Unable to Remove Malware Crusher

Forgot to mention that I was following this link:

How to Automatically remove Malware Crusher on macOS and Mac OS X?

to remove the mchlpr.exe

I tried the Malwarebytes some of you have mentioned, it helped remove some other malware, but not this one.

(as a mentioned in my last post, the package you downloaded and installed is actually a Malware bundle, not really an Adobe update package - so it's not Adobe's fault. To find it out yourself, install it again, but during the installation click on the 'View website' yourself. It should go to Adobe website, but what you see is a crap)

The Malware bytes found the following for me by the way. It's not directly relating to this problem but I think it's good to run it as it's free for 30 days.

To help troubleshoot your Mac, I would suggest that you consider using EtreCheck and posting the resultant report for us to review. Since you were a Unix sysadmin previously, you may discover the location of this malware before we do.

• You can download EtreCheck from here.
• Start EtreCheck from a normal user account. Optionally, you can run it from a user account with Administrator privileges.
• Select Options

  Verify that the two options: "Ignore expected failures in Apple tasks" and "Hide Apple tasks are enabled." Note: They should be by default. You can skip this step the next time your run EtreCheck.

• Select a problem from the drop-down menu to enable the "Start EtreCheck" button. Optionally you can add comments on what you are experiencing, especially to aide others with if you post the results.
• Click on Start EtreCheck
• Allow the program to run to completion.
• When done, you should get a results report.
• Select the "Share Report" icon.

  Select Copy Report

• Paste the report to your reply post.

In addition, I would suggest that you also consider using Malwarebytes to try to eradicate this from your Mac.

The EtreCheck confirms your original post in that this malware is not being discovered. I am assuming that you also tried Malwarebytes to remove it, but that wasn't successful either ... correct?

If that's the case, I can only offer the following suggestions:

1. Remove CleanMyMac.
2. Remove all versions of Adobe Flash / Flash Player.
3. Remove Google Chrome
4. Do an Internet search on "Malware Crusher." See if it provides any useable articles for you to review.
5. Finally, if someone else has had this issue and found a solution, maybe they can chime in.

Due to there being several 'malwarebytes' products through the link

you posted, one to 'free' mac product may be adequate from here:

Malwarebytes Anti-Malware for Mac

LEARN MORE DOWNLOAD

Best regards! 🙂

com.techyutils.mchlpr.plist is running as a user launch agent and this is likely starting the Malware Crusher program. It's made by Techyutils and "mchlpr.plist" sounds like "Malware Crusher Helper.plist".

Make sure you have a current time machine backup of your data just in case something goes wrong, then boot into safe mode and try removing this item. Note this will only stop the program from automatically launching and the program itself will still be on the computer somewhere.

The Malwarebytes for Mac had previous recognition of odd issues with

the main player behind the ungainly software in your Mac as seen by

use of Etrecheck report... re: 'Techyutils Software Private Limited'

A few articles last year by Thomas Reed, made mention of the products

and their purveyor; sometimes the certificate may not match the actual

source of the problem.

PCVARK plays dirty - Malwarebytes Labs

PCVARK plays dirty Posted: August 19, 2016 ... Private Limited," while the

Mac File Opener certificate belongs to "Techyutils Software Private Limited. ...

https://blog.malwarebytes.com/threat-analysis/2016/08/pcvark-plays-dirty/

A broad search using those words together shows where they belong,

and their claims do not appear to be substantiated in fact to be useful.

https://duckduckgo.com/?q=Techyutils+Software+Private+Limited&t=ffsb&ia=web

So their product 'remove malware crusher' and others, tend to look as

the cure to their bait. Some makers create an issue then offer $olutions.

Objective-See

As 'Whats Your Sign' shows, malware is signed with an Apple Developer ID belonging to 'Techyutils Software Private Limited.' More signed OS X malware ...

https://objective-see.com/blog/blog_0x12.html

So something of this ilk is behind some of the problem you've faced;

also those other untoward offerings whose makers suggest they are

a kind of 'fix' can be the cause of much unnecessary grief in macOS.

{cleanmymac, mackeeper, & other such items have a bad history here}

You may have to look into any archived backup which pre-dates these

problematic software additions to your Mac, if you use them to restore

your Mac; or simply re install the entire system and then make a full

backup including a bootable system clone on external enclosed HDD.

Good luck & happy computing! 🙂

Hi Rasana,

I have the same problem, after clicking on a Adobe Update package a number of malwares are installed and I took pains to remove them but the the mchlpr just keeps restarting itself.

What I'd want to add is that the 'Adobe Update Package' you download is actually not the updater, just a bundle of malwares using Adobe's name and icon. I click on the package again but this time I visit the webpage (there's always one before you install dmg), and actually it leads to a some ******** webpage.

You can verify this by doing it yourself again - just that stop it before the final step.

Actually, that very well may be the cause of the Malware Crusher pop-ups, as Advanced Mac Cleaner and Malware Crusher are made by the same scam company.

If you're still seeing Malware Crusher pop-ups, try restarting your computer, then do another scan with Malwarebytes.

Thanks. Probably it is the same root cause but I did tried to run the Malwarebytes and restarted the OS as you said, but it was still there.

I cleaned it up by following the instructions I mentioned in the post, it was a bit painful because some steps are manual removal. But it really did the job.

Anyway it seems that the best way is to be 100% sure what you're doing before you install any software. A sudden pop-up, especially the ones apear when you're browsing a web, are very likely to be malware, though the icon, warning, etc., looks like a good one.

Try using the ASC search feature. I just came up with this ASC post on this topic: How to get rid of malware crusher pop up

Good point. Thanks!

I tried Malwarebytes, but it doesn't find this Malware Crusher. It's very well hidden!