How to remove the ‘mshelper’ Mac malware

Macs may have a reputation for being resilient to malware, but no technology is immune to the ever-increasing range of digital dangers.

If your Mac’s battery is draining faster than usual, the fan sounds louder, or the casing is getting hot for no readily apparent reason, then you may be feeling the affects of the latest piece of Mac malware.

Recently, Mac users have noticed a mystery ‘mshelper’ program burning through their CPU cycles at an alarming rate. While it’s not currently clear what this program is doing, one popular theory is that it’s part of a crypto-mining operation that’s designed to generate cryptocurrency from your computer, without your knowledge or permission – a process that could potentially permanently damage your hardware.

Any CPU-hungry application is bad news for your Mac’s battery life and overall performance, so if your Mac is running a little louder, slower or hotter than usual then it’s worth checking whether mshelper has infected your Mac.

Is mshelper burning through my system resources?

The easiest way to check whether mshelper is affecting your Mac, is to use macOS’ built-in Activity Monitor app:

• Open a new ‘Finder’ window.
• Navigate to ‘Applications > Utilities.’
• Launch Activity Monitor.
• Select the ‘CPU’ tab.

• Search for ‘mshelper.’

If Activity Monitor returns zero results, then congratulations, your Mac is in the clear! However, if mshelper does crop up in your search results, then for the sake of your Mac’s battery life and overall performance, you should remove all trace of it from your machine.

Delete mshelper without any third party software

To banish mshelper without downloading any additional software, you’ll need to delete two files from deep in your Mac’s library, and then quit the mshelper process.

• Open a ‘Finder’ window.
• Select ‘Go > Go to Folder… ‘ from the menu bar.
• Enter ‘/Library/LaunchDaemons’ and then click ‘Go.’
• Find a file named ‘com.pplauncher.plist,’ delete it and then empty the Trash.
• Select ‘Go > Go to Folder…’ from the menu bar.
• Enter ‘/Library/Application Support,’ then click ‘Go.’
• Find a file named ‘pplauncher,’ delete it and then empty the Trash.

Finally, you’ll need to stop the ‘mshelper’ process:

• Relaunch Activity Monitor (‘Applications > Utilities > Activity Monitor.’)
• Select the ‘mshelper’ process.
• Click the ‘Force a process to quit’ icon (towards the upper-left of Activity Monitor).

Removing mshelper with EtreCheck 4

Alternatively, you can detect and remove mshelper using the third party Etrecheck application.

EtreCheck is priced at €15.00 / $10 USD, but you can run it for free a few times before deciding whether EtreCheck is right for you.

To search your Mac using EtreCheck:

• Download the latest version of EtreCheck.
• Unzip the EtreCheck file, and then launch the application.
• Click the bouncing EtreCheck icon that should have appeared in your Dock.
• Read the terms and conditions, and if you’re happy to proceed then click ‘I agree.’
• Open the ‘Choose a problem’ dropdown, and then select ‘Computer is too slow.’

• Click ‘Start EtreCheck.’

If mshleper is present on your machine, then EtreCheck will notify you and help you remove it. After removing mshelper, it’s recommended that you launch Activity Monitor, check for the mshelper process, and manually stop it, if necessary.