PSA: Here’s how to check for – and remove – the Mac malware mshelper

If your Mac seems to be running at high fan rates or you’re seeing reduced battery-life for no apparent reason, you may want to check for some Mac malware that seems to be going around …

A couple of support threads have described people finding a process called mshelper using a lot of CPU usage.

From the little that’s known about it so far, it seems this is either adware or a cryptocurrency miner. Despite the heading in the Reddit thread, there’s no evidence that it’s a virus, so the most likely explanation for its spread is a sketchy download which installs it alongside some other app.

You can check for it by launching Activity Monitor and then clicking on the CPU tab to sort by highest CPU usage. Look for a process called mshelper at or close to the top.

If you find it, killing the process doesn’t help as it restarts itself. But you can remove it by deleting two files:

1. /Library/LaunchDaemons/com.pplauncher.plist
2. /Library/Application Support/pplauncher/pplauncher

It’s likely that Apple will add mshelper to the macOS blacklist shortly to disable it, but the above will reportedly resolve it in the meantime.

Check out 9to5Mac on YouTube for more Apple news: