Can't enable real time protection in any antivirus (tried 5 already), desperate to keep Mac protected, how?

Dear All,

I am looking for assistance, I have tried already 5 different antivirus programmes for Mac and each of them failed to activate real-time protection component.


I spent 3,5 hours looking for a way to fix it, checking the websites of vendors of the AV software I tried (AVG, Avira, Avast, Sophos, Norton), for the recommendations on solving the issue.


None of the antivirus I tried did work, and none of the solutions suggested helped.

From that, I assume there is an issue on the Mac side.

I use the most recent MacBook Pro High Sierra, purchased new 2 months ago.


I am desperate as I would like to find a different way to activate AV protection rather than having to perform a clean install etc..


Thank you for your help!

MacBook Pro TouchBar and Touch ID, macOS High Sierra (10.13.5)

Posted on Jul 8, 2018 1:46 PM

Reply
15 replies

Jul 8, 2018 3:54 PM in response to DziejekDziejek

2018-06-13 16:45:53 Kernel Panic (2 times)

3rd party kernel extensions:

com.sophos.kext.sfm 9.7.4

com.sophos.nke.swi 9.7.4

com.sophos.kext.oas 9.7.4


I suspect sophos. Get rid of.


Launchd: /Library/LaunchDaemons/com.avg.init.plist

Executable: /Library/Application Support/AVGAntivirus/hub/init.sh


Launchd: /Library/LaunchAgents/com.avg.userinit.plist

Executable: /Library/Application Support/AVGAntivirus/hub/userinit.sh


Launchd: /Library/LaunchDaemons/com.avg.update.plist

Executable: /Library/Application Support/AVGAntivirus/components/update/update.sh


Launchd: /Library/LaunchDaemons/com.avg.uninstall.plist


Uninstall avg

Jul 8, 2018 2:29 PM in response to DziejekDziejek

At the same time, I am a bit confused with the fact that AVs simply do not work

That's why they are not recommended around here. Most likely, they have not been updated for 10.13.5. They probably do some flaky things that are very dependent on the version of macOS that is running. Most of them have been ported from Windows and mostly detect Windows viruses they see in your mail.


and I'm worried that some malicious code is sitting on my Mac. As most of people I have my private family files and personal documents.

Use a good password. Set up a firmware password. Use two fractured appleid login. Have good backups.

Note: I do have good backups. NoteNote: if you forget you firmware password you could be SOL. If you forget you appleid password and your recovery password you will be SOL. So, I do neither of these.

Jul 8, 2018 2:46 PM in response to DziejekDziejek

Clean up:

/Library/LaunchDaemons/openvpn.plist

/Applications/Avira Phantom VPN.app/Contents/Resources/OpenVPN/openvpn

Executable not found

/Library/LaunchDaemons/AviraPhantomVPNHelper.plist

/Applications/Avira Phantom VPN.app/Contents/Helper/Helper.OSX.app/Contents/MacOS/Helper.OSX

Executable not found

Remove the items in the Clean Up section. It's just flotsam that is taking up space.

Jul 8, 2018 2:00 PM in response to BobTheFisherman

Bob,

Thanks a lot for quick reply. I've read the materials you provided in the link, I am a cautious user of the internet generally, sticking to 95% of the suggestions from there.


Now regarding my issue, just to clarify I have been removing each AV before an installation of a new one, to keep them from interfering with each other. <Maybe there are some remainings hidden deep in the folder structure?>


The first AV that stopped giving real time protection after being fine for 6 weeks was Sophos, then every other AV I installed could not be enabled. The question is why Sophos failed for no reason in the first place? then the other AVs...


Honestly, I am slightly worried that the reason why the AVs do not work, is that my Mac got infected somehow, and the malware prevents AV software from working. Can I check that somehow?

Jul 8, 2018 2:44 PM in response to rccharles

Note: I believe in physical security. I do not take my computer outside the house, so it's as safe as anything I own. I do not recommend a firmware password, because if you forget it you will need to go to an apple store with proof of ownership and ask them to reset it. I do not do the two factored [ there is also another name for it, but I forget. ], because if you loose your recovery password, you will truly be SOL. There is no apple recovery from a lost recovery password. Should you mistype you appleid password too may times, you will be locked out until you provide you recovery password. Or someone else tries to guess your password.


You may want to turn on filevault. This provided real protection by encrypting your harddrive. You best have good backup. I do not because in the cause of disk corruption, the only way to recover your data is from a backup.


I rate the data on my computer as not that valuable to others, if you have high value data on your computer, you may want to make other conclusions.


R

Jul 8, 2018 2:05 PM in response to DziejekDziejek

I second Bob the fisherman that you don't want to install any AV software your Mac.

Maybe if provide with an EtreCheck report, we might be able to spot something on your Mac. Try using the program created by Etresoft, a frequent contributor. It will provide a snapshot of your system which we can analyze to possibly determine the cause of your problem. Please use copy and paste as screen shots can be hard to read. On the screen with Options, please open Options and check the bottom 2 boxes before running. Click “Share Report” button in the toolbar, select “Copy to Clipboard” and then paste into a reply. This will show what is running on your computer. No personal information is shown.


Etrecheck – System Information

Jul 8, 2018 2:10 PM in response to DziejekDziejek

You missing the point. Apple already provides all the protection you need. It's built into macOS.


The only "protection" type software recommend around here is:

-- malwarebytes for the mac. Has a stricture definition of "adware".

-- etrecheck Let's you know the "health" of your mac.


Here are the random thoughts that I have collected on the subject.


Malwarebytes has come to be accepted as the only malware detector you should consider. For those pestered by browser attacks consider Malwarebytes.


Discusses Mac OS X operating system wide malware detection and removal

See Linc Davis, thomas_r., and etresoft comprehensive write ups on

https://discussions.apple.com/thread/5728993


etresoft steps back and states that the frequency of malware is increasing on the Mac. thomas_r. reveals his involvement in Malwarebytes as Director of Mac Offerings

https://discussions.apple.com/thread/7343915

https://discussions.apple.com/thread/7940701?answerId=31698261022#31698261022


"Malwarebytes Anti-Malware for Mac Removes adware and malware Revives your Mac"

https://www.malwarebytes.org/antimalware/mac/


"visibility & protection to the core"


https://objective-see.com/


Web browser malware removal:

see Esquared, Linc Davis

https://discussions.apple.com/thread/6689392


Fixing Safari malware attacks. See thunderzzz approach.

https://discussions.apple.com/thread/7307569


The best techniques for securing your Mac from the professionals.

http://www.macworld.com/article/2048160/how-the-nsa-snoop-proofs-its-macs.html



phishing

"fake" panic warnings

https://discussions.apple.com/docs/DOC-8771

Jul 8, 2018 2:15 PM in response to rccharles

Rccharles,

I got the point, no need to use any additional software than what Apple provides built-in and general internet usage safety measures. I understand and will not push to have any AV installed.


At the same time, I am a bit confused with the fact that AVs simply do not work and I'm worried that some malicious code is sitting on my Mac. As most of people I have my private family files and personal documents.


In response to Bob I'll include etrecheck report

Jul 8, 2018 2:38 PM in response to DziejekDziejek

At the same time, I am a bit confused with the fact that AVs simply do not work

That's because there are no known viruses for the Mac. The only malicious software that might get on the Mac is adware and malware which have to be installed by the user. Granted they may be under the guise of some other item, but there is no software that can be added to the Mac without the user allowing it. If you're worried about spyware physical access to the Mac in question is required. Unless your Mac is in a location where casual passerby have access that's not a concern.


Follow the suggestions made in the link that BobtheFisherman first posted and you'll be fine. Only download software from the App Store or directly from the developer's web site. Other sites that offer the same software for download often have hidden adware or malware in the installer.


User uploaded file

Jul 8, 2018 4:38 PM in response to DziejekDziejek

Hello DziejekDziejek,

Sorry about the pasting error. I may need to issue a new update to fix that. The problem is in your "Software Install" list for OneDrive. The version number trips the spam filters in Apple Support Communities. I do have a check for that but it only applies to kernel extensions. I must have added the software install list since then and forgot to apply that same spam-filter evasion tactic. I'll have to fix this since Office is a popular product. I've seen a couple of similar reports recently.


As for your antivirus issues, I can't disagree with what anyone else here as said. One complication is that although true Mac malware is very rare, annoying adware is quite common. Apple's built-in protection does very little against adware. But then, 3rd party antivirus apps also have very spotty performance against adware too.


I do recommend MalwareBytes for Mac. Unfortunately, it looks like when you were testing MalwareBytes, you still had Sophos installed too. EtreCheck will complain if you have more than one 3rd party antivirus app installed. I added this check recently because I was seeing more and more people having multiple 3rd party antivirus apps installed. I thought that was very risky because they all use the same techniques against the same set of files. But in all honesty, it was just a hypothetical concern. I didn't have any proof - until now. So thanks! 🙂


I don't run any antivirus software myself. There are very few that I have even attempted to test. I have run MalwareBytes and it seems to work as advertised. The current version does include a kernel extension. I was skeptical when that part was added because kernel extensions are very difficult to do properly and often cause problems. I have seen a number of reports here on Apple Support Communities from people having trouble with the MalwareBytes kernel extension. For most people, and from my limited tests, it seems to run fine. I have seen sporadic reports of other 3rd party antivirus tools catching some adware, so they do work. But there is no guarantee they will work against all adware, on all versions of macOS, or in conjunction with any other software, especially other antivirus software.


I think maybe if you try your test again, but do a better job of uninstalling, you might have better results. You can't ever drag any of these files to the trash to uninstall. You must use vendor-provided uninstaller or uninstallation instructions. Never use an "app zapper". Never try to manually delete files in hidden directories by hand.


Don't use EtreCheck to uninstall files either! You can use the "clean up" feature to clean up the mess left behind from previous manual attempts at uninstall or "app zappers". But EtreCheck's own adware or unsigned file removals are only meant for adware and malware. It will break any software you use it with. If you use it with adware, well, that's good, because you want to break it. But don't use EtreCheck to remove any unsigned files unless you are sure they are adware. For example, you have a number of unsigned AVG files. Don't use EtreCheck to remove those. Use the AVG uninstaller if you want to remove them. I won't address the question of why a major antivirus company like AVG would be distributing unsigned software. 🙂


Unfortunately, in most cases, antivirus software is simply designed for Windows. They are tested with Windows and against mostly Windows malware. In the past, when I've been forced to use antivirus for US government work, it has been a challenge. Due to said government work, I was years behind on my OS updates. But even my ancient versions of macOS were unsupported by the #1 Mac antivirus vendor at the time, with their top-of-the-line enterprise endpoint protection product. If they fail to notice Apple's new software releases with all of Apple's hype and spectacle, how are they supposed to notice new releases from malware developers who are trying to attract a lot less attention than Apple?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Can't enable real time protection in any antivirus (tried 5 already), desperate to keep Mac protected, how?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.