remove those entries. In the disabled.plist file, ensure that entries for Malwarebytes are set to false. If you've made any changes, then I suggest you to reboot your OS. You can perform a check on your system with the program EtreCheck. You can obtain a copy of a sample that I took for the process in a previous post to compare to the sample you could take of the RTProtectionDaemon process on your system. Also, I would suggest that you update your OS to 10.12.6.

Edited August 31, 2017 by robertleeblairjr

[BillyP]

Ok guys after try reinstalling malwarebytes you lost me.  I have no idea what your talking about.  In my situation am I looking at paying someone to fix this.  I'm currently running MacKeeper and the dude at Apple said no no no no no install malwarebytes it's the best and it will get rid of MacKeeper. MacKeeper is using too much of my CPU. What do you think?

[robertleeblairjr]

13 minutes ago, BillyP said:

Ok guys after try reinstalling malwarebytes you lost me.  I have no idea what your talking about.  In my situation am I looking at paying someone to fix this.  I'm currently running MacKeeper and the dude at Apple said no no no no no install malwarebytes it's the best and it will get rid of MacKeeper. MacKeeper is using too much of my CPU. What do you think?

This thread is not devoted to your curiosity about MacKeeper and whether to use that software. But, it's garbage and has had a bad history with its business model. Either way, create your own thread for these inquiries.

[treed]

I think that we may have found the root of the problem, although we're still not sure exactly what caused it.

It looks like folks have their system keychain set to an unusual "restricted" mode, which is related to the System Integrity Protection feature in macOS, and which should NOT be set for the system keychain.

To check for this problem, open the Terminal app, which is found in the Utilities folder in your Applications folder. In the Terminal, enter the following command and press return:

ls -alO /Library/Keychains/System.keychain

(Note that you should copy and paste this command, to avoid typos.)

The resulting output in the Terminal window should look something like this:

-rw-r--r--  1 root  wheel  - 74244 Aug 30 10:45 /Library/Keychains/System.keychain

If, instead, you see the word "restricted", as in the following example, then this is the cause of your problem:

-rw-r--r--@  1 root  wheel  restricted 83556 Nov 16  2016 /Library/Keychains/System.keychain

If you see that "restricted" flag, then that means that your system keychain isn't writeable, not by any user on the system. You may also have seen other issues due to this, such as an inability to get your computer to remember new wifi passwords.

To solve this problem, first make sure you know what your hard drive name is. If you're not sure, open a Finder window, then press command-shift-C (or choose Computer from the Go menu). Your hard drive will be in the list. Make a note of the exact name if necessary.

Next, restart in recovery mode by holding down command-R at startup. Once you're in recovery mode, rather than choosing one of the four options in the window, go to the Utilities menu and choose Terminal.

When the Terminal window opens, enter the following command, replacing "Macintosh HD" with the name of your hard drive:

chflags norestricted "/Volumes/Macintosh HD/Library/Keychains/System.keychain"

Make sure you type that exactly as shown, including the double quotes... the only difference should be the hard drive name. Press return to execute the command.

Then restart the computer, and see if Malwarebytes is working.

[treed]

48 minutes ago, BillyP said:

Ok guys after try reinstalling malwarebytes you lost me.  I have no idea what your talking about.  In my situation am I looking at paying someone to fix this.  I'm currently running MacKeeper and the dude at Apple said no no no no no install malwarebytes it's the best and it will get rid of MacKeeper. MacKeeper is using too much of my CPU. What do you think?

Apple is correct, you should not use MacKeeper. That's a scam app. Once you get Malwarebytes working, run a scan and it will detect and remove all components of MacKeeper for you.

Try the procedure I just posted and see if that gets Malwarebytes working for you.