Apple Security Alert: “HP Utility” or “HPDeviceMonitoring.framework” will damage your computer [SOLVED]

Problem Description

I recently began receiving reports of a security alert on Apple computers that states:

“HPDeviceMonitoring.framework” will damage your computer. This file was downloaded on an unknown date. [] Report malware to Apple to protect other users

In some instances, “HP Utility” will be in quotes in the alert message. There is a check-box next to the Report to Apple option. This is an alarming and disconcerting message for most users to see. When you click on the OK button, the message goes away and then shows up again immediately. Below is a workaround.

Problem Solution Options

OPTION #1 – HP Uninstaller. You may have an HP folder in your Applications folder. Inside of that HP folder there may be an HP Uninstaller option. If you use this, it will remove all of your printers. If you have many printers configured, then using this option will require that those be setup again, including non-HP printers. In our tests, running the HP Uninstaller software did not resolve the problem, but it may have worked toward a solution. Further instructions can be found on the HP software uninstallation support page where there are manual steps are provided in addition to running the uninstaller. [HP Easy Start]

OPTION #2 – HP Easy Start Uninstaller. If you download and install HP Easy Start, you will find under the Easy Start menu there is an option to “Uninstall HP Software.” [HP Easy Start] This seems to work well for many people. Once the software is removed, then use HP Smart to setup your printer. [HP Smart]

OPTION #3 – Cleanup Utility. Programs like CleanMyMac are able to remove programs with their related files. This can be helpful for difficult to remove programs. If you choose this option, be sure to only download that software from the developer’s website MacPaw.com/cleanmymac. Note that this is not a paid or affiliate link.

If you are still having trouble, feel free to post a comment describing your situation in the comments below. A temporary workaround is below.

Temporary Workaround

If you don’t want to do anything about the problem yet and perhaps are hoping Apple or HP will address the solution, the best workaround presently is to move the message window/box to an area of the screen where it doesn’t get in the way. It is persistent across desktops so you can’t hide it on a desktop. It is possible to drag the alert message mostly off the screen with a corner still showing so you can still drag it into view if needed.

Document Purpose

As a tech consultant supporting hundreds of individuals and businesses, I’m fairly quickly made aware of wide-spread problems that impact multiple people because I get inundated with emails, phone calls, and text messages from people all experiencing the same problem. This page describes a recent problem impacting many people around the world.

For an individual experiencing a problem, they don’t know if it’s unique to their computer, or if it is impacting multiple people. Often, support documents are not available in the initial days of a wide-spread issue. So, people spend many hours with trial-and-error diagnostics, sometimes creating more problems than solutions.

The main purpose of this document is to let people know:

• This is a known issue.
• There is no threat posed by HP software.
• You need not try to do something with your computer to prevent this issue.
• In our tests, printing still worked despite the error.

Additional news about this issue will be posted as it becomes available.

Further Reading

Here are some additional resources. Beware of Google search results describing this as a malware or virus and offering instructions for removal.

• Apple Discussion Forums (23 Oct 2020). Excerpt: “It’s still uncertain exactly what is causing the problem, but please don’t go ripping things out of your systems willy-nilly! Do not remove launch agents or daemons if you don’t know what they are, as that can break legitimate software. If you’re affected, search for information on how to properly uninstall the software in question. For example, for HP software, look for an HP-provided uninstaller, or contact HP support for assistance with removing it. Be sure to use resources only on the HP website, such as support.hp.com, to avoid getting scammed. (Googling for “HP support” is likely to connect you with a scammer.) The same goes for Amazon, etc.” [More…]
• Apple Insider (23 Oct 2020) Excerpt: “Some Mac users being warned that Amazon Music app and HP drivers are malware.” Excerpt: “Some users are reporting that they can no longer print to HP printers, or can’t continue playing Amazon Music through the dedicated app, because of a macOS error that claims the software is malware. AppleInsider has been contacted by users reporting that their Macs are suddenly claiming their HP printers contain malware and “will damage your computer.” Separately, other users are reporting the same issue, but to do with the Amazon Music app.” [More…]
• Malwarebytes (29 Oct 2020). Excerpt: “Apple was able to reinstate the revoked certificate, which fixed the problem for some people, but not everyone. We’re still seeing new cases reported days later.” [More…]
• The Register (23 Oct 2020) Excerpt: “The Register understands from sources familiar with the matter that HP Inc asked Apple to revoke its printer driver code-signing certificates. It appears this request backfired as it left users unable to print. A HP Inc spokesperson told us on Friday night: ‘We unintentionally revoked credentials on some older versions of Mac drivers. This caused a temporary disruption for those customers and we are working with Apple to restore the drivers. In the meantime, we recommend users experiencing this problem to uninstall the HP driver and use the native AirPrint driver to print to their printer.'” [More…]

Global Impact

The map below shows recent visitors to this page. This suggests the problem is impacting people around the world.

Best Practices

Apparently some change to Apple MacOS, HP Software, or both has caused this problem. Those involved should have tested for problems like this prior to rolling changes out to millions of users. The flaw in Apple’s malware detection that produces these false positives should be correctable remotely for this and any future issues. Otherwise, the disruption and negative impact will propagate over several days rather than just a few hours.

Collateral Damage

Whenever a problem like this surfaces, people run to the Internet for answers. Opportunists see this as an opportunity to infect computers with malware or sell fake support services. Below is one of the Google results that shows up when searching on a solution to this problem. The title is misleading because it suggests the software is a virus that needs to be removed. Some people will follow such advice and cause further harm to their computer, causing an even greater negative impact. This is why such problems need to be resolved by Apple and HP as quickly as possible.

Avoid Fake Solutions

For this and other computer issues, you will want to avoid fake solutions which are often attempts to cause other problems on your computer or take your money.

Document History

• 24 Oct 2020 at 7:50 PM – Document created.
• 26 Oct 2020 at 9:58 AM – Updated to include some additional problem resolution instructions.
• 29 Oct 2020 at 5:33 PM – Updated to includes links to The Register and the Malwarebytes blog articles on this topic.p