What is mshelper?

Before seeing your post, I actually did intensive research online and there wasn’t that much information about mshelper. If there was any, it’d be recent as well. My guess is that this malware is very new so the anti-virus or malware programs are yet to be able to regconize or fix it.

Hi guys! I really need help. I have the 'mshelper' issue too. Ran the etrecheck and got the same results as you guys. I went into my library but can't seem to find /Library/LaunchDaemons/com.pplauncher.plist and /Library/Application Support/pplauncher/pplauncher.

What else can i do now? Please help!

Thank you.

Ok I can't seem to purchase the license... it says that "EtreCheck cannot communicate with its license server. If you are using an internet firewall or filter such as “Little Snitch”, please disable it or allow EtreCheck to contact its servers." I am not using little snitch... Any clue?

It's fairly simple. Etrecheck flags everything it doesn't already know about as possible adware.

Other, more responsible, software only flags something that it can positively identify as a threat as a threat.

Etrecheck's philosophy is a strength for anyone who is running nothing but well-known, commercial-like software. It's a false positive nightmare for anyone who isn't.

softwater wrote:

Etrecheck flags everything it doesn't already know about as possible adware.

No. That is false.

Other, more responsible, software only flags something that it can positively identify as a threat as a threat.

That isn't being "more responsible". That is being standard, run-of-the-mill 3rd party anti-virus software. Ask the people in this thread how well that software worked out for them.

Etrecheck's philosophy is a strength for anyone who is running nothing but well-known, commercial-like software. It's a false positive nightmare for anyone who isn't.

"False positives" are what 3rd party antivirus software generates. Because EtreCheck is not antivirus or security software, "false positive" are impossible.

As a convenience for users, EtreCheck does have the same kind of basic adware detection that some 3rd party security apps provide. But ultimately EtreCheck isn't looking for adware or malware. EtreCheck is looking for anything that might be a problem. Any software in 2018 that still doesn't have a digital signature is a potential problem. It is impossible to say anything definitive about software that doesn't have a digital signature. EtreCheck will try to make a guess. As can be seen in the EtreCheck report above:

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.adobe.SwitchBoard.plist

Executable: /Library/Application Support/Adobe/SwitchBoard/SwitchBoard.app/Contents/MacOS/launch.switchboard

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.valvesoftware.steamclean.plist

Executable: /Users/***/Library/Application Support/Steam/SteamApps/steamclean

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.pplauncher.plist

Executable: /Library/Application Support/pplauncher/pplauncher

Details: Domain name invalid - possibly adware

Launchd: /Library/LaunchDaemons/com.macpaw.CleanMyMac3.Agent.plist

Executable: /Library/PrivilegedHelperTools/com.macpaw.CleanMyMac3.Agent

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

16 32-bit apps

Kernel Extensions:

/Library/Extensions

[Loaded] Soundflower.kext (MATT INGALLS, 2.0b2 - SDK 10.10)

[Loaded] MB_MBAM_Protection.kext (Malwarebytes Corporation, 3.3 - SDK 10.13)

[Loaded] SophosFileProtection.kext (Sophos, 9.7.4 - SDK 10.12)

[Loaded] SophosFileMonitor.kext (Sophos, 9.7.4 - SDK 10.12)

[Loaded] SophosWebProtection.kext (Sophos, 9.7.4 - SDK 10.12)

sometimes EtreCheck guesses are better than "more responsible" antivirus software.

Yeah I know that. I’d never used these programs and only resorted to them then in desperation ): I knew CleanMyMac was pretty much a scam but I just came across a post about using it to get rid of “mshelper” so I gave it a try.

Anyway, thank you so much for the very thorough advice.

Wow, worked like a charm.

Thank you so much. This is such a great relief.

This may show up under the "Unsigned Files" catagory like shown below.

Hello RonEdwards,

I'm happy that EtreCheck was able to help. However, I would like to clarify a couple of things.

You don't need to purchase a license to remove adware, or even something that might be adware. As dominic23 points out, you can just find the file in the "Security" section of your EtreCheck report and click the "Remove" button. No license purchase is required for this.

There are some operations in EtreCheck that are restricted to people who have purchased a license. Primarily, these are for safety considerations. I always advise people to stay out of hidden directories. I have seen too many cases where people go into those directories and just start deleting any file they don't recognize or understand. Before Apple added System Integrity Protection, a person could damage their operating system that way. It is still possible to damage installations of legitimate 3rd party software. Some of the "Reveal in Finder" buttons in EtreCheck will dump the user right into those hidden directories. In cases where these are Apple-provided folders for user-accessible files like plug-ins, EtreCheck will let anyone access the folder. But if the target is likely deep inside some 3rd party software bundle, I need to protect people from causing self-harm. Too often, people think they need to delete anything that they see listed in an EtreCheck report and I want to discourage that. So, some advanced features like this are restricted to more advanced users who have purchased a license.

This particular file is interesting. I would appreciate it if anyone who had saved an EtreCheck report with this file could send it to me via the "Report a Problem" feature. The "mshelper" name doesn't appear to be related to the "com.pplauncher.plist". But I have always expected malware developers to eventually start getting more clever about these things. I would really like to know where "mshelper" is installed in your system. I have an open issue in EtreCheck to show the full path for items listed only in one or more of the "top process" lists. I guess I need to finally get that implemented now.

It certainly does appear that "mshelper" is a bitcoin mining trojan. I don't doubt it is related to "com.pplauncher.plist".

Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.