Some Mac users being warned that Amazon Music app and HP drivers are malware [u]

Posted:
in General Discussion edited October 2020
Some users are reporting that they can no longer print to HP printers, or can't continue playing Amazon Music through the dedicated app, because of a macOS error that claims the software is malware. Update: HP is reportedly working with Apple to fix the problem.

Some users of HP printers or the Amazon Music app are reporting error messages like this
Some users of HP printers or the Amazon Music app are reporting error messages like this


AppleInsider has been contacted by users reporting that their Macs are suddenly claiming their HP printers contain malware and "will damage your computer." Separately, other users are reporting the same issue, but to do with the Amazon Music app.

In each case, attempting to launch the app or to just use the Mac, brings up a dialog box. It reports that there is malware, says it will damage the Mac, and advises users to move a particular file to the trash.

That file can be the Amazon Music app, or it can be the HP printer driver called "HP Device Monitoring.framework." Users have the option to click Move to Trash or Cancel, but if they cancel, the error keeps reoccurring.

Computer Question: I didn't update my drivers or OS or anything... but all of a sudden, my (old HP Laserjet) printer stopped working yesterday.

When I check the logs it says the legacy driver no longer works. HP doesn't have a new driver...

Any ideas?? pic.twitter.com/zGC4dxDluI

-- Still Jim (@CrazyJimP)


The problem originally appeared to be related to Apple's XProtect. This is part of Gatekeeper, Apple's security system that exists to identify and disable malware on Macs.

Most reported incidents are from consumers, but AppleInsider can now confirm that the issue is affecting printing in enterprise as well. It appears to still be possible to successfully AirPrint from Mac to an affected HP printer, however.

Most users affected report that they have not recently updated either their HP printer drivers, or the Amazon Music app. The presumption is that it's therefore to do with a behind-the-scenes macOS malware definitions update, but has not been confirmed.

Update: the issue does appear to be related to XProtect, but was specifically caused by HP asking Apple to revoke its printer drivers. It's not known why HP requested this, but the company reportedly told The Register that it wasn't intended to cause these problems.

"We unintentionally revoked credentials on some older versions of Mac drivers," said a HP spokesperson. " This caused a temporary disruption for those customers and we are working with Apple to restore the drivers. In the meantime, we recommend users experiencing this problem to uninstall the HP driver and use the native AirPrint driver to print to their printer."

There is also now a workaround that should fix the issue. It involves removing the old HP printer driver and getting the Mac to download a new version.
camelia
«13

Comments

  • Reply 1 of 46
    razorpitrazorpit Posts: 1,796member
    Amazon and HP. No surprises there.  ;)

    Seriously though, HP needs to update their drivers.
    watto_cobra
  • Reply 2 of 46
    What version(s) of Mac OS Does it appear to be affecting?
    watto_cobra
  • Reply 3 of 46
    Mike WuertheleMike Wuerthele Posts: 6,928administrator
    crispyds said:
    What version(s) of Mac OS Does it appear to be affecting?
    We have reports of both Amazon Music and HP drivers from both Mojave and Catalina.
    watto_cobra
  • Reply 4 of 46
    I'm using Catalina and Win10 on Bootcamp.
    watto_cobra
  • Reply 5 of 46
    I have Bootcamp and Amazon Music is on there as well as on OSX. I had just installed Paragon NTFS, which I've done many times (free trial!) and had rebooted into OSX. I then got the warning about Amazon Music. First time that's ever happened. I binned it, rebooted, (no warning this time) re-downloaded the app to OSX and it works fine. Did OSX get a bit confused regarding the Bootcamp version of it and throw a wobbly?
  • Reply 6 of 46
    happened to my mac. its driving me nuts. what to do? if i delete it i wont be able to use the printer?
  • Reply 7 of 46
    Well, this happened to me also under Catalina: both for a Citrix ReceiverHelper file and two HP directories HDPM.framework and HPDeviceMonitoring.framework. I recently did a total restore from a Time Machine backup, so I assumed something went wrong there and I did a reinstall of the HP drivers. The problem did disappear, but seeing this post It may have been unnecessary. 
    watto_cobra
  • Reply 8 of 46
    im scared to tinker my mac.. should i wait for the update? its annoying looking at it
  • Reply 9 of 46
    crowleycrowley Posts: 10,453member
    Happened to me with a pair of MacBook Airs connected to a bluetooth HP printer earlier today.  Good to know that it's not just our set up.
  • Reply 10 of 46
    I just use my printers as printers, but here's what I did to fix it..... Downloaded HP Easy Start and used it to Uninstall HP Software (Under HP Easy Start in main menu ) Warning says this deletes all HP install settings. Then just hit print and selected my hp printer. Printing fine now. 


    JFC_PAmwhiteNigelstwatto_cobra
  • Reply 11 of 46
    I fixed it by downloading "HPPrinterDrivers5.1.dmg" from HP here and running it. A restart later, I'm good to go.
    JFC_PAraulcristianrazorpitwatto_cobra
  • Reply 12 of 46
    FIX: I wiped my Mac of everything HP printer related. Then as directed on apple’s website, went to 123.hp.com
    located my printer by following the steps, ensured my printer was connected to my network, then I was able to download the software/drivers. Basically started fresh. Everything is happy and working now. It’s always something lol. 
    edited October 2020 JFC_PAwatto_cobra
  • Reply 13 of 46
    jblongzjblongz Posts: 170member
    Flagged as malware because these software may have access and/or capability to monitor you in an intrusive way.
    watto_cobra
  • Reply 14 of 46
    I removed and then reinstalled the HP drivers, restarted several times and it still wont work.
  • Reply 15 of 46

    For Apple users:

     

    Solution from a user:

    I've just got rid of it by:

    1. Using Finder to go to "Library/LaunchAgents" and moving the most recently added and suspicious looking file to the bin.
    2. Did the same here "Library/LaunchDemons"
    3. And here "~Library/LaunchAgents"
    4. I also went to "Applications" and sorted by most recently added to see if anything suspicious has been added, and removed that.
    5. Then I restarted my Mac and it's fixed!
     
    *****I deleted com.hp.devicemonitor.plist from ~Library/LaunchAgents and (knock on wood) the alert is gone!
  • Reply 16 of 46
    I deleted every hp directory in the files path the dialogue box pointed me to. Then I deleted the printer from the printer System preference. Then I added my hp printer again. The proper drivers were downloaded and the thing printed again. 


    JFC_PAwatto_cobra
  • Reply 17 of 46
    This just happened to me after upgrading to OS 15.7. 

    It won't go away, and it is quite frustrating. I realize deleting "com.hp.devicemonitor.plist"(etc) has fixed the problem for some, but are there any unwanted side effects?

    edited October 2020 watto_cobra
  • Reply 18 of 46
    I get a "HP Scanner 3 will damage your computer" when I open my Printer Queue window, and then select the Scan button (but not the other error message). I downloaded 10.15.7 earlier this week. A friend had the other error message with 10.15.5 today. 
    watto_cobra
  • Reply 19 of 46
    tmbrg70 said:

    For Apple users:

     

    Solution from a user:

    I've just got rid of it by:

    1. Using Finder to go to "Library/LaunchAgents" and moving the most recently added and suspicious looking file to the bin.
    2. Did the same here "Library/LaunchDemons"
    3. And here "~Library/LaunchAgents"
    4. I also went to "Applications" and sorted by most recently added to see if anything suspicious has been added, and removed that.
    5. Then I restarted my Mac and it's fixed!
     
    *****I deleted com.hp.devicemonitor.plist from ~Library/LaunchAgents and (knock on wood) the alert is gone!
    These are uninstallation instructions.  This isn't exactly a fix unless uninstalling the software is a fix.
  • Reply 20 of 46
    jblongz said:
    Flagged as malware because these software may have access and/or capability to monitor you in an intrusive way.
    That isn't the reason. Most likely Apple has nothing to do with this.

    I didn't verify this, but it sounds like a code signing issue to me.

    Apps that were code signed with a provisioning profile that use advanced capabilities before February 22, 2017 will work for 5 years before showing this error. Apps signed after that will work for 18 years.  These apps probably have not been updated in the last 5 years so they are now expired.

    From Apple docs:
    "For apps that utilize advanced capabilities with a Developer ID provisioning profile Gatekeeper will evaluate the validity of your Developer ID certificate when your application is installed and will evaluate the validity of your Developer ID provisioning profile at every app launch. As long as your Developer ID certificate was valid when you compiled your app, then users can download and run your app, even after the expiration date of the certificate. However, if your Developer ID provisioning profile expires, the app will no longer launch."
    edited October 2020 dewmeraulcristianwatto_cobra
Sign In or Register to comment.