Mhptask on Mac: what it is and how to remove it
Mhptask is a parent process of the potentially unwanted program Mac Heal Pro, which claims that it can perform software and hardware analysis, clean useless files and free up space, as well as enhance users' privacy and security. After seeing such marketing slogans, many users may be tempted to download and install the application in the hopes of improving the speed of macOS.
Facts checked October 7, 2026. Removal steps checked against Apple's current documentation and the security vendors' reports. We have not run the malware on a Mac. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your Mac is infected.
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds before you decide anything.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with Mhptask.
Do it yourself · free Remove Mhptask yourself 7 steps, about 21 minutes, no software needed.
Start the steps
Mhptask: summary
| Name | Mhptask |
|---|---|
| Type | Mac virus, scareware |
| Related software | Mac Heal Pro |
| Main functionality | The aim of the dubious application is to convince users that their systems are in deep trouble and it provides the fake solution for $14,95 |
| Installation | In most of the cases, users install Mhptask unintentionally while implementing apps from third-party sites, as the PUP is hidden within software bundles. Also, they might get tricked by fake Flash updates – a common scareware distribution tactic. However, others may get convinced that the app does wonders and download it deliberately from the official website |
| Associated risks | Installation of other PUPs through promotional offers, monetary loss due to purchasing a license for useless software, personal details disclosure to unknown parties |
| Removal | Scan the Mac with security software to find the malware and anything installed with it. Fortect for Mac scans for malware and unwanted programs. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Detection | MacOS:AMC-AZ [PUP] Not-a-virus:HEUR:AdWare.OSX.Mhp.a A Variant Of OSX/GT32SupportGeeks.G Potenti Microsoft: Misleading:Win32/Lodi Adware.MAC.Generic.12841 (B) Not-a-virus:HEUR:AdWare.OSX.Mhp.a A full list of detections can be found on Virus Total |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Symptoms | An unknown program in Installed apps |
| Evidence | 5 write-ups by security sites; details still limited |
| Program | Mhptask |
| First seen | 17 October 2019 |
| Facts checked | 7 October 2026 |
Is Mhptask a real security program?
From our report of Oct 2019 · not reviewed since
Mhptask is malicious task that is run by a scareware program Mac Heal Pro
Mhptask is a parent process of the potentially unwanted program Mac Heal Pro, which claims that it can perform software and hardware analysis, clean useless files and free up space, as well as enhance users' privacy and security. After seeing such marketing slogans, many users may be tempted to download and install the application in the hopes of improving the speed of macOS.
However, Mhptask is nothing but a scam - it aims to make users pay for the full version of the app by showing fake and exaggerated scan results. Such software is often referred to as scareware or scamware by security experts.
"Mhptask will damage your computer. You should move it to the Bin." - users may encounter this legitimate pop-up message on their Macs. As evident, this app should not be trusted, as it is set to perform potentially malicious tasks on the system. Similarly to dubious processes related to potentially unwanted programs (for example, Helpermcp, Maftask), Mhptask removal should be performed immediately in order to protect computer safety.
The Mhptask virus usually gets installed along with other applications downloaded from third-party sources, despite the infosec community discouraging users from doing so and relying on official sources like App Store. Nevertheless, some might be looking for solutions to their slow Mac issues, and stumble upon the following marketing phrase:
Who wouldn't want that? It seems like a great deal. However, Mhptask brings more harm than benefits, and many AV engines are already marking the application as potentially unwanted/malicious.
Once installed, the Mhptask app performs a full system scan, which indicates several macOS areas being of a "poor" status, misrepresenting the actual situation and deliberately misleading users into believing that their Macs are in serious trouble. Exaggerating scan results and marking them in red color (psychologically, red is associated with danger - this is another social engineering trick) is more likely to subdue victims and look for solutions immediately.
Of course, the alleged solution would be to purchase the full version of Mhptask/Mac Heal Pro, which costs $14,95 per month. However, even after victims realize that they got scammed, the subscription will not stop until they cancel it. Besides, as long as Mac Heal Pro remains on the system, it will continually spam users with pop-ups that ask to purchase the licensed version of the application.
However, once users try to remove Mhptask from their machines, they might not be able to, as the PUP may insert various persistence techniques in order to remain on the system as long as possible.
Therefore, users should follow our guide below to make sure that all components of Mhptask and Mac Heal Pro are eliminated. Additionally, we encourage users to scan Macs with after termination, as some changes done by the unwanted app may be damaging to Mac.
It is important to note that Mhptask can also sometimes cause extensive CPU or other resource usages on the device. Unlike Accountsd high CPU usage (this is a legitimate Mac process used by Mail.App), PUP-related processes can be removed as soon as the primary application is deleted, preventing resource usage.
From our report of Oct 2019 · not reviewed since
More from our earlier report on Mhptask
- Clean, Repair & Speed Up Your Mac with All-in-One Mac Utility
- ~/Library/Application Support/mhp/mhptask ~/Library/Application Support/mhp/com.techyutils.mhptask.plist ~/Library/LaunchAgents/com.techyutils.mhptask.plist
How Mhptask got on your Mac
From our report of Oct 2019 · not reviewed since
One of the biggest mistakes that Mac users make is when they resort to external sources for new applications - these are usually not verified by Apple and may cause harm to the computer.
This is especially true when downloading cracked software from torrent, and similar sites. However, even torrents are not necessary to infect your machine with such pests like fake system optimizer, which tries to trick you on every step.
Besides, its termination might be just as difficult as that of malware - legitimate apps only need to be moved to trash.
Security experts advise users to be vigilant: adware and PUP distribution for Macs is on the rise, which explains the increase of such apps like Mac Auto Fixer, Mac Tonic, Advanced Mac Cleaner, and many other useless tools that might be even harmful.
Even if you resort for third-parties for new apps, please make sure you read the installation instructions carefully, opt for Advanced/Custom settings, and decline all the offers on the way.
Additionally, be aware that many scareware apps are distributed with the help of fake Flash updates. Never trust prompts that come from your browser - either set the software to update automatically or go to the official site and download the update yourself. Best would be to uninstall Flash altogether, as most modern browsers already have the feature implemented.
How to remove Mhptask
How to remove Mhptask from a Mac
Start with the passwords and crypto, from another device: a stealer copies them in seconds.
Then clean the Mac, or erase it.
Step 1: Change passwords from another device first
If you pasted a command into Terminal or opened a downloaded file from Mhptask, assume the passwords saved in the browsers and in Keychain on this Mac are known to the attacker.
From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and work accounts, and sign out of all other sessions on each one.
Move any cryptocurrency to a new wallet created on a clean device, because a seed phrase that was stored on this Mac is compromised. Do this before cleaning the Mac: cleaning does not undo the theft.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 2: Quit what is running that you do not recognize
Open Activity Monitor (in Applications > Utilities, or search for it with Command + Space).
In the CPU or Network tab, look for a process you did not install or whose name is random, select it, click the stop button (the octagon with an X) and choose Quit or Force Quit.
Note the name first: you will look for the same name in the next steps. Malware that comes back after a restart is handled in the next two steps.
Step 3: Remove unknown login items and background items
Open System Settings > General > Login Items & Extensions. Under Open at Login and Allow in the Background, switch off or remove anything you do not recognize, especially items whose developer is shown as an unknown name or that appeared on the day you ran the command.
Then open Finder, choose Go > Go to Folder and check
~/Library/LaunchAgents,/Library/LaunchAgentsand /Library/LaunchDaemons for property list (.plist) files you did not add. Drag suspicious ones to the Bin, then restart the Mac.Step 4: Delete apps and downloads you did not intend to install
Open the Applications folder and your Downloads folder. Drag any app you did not install, and any disk image (
.dmg), installer (.pkg) or archive (.zip) that came from Mhptask or a site you do not trust, to the Bin, then empty the Bin.Also check
~/Library/Application Supportfor a folder with the same name as the app you removed.Step 5: Check the browsers for extensions and changed settings
In Safari open Settings > Extensions and General (homepage). In Chrome open
chrome://extensions, in Firefoxabout:addons.Remove any extension you did not add, and reset the homepage and search engine if they changed. Browsers hold saved passwords and cookies, which is why the password step comes first.
Step 6: If it was an infostealer, erase and reinstall macOS
Stealers copy data and often leave persistence you cannot be sure you found.
The only complete fix is to back up your personal files only (documents, photos, not apps or settings), then open System Settings > General > Transfer or Reset > Erase All Content and Settings, or use macOS Recovery to erase the disk and reinstall macOS, as Apple describes in its support articles.
Restore only your files afterwards, and install apps again from their official sources.
Step 7: Report it and watch your accounts
Report the site and the command to the authorities in your country, and tell your bank if any card was saved in a browser or in Keychain.
Over the next weeks watch your e-mail, bank and exchange accounts for sign-ins and transfers you did not make. Keep the notes you made, such as the process names and the file dates, in case a bank or the police ask for them.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Delete from macOS
To get rid of the Mhptask on Mac, please follow these steps:
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of Oct 2019 · not reviewed since
Ways to get rid of Mhptask virus
To remove Mhptask from your device, you will also have to terminate the application associated with it - Mac Heal Pro.
First, we suggest you try moving the app to Trash, just as you would do with any other applications. However, it is a well-known fact that deceptive PUPs often implement tasks that run the background or install components all over the system. In such a case, you should follow these steps:
Once the task is shut down, delete the following components to complete Mhptask removal:
After you are done, scan your machine with a reliable anti-malware software, it will most likely detect all the remaining components (if any are left) and check for other potentially unwanted software/malware.
- Click on Finder and select Applications
- Double-click on Utilities and then Activity Monitor
- Locate Mhptask and press X at the top-left of the window
Questions about Mhptask
Is Mhptask a virus?
Most programs that appear the way Mhptask did are not viruses in the strict sense. They are potentially unwanted programs:
- real software that arrives bundled with other downloads and then shows offers
- changes browser settings
- starts with Windows
Some are harmless, some are annoying and a few carry adware. What makes it worth removing is that you did not choose it.
Uninstall it from Installed apps and check the startup list and the browsers for anything added the same day. If it refuses to uninstall or returns after a restart, treat it as more serious and run a Microsoft Defender offline scan.
Mhptask will not uninstall. What can I do?
First restart the PC and try again, because the program may have been running and locked its own files. If the uninstaller is missing or fails, start Windows in Safe Mode, where most third-party programs do not start, and remove Mhptask from Installed apps there.
If it still refuses, delete its startup entry and its scheduled task, restart, and try once more. A program that actively prevents removal is behaving like malware, so finish with a Microsoft Defender offline scan. Avoid third-party uninstallers offered on search ads; several of them are unwanted programs themselves.
Should I reset my PC because of Mhptask?
Only if the signs point to deeper access. Reset when you see mhptask in the list of installed apps again after removal, when Windows Security cannot start or update, when remote access tools you did not install keep appearing, or when you simply cannot trust the PC any more.
Otherwise, the plan in this guide plus an offline scan is enough. If you do reset, choose Remove everything and Cloud download for a fresh copy of Windows, restore only documents and photos, and reinstall programs from their official sites. Change important passwords from the clean system afterwards.
I entered my card number in Mhptask. What should I do?
Call your card issuer using the number on the back of the card, report the purchase as fraud and ask for a new card. Ask them to block further charges from the same merchant. Watch your statements for small test charges, which often come before larger ones.
If you used a password on the order page or the same e-mail for the purchase, change that password and expect phishing e-mails that mention the purchase. Your bank can also tell you whether the merchant is linked to other fraud reports.
I called the number from Mhptask. What now?
End the call and do not let them reconnect. If they installed a remote-access tool, disconnect the PC from the internet and uninstall that tool from Installed apps. Change passwords for e-mail, banking and anything you typed during the call, using another device.
If you paid, contact the bank today for a chargeback. Report the number to the authorities in your country. The program behind mhptask in the list of installed apps still needs removing: follow the plan in this guide, then run a full scan in Windows Security.
Is Mhptask a real Windows warning?
No. Real Windows Security notifications appear in the notification area and in the Windows Security app, use Microsoft's design and never ask you to call a phone number or pay to fix anything. What people report is mhptask in the list of installed apps, drawn by a program that copies the look of a system message.
Open Windows Security from the Start menu to see the real status of your PC. If it shows no threats while the window keeps appearing, the window itself is the problem, and the plan in this guide removes the program that shows it.
I let a technician connect to my PC because of Mhptask. Is it safe now?
Not until you check. While connected, the caller could install other programs, create a user account or look at saved passwords. Disconnect from the internet, uninstall the remote access program and anything else installed during the call, and run a full scan and the Microsoft Defender offline scan.
From another device, change your e-mail and banking passwords and turn on two-step verification. If the caller opened your online banking, call the bank today. A reset of Windows is the safest option if you cannot tell what was done.
What is Mhptask?
Mhptask is fake security software, sometimes called a rogue antivirus or scareware. The program, Mhptask, shows invented or exaggerated problems to make you pay for a licence, and some versions send you to phone "support".
It does not protect the PC, and the threats it lists are not a reason to pay. Fake security programs usually arrive through fake virus warnings on websites, extra offers in free installers or ads for faster PCs. Uninstall it and use the free protection built into Windows instead.
Will the seller of Mhptask refund me if I ask?
Sometimes, but do not depend on it and do not let them steer the process. If you contact the seller, do it in writing and keep the replies. Never install software, share your screen or give banking details to get a refund.
The more reliable route is your card issuer or PayPal: a chargeback or dispute for a product sold with false claims. If the seller or anyone claiming to represent them calls you first about a refund, treat it as a scam and hang up.
Will Fortect remove Mhptask?
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds on your Mac before you decide anything.
For Mhptask, follow the plan on this page as well: removing a launch item or an app is done in macOS itself, and a scanner cannot undo what was typed or entered on the infected Mac, such as saved passwords that were copied.
Change your passwords from another device first, and if the page tells you to erase the Mac, a scan is not a substitute. The free scan costs nothing and the full-featured product needs a license.
Sources
- Webroot: What is Social Engineering? (read October 7, 2026)
- HackRead: Hackers using pirated software to spread new cryptomining Mac malware (read October 7, 2026)
- Dieviren: Dieviren (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)