Cannot activate Malware for Mac

[Kimberly]

Please help me. I worked with the Apple guys for three days and we cannot get Malware Premium to activate.This is needed, as this is my work computer. Thanks for any ideas. 

[treed]

Can you clarify exactly what you're trying to do and what the results are?

[Kimberly]

Sure, it seems that I have premium according to the screen, but I cannot use real-time protection. It will not go on, and when I push the activate screen which keeps coming up when I go into open malwarebytes, nothing happens....I cannot get off the activate screen.

 

 

[treed]

Can you run a test for me? Open the Terminal app, which is found in the Utilities folder in the Applications folder, then paste the following command into the Terminal window:

ls -alO /Library/StagedExtensions/

Press return to execute it, then copy and paste the results here. What you should get should look like this:

thomas$ ls -alO /Library/StagedExtensions/
total 0
drwxr-xr-x@  5 root  wheel  restricted  160 Sep 30  2017 .
drwxr-xr-x+ 69 root  wheel  sunlnk     2208 Apr 24 19:52 ..
drwxr-xr-x   3 root  wheel  restricted   96 Jul  4 10:45 Applications
drwxr-xr-x   4 root  wheel  restricted  128 Jul 31 11:02 Library
drwxr-xr-x   3 root  wheel  restricted   96 Sep 30  2017 System

 

[Kimberly]

ok working on this

[Kimberly]

drwxr-xr-x   3 root  wheel  -        96  9 Jun 09:38 .

drwxr-xr-x+ 61 root  wheel  sunlnk 1952 14 Aug 20:52 ..

drwxr-xr-x   5 root  wheel  -       160 12 Aug 01:53 Library

[Kimberly]

is that what you want?

[treed]

Okay, that appears to be the problem. It looks like your StagedExtensions folder has been tampered with and left in an unusable state. There is a known issue with macOS that will cause failure to activate an extension in such a case, until this problem is fixed.

The quickest way to fix the problem would be to restart in recovery mode (hold down command-R at startup), then enter the Terminal once in recovery mode, and enter the following command:

chflags -R restricted /Volumes/*/Library/StagedExtensions

If your hard drive is encrypted with FileVault, however, you will first need to mount it using Disk Utility, which will require you to provide the encryption password to unlock the drive.

I know those instructions may be daunting, so if you're not sure that you can follow them, there is an easier - but more time-consuming - method. Follow the directions here to reinstall the system, skipping the step for erasing the hard drive:

https://support.apple.com/HT204904

This will install a fresh system on top of your current system, and should repair that StagedExtensions folder.

Before doing either of these things, you should be sure to have good backups, just in case something goes wrong.

Out of curiosity, do you know who might have tampered with that folder? It would have been someone with physical access to the computer. Did you, or someone else you know, follow instructions you found online to delete items from that folder, or was your machine serviced by a tech at some point recently?

[Edited to add -R to the chflags command]

Edited August 14, 2018 by treed

[Kimberly]

Wow, I hope I can do all this...um no one has tampered with my machine, but I got this last summer from a friend and she had her stuff removed in California before giving it to me...I have had Apple guys helping me since May 24th when I was in Dundee, Scotland and had a major adware attack...could that be it? And in the past three days, I have had Apple guys trying to sort this out and work on getting the application of Malwarebytes working--I should have found this forum first. The several Apple guys had access, of course, but they were trying to help me find any blocks, such as left-over adware or spyware from the attack in May. Also, last winter remember that attack on Macs when we had to get a patch? I was working with a Mac guy then as well.

I think I need help with this, and will ask someone to help me, as I am afraid of doing something wrong. I have stage four cancer and not 100% exact with things, which is why I asked the Apple guys for help. 

Thank you SO much. I shall try and get someone to help me. I am nervous, as I am a freelance writer and have all my work on this computer.

I am very grateful.

Marie Dean (Kimberly)