How to get rid of malware crusher pop up

I was having the EXACT issue. I ended up finding the app that was causing this notification to pop up and delete the file. It was in my Application folder. 2 of them actually. One named "Malware Crusher" and then I also had a folder named "_MacOSx" (if you open the folder you will see another app called malware crusher). I deleted both and now I am not having the issue any more. I haven't had the notification pop up for over 2 days now so if you had this then you know how many times a day it would pop up.

Hi,

See if Malwarebytes will take care of it. Don't worry, it's safe: run Malwarebytes: https://www.malwarebytes.com/mac/

Hello Fishin301,

I thought this was a case of notification SPAM. Deleting a non-Mac App Store app will not remove any pending notifications. There are some apps that will fill up your notification queue with ads so that, even if you delete the app, the ads will live on. The soon-to-be-released EtreCheck 3.4 is the only way to remove these notifications without resorting to Terminal commands and SQL. A week ago I posted instructions on how to use those manual techniques in this thread: Re: Annoying PDF Expert 'TRY NOW' Pop up. Since then, I've added this as a feature to EtreCheck and thought this would be a good chance to test it in the wild.

From the description of the problem, I thought Malware Crusher was doing the same thing. I just tried it, however, and it didn't create any notifications on my test system. It did immediately display a number of harmless cache files as "infections". Ironically, one of those "infections" that it reported was a file that it created.

For the record, EtreCheck will not delete any apps at all. It will disable adware so that it doesn't run an inject ads, but that is it. MalwareBytes will actually delete any adware (or Potentially Unwanted Programs) that it recognizes. But EtreCheck can detect and disable even brand new adware that no other app can detect. Both EtreCheck and MalwareBytes were developed to help other Mac users here on Apple Support Communities. Manual instructions such as what I posted above can be dangerous. On more than one occasion, I have been helping someone here on Apple support communities try to manually delete some app and saw them get confused and start randomly deleting other, important files. This has happened to other helpers as well. So, I am trying to add features to EtreCheck that will safely perform low-level operations like this without the need for UNIX commands. But if you really want the UNIX commands, I'm happy to help with those too.

Adware is designed to avoid deletion. It is unusual to be able to go into the Applications folder and just delete it. And after testing Malware Crusher, I can confirm that your instructions are not adequate. You still have parts of Malware Crusher running. I don't know what is going on with your "_MacOSx" folder. That sounds like a Mac zip file decompressed on a PC or something. It shouldn't be in your Applications folder and Malware Crusher didn't create it. It sounds like you have other problems that need to be addressed. I suggest you run MalwareBytes to completely remove Malware Crusher. If you have other problems, start a new thread and mention that "_MacOSx" folder. Someone might recommend you run an EtreCheck report. I wouldn't disagree with that advice. 🙂

Find and remove items at the following paths:

~/Downloads/mcr_mcrsite.pkg

/Applications/Malware Crusher.app

~/Library/LaunchAgents/com.techyutils.mchlpr.plist

• ~/Library/Application Support/MCR/mchlpr.app/Contents/MacOS/mchlpr
• ~/Library/Application Support/MCR

• ~/Library/Application Support/Malware Crusher/params.plist
• ~/Library/Application Support/Malware Crusher/settings.plist
• ~/Library/Application Support/Malware Crusher

~/Library/Malware Crusher/msets.plist

Do not attempt to use the app's own uninstaller. From my scan of the installer.pkg, the uninstaller does little more than give you another "chance" to buy it.

If you're not comfortable removing these items yourself, you can us a little tool I wrote called DetectX to do it for you.

Disclaimer: this post contains a link to my website and software from which I may gain some kind of compensation.

DetectX is 'donationware' - meaning you can use it without any requirement to pay.

Hello jmelvinthree,

Are these notifications? What do they say? Can you click on them? What happens when you do that?

This sounds like another case of notification SPAM. I recently added this to my adware removal app EtreCheck, but it isn't released yet. If you want to try the beta version, you can download EtreCheck 3.4 from https://www.etrecheck.com/download/EtreCheck_beta.zip and run it. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID.

I have tested this new feature on a couple of apps that I know will load up your notification queue with ads. But there are always new scam apps being developed. I would like to know if EtreCheck can detect your notification spam and remove it.

Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.

Unfortunately, your can't use Google for suggestions. The internet is just covered with ads for "clean up" apps. The link you posted is just an ad for one of those "clean up" tools that is likely made by the same company that developed "Malware Crusher".

I know this may look sketchy, but I am just an average computer user.

Download Malwarebytes | Malwarebytes Anti-Malware for Mac

It worked. It asked me to restart my computer, which made me nervous, but I did it.

Malware Crusher is gone and then I deleted the Malwarebytes program.

Chris

MalwareBytes is an effective tool for removing adware. But it sounds like jmelvinthree is talking about notification SPAM. Even if the adware is removed, those notifications are still sitting in a database and will keep demanding attention. Maybe there are only 4 notifications pending. Maybe there are 12 pending. There is no limit really.

The big danger here is that someone might think that MalwareBytes didn't work when the next notification pops up in two days. Then they might try to download some other anti-malware tool. But that might lead them right back to some scamware program that just does a fake antivirus scan and then, wait for it, fills the notification queue full of ads for their "pro" antivirus version.

It is important to identify exactly what the symptoms are. Pop-ups in a web browser might very well be adware. But notification pop-ups are different and need a different approach.

You may be correct in saying what I did is not adequate but.... I did not have to download and install a 3rd party app to delete another app I never wanted. "EtreCheck" may be an effective program but I am not looking to install, purchase, download or use another application to remove one I never wanted. I believe the "_MacOSx" folder was just a sneaky way to hide the malware crusher app. I have seen malware hide their apps in folders named completely different in what seems to be legit systems folders. Either way, the notifications has stopped and I did not have to download any malware detector/remover program.

I used etrecheck and the following is posted under user launch agents:

[running] com.techyutils.mchlpr.plist (Techyutils Software Private Limited - installed 2017-06-02)

I had already removed the application. I cannot remove the library entry because it's "in use". Still getting notifications. Now what?

Hello aoberg88,

How did you remove it? I suggest using MalwareBytes via the link above. Apps like this are firmly in the grey area. They are signed with a valid developer ID so EtreCheck won't automatically flag them. They aren't actually adware so I don't flag them that way. But they may be considered "Potentially Unwanted" by apps like MalwareBytes.

I plan to have a future version of EtreCheck provide more direct control over disabling any and all background tasks like this. But this would be just "disabling", not uninstalling. Unfortunately, many modern apps simply cannot be uninstalled by the user without help. I do not have the resources to build an "app zapper" for every 3rd party program in the world. Maybe companies like MalwareBytes can manage that.

IplayGuitar4fun wrote:

Fishin301 seems to be correct. The other post is added by Etresoft pushing Etre software..........

Hardly. Twice in this thread I recommended another tool, MalwareBytes for Mac.

From the description of the problem, I thought this was notification SPAM. EtreCheck is the only app that can delete notification spam. But then after trying it, I did not see any notification SPAM. Because Malware Crusher is not adware, EtreCheck isn't going to do anything about it. If you want to remove some other legitimate software that a tool like MalwareBytes might classify as "Potentially Unwanted", then you will have to use MalwareBytes.

And it most certainly is adware. Aside from the ones I've mentioned above (I haven't seen your _MacOSx folder yet) and a few more I haven't mentioned yet (this warren goes deeper than I'd at first anticipated, and I haven't finished yet), there's also

~/Library/hlprmcr

You might want to check for that. It contains a plist with arguments to a few other binaries and url's to other notorious adware agents.

You, my friend, are an absolute champion!! I had already tried malwarebytes' free version upon my MacBook but it didn't seem to assist me at all & simply wanted me to buy the licensed version - surprise, surprise! Anyway, although I'd used my licensed form of "CleanMyMac 3" to uninstall malwarebytes, I was still receiving "quarantine" pop-up messages from them - so I had to re-install malwarebytes, simply in order to be able to uninstall it by using malwarebytes' own uninstall utility - crazy!!

However, I was still receiving malwarecrusher messages AT LEAST every half an hour over the past 24 or so hours - & although I had noticed the "_MacOSx" 'file' at the top of my Applications folder & I did briefly think on more than one occasion that it was only a recent addition to my applications that I had noticed, each of these times I gave it no further thought & continued to search for something else that was amiss, preferably with the title of "malwarebytes" - d'oh!! As soon as I followed your advice & trashed & then permanently deleted "_MacOSx", my one remaining pop up issue has since been GONE FOR GOOD!!

Thanks so VERY much for your simple, yet 100% invaluable advice!!

And these:

• ~/Library/Malware Crusher/db_adw_mac.db,
• ~/Library/Malware Crusher/scan_info,
• ~/Library/Malware Crusher,