How to delete the 'mshelper' malware from macOS

Posted:
in macOS
If your Mac is running hot and is consuming its battery at a higher rate than expected in recent days, you may be affected by 'mshelper.' AppleInsider explains how to check for the resource-consuming malware, and how to stop it from slowing down macOS.




New malware affecting macOS has started to circulate, with reports from Mac users on Apple's support forums and Reddit revealing systems are being affected by it. Affected Mac systems typically have their processor running at full tilt, which can prevent other software from working optimally due to resources being used on this unwanted program.

The high processor usage can also cause the Mac to run its fans constantly to try and cool everything down. For MacBook users, mshelper's interference also means the battery life will erode away faster than normal.

It is unknown what exactly mshelper is doing to utilize the processor at such a high rate, but speculation on the Apple support forum suggests it could be some form of adware, or possibly a program used for mining cryptocurrency on a victim's computer. Aside from using the processor, there also doesn't seem to be any other issues it causes on affected desktops, as is typical with ransomware.

As it isn't a virus, it is likely mshelper is distributed through an installation of another piece of software rather than spreading organically.

Checking for mshelper

Open Activity Monitor, which can be found in the Applications folder under Utilities. Alternately, you can search for "Activity Monitor" in Finder, under a "This Mac" search.



Once Activity Monitor is open, click CPU to bring up a list of processes currently using it, then click the Process Name tab to sort the list by alphabetical order. Scroll down the list until you reach where mshelper would appear alphabetically.




You can also click %CPU to sort the list by processor usage. As mshelper is a processor-intensive program, it should appear at the top of the list.




If it appears at all, then the next task is to eliminate it from macOS.

Removing mshelper

While it is possible to kill the process, this is futile due to it automatically restarting once closed. One way to stop this from happening is to delete just two files buried in the Mac's library.




In Finder, select your Mac's internal storage, then select Library followed by the LaunchDaemons folder. Select com.pplauncher.plist and delete it.

The other file is also found in the Library, under Application Support then pplauncher. Select and delete pplauncher.

At this point, you can kill the process.

Further notes

Apple does operate its own anti-malware protection system in macOS, designed to protect against threats known to the company. While it isn't currently protecting against this issue, it is highly probable Apple will include changes in a future update to prevent it from working.

Comments

  • Reply 1 of 19
    racerhomie3racerhomie3 Posts: 698member
    This most likely shipped with pirated software .

    lkruppwilliamlondonedred
  • Reply 2 of 19
    lkrupplkrupp Posts: 6,389member
    This most likely shipped with pirated software .

    In other words, you get what you pay for and in this case what you didn’t pay for. 
  • Reply 3 of 19
    Mike WuertheleMike Wuerthele Posts: 3,302administrator
    This most likely shipped with pirated software .

    It seems likely. We're trying to run it down.
    chasm
  • Reply 4 of 19
    bulk001bulk001 Posts: 400member
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    williamlondon
  • Reply 5 of 19
    racerhomie3racerhomie3 Posts: 698member
    bulk001 said:
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    Trusted developers & websites do not ship adware with their software.
    williamlondonMplsPmac_dog
  • Reply 6 of 19
    jdgazjdgaz Posts: 297member
    bulk001 said:
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    Trusted developers & websites do not ship adware with their software.
    You mean like Mr Softie?
  • Reply 7 of 19
    nunzynunzy Posts: 662member
    One of the greatest things about Apple products is that they are free of viruses. But these haters want to ruin things.
  • Reply 8 of 19
    StrangeDaysStrangeDays Posts: 5,587member
    nunzy said:
    One of the greatest things about Apple products is that they are free of viruses. But these haters want to ruin things.
    Still are. Malware isn’t a self-replicating virus of the sort we remember warmly on Windows. (or even old System versions)
    chasmwatto_cobra
  • Reply 9 of 19
    nunzynunzy Posts: 662member
    nunzy said:
    One of the greatest things about Apple products is that they are free of viruses. But these haters want to ruin things.
    Still are. Malware isn’t a self-replicating virus of the sort we remember warmly on Windows. (or even old System versions)
    That's what I'm saying.
  • Reply 10 of 19
    DoodpantsDoodpants Posts: 15member
    bulk001 said:
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    Trusted developers & websites do not ship adware with their software.
    Okay, you're definitely new to the internet. There have been plenty of free software distributions from legitimate developers where, if you didn't uncheck the right box during installation, you would find that your browser's home page had been changed, or it had a new toolbar installed in it. Java shipping with the Ask.com toolbar is probably the most notorious. RealPlayer was another one from the earlier days.

    And that's not even getting into malware distributed on non-free products, such as when Sony distributed rootkits on their music CDs. So, plenty of "legitimate" companies have distributed adware/malware with their products.
    edited May 18 singularitynunzygatorguyosmartormenajrcaladanianfastasleep
  • Reply 11 of 19
    focherfocher Posts: 624member
    Malware is almost never a virus. Malware is just a software application that does nefarious things, and it's almost always user installed - directly or indirectly.

    No operating system can truly prevent malware, because it would have to essentially never allow applications to run. There are whitelisting solutions that are configured to ensure only authorized applications run. MacOS currently uses a combination of partial-whitelisting through Gatekeeper and blacklisting through the built in XProtect software in MacOS since 10.6. This allows Apple to blacklist applications, and it periodically pushes out updates to this list which is stored at /System/Library/Core Services/CoreTypes.bundle/Contents/Resources/XProtect.plist
    jasenj1
  • Reply 12 of 19
    bulk001 said:
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    Trusted developers & websites do not ship adware with their software.
    Stuff happens.
    https://appleinsider.com/articles/17/05/08/handbrake-for-mac-developers-warn-of-potential-trojan-installation-following-server-breach

    Doodpantsfastasleep
  • Reply 13 of 19
    I've had problems with high CPU usage in the last few weeks, but it wasn't mshelper. It was the classic bug of kernel_task going berserk. Still haven't found a reliable way to prevent that. Googling it, I see I'm far from the only one who complained about this. Damn you, Apple.
    lostkiwi
  • Reply 14 of 19
    fahlmanfahlman Posts: 690member
    Doodpants said:
    Trusted developers & websites do not ship adware with their software.
    Java shipping with the Ask.com toolbar is probably the most notorious. RealPlayer was another one from the earlier days. 
    Oracle and RealPlayer? He did say Trusted developers.
    tokyojimu
  • Reply 15 of 19
    The article states:

    "then click the Process Name tab to sort the list by alphabetical order. Scroll down the list until you reach where mshelper would appear alphabetically."

    Why not just type "mshelper" in the search field?
    fastasleep
  • Reply 16 of 19
    Mike WuertheleMike Wuerthele Posts: 3,302administrator
    The article states:

    "then click the Process Name tab to sort the list by alphabetical order. Scroll down the list until you reach where mshelper would appear alphabetically."

    Why not just type "mshelper" in the search field?
    That works too.
  • Reply 17 of 19
    majorslmajorsl Posts: 46unconfirmed, member
    Sophos home (free) does detect and block it, FWIW.
    MplsP
  • Reply 18 of 19
    MplsPMplsP Posts: 610member
    Waiting for someone to make the obligatory “but Macs don’t get viruses” troll post....

    nunzy said:
    One of the greatest things about Apple products is that they are free of viruses. But these haters want to ruin things.
    Well, technically no. IIRC there are one or two mac viruses, but in my book, malware and viruses are one and the same. I realize that there are technical differences, but in the end, it is code running on your machine doing something you don’t want and that you need to get rid of. There is definitely less malware on Macs than on Windows, but there’s enough to cause problems, so in the end it doesn’t matter because you still need to be careful and take precautions.

    racerhomie3 said:
    bulk001 said:
    This most likely shipped with pirated software .

    You do realize that there is lots of software that is available for download for free right? Maybe you are new to the Internet ... [facepalm]
    Trusted developers & websites do not ship adware with their software.
    And how do you tell if a developer is trusted or not? By their nice website?
  • Reply 19 of 19
    bestkeptsecretbestkeptsecret Posts: 2,944member
    I'm just tickled that the malware is called "mshelper".
Sign In or Register to comment.