“HPDeviceMonitoring.framework” Mac Solution

Recently we have received hundreds of malware reports  from mac users concerning a pop up message with the following text:  “HPDeviceMonitoring.framework” will damage your computer.

This is related to HP printer drivers that have been detected by MacOS as malicious. Most detections have happened to users who have just updated there MacOS Catalina 10.15.7. 

In this article we will cover solutions from Apple, HP and what you can do to bypass the message altogether. 

Expired HP Certificate

HP forums suggest that your driver certificate has expired and may lead to your Mac to notify you that the application, in this instance HPDeviceMonitoring.frame is malicious. 

HP Forum Solution 1

Update your drivers and software using HP Easy Start

1. Download HP Easy Start
   
   
2. Follow the instructions for setting up your printer.  You will be notified if your software needs to be updated.  If it does, the box next to Printer Essentials will be checked by default and you just need to select the Install button.

The following should not be necessary but if you want to be extra diligent and guarantee a clean new install.

1. 1Download HP Easy Start
2. Open HP Easy Start and Select the HP Easy Start Menu in the macOS menu bar.  In this menu select Uninstall HP Software.
3. Select Continue to start the Uninstall process
4. Once the uninstall completes.  Select Set Up New Device.
5. Go through the new device setup process by following the prompts.
6. The software will start to install
7. Follow the remaining prompts to finish the process.

Apple Forum Solution 

Apple has not given any detailed instruction on the issue, However you can find some users on mac forums have resolved HPDeviceMonitoring.frame  malware by removing launch agents and daemons with the following instructions

1. Using Finder to go to “Library/LaunchAgents” and moving the most recently added and suspicious looking file to the bin.
2. Did the same here “Library/LaunchDemons”
3. And here “~Library/LaunchAgents”
4. I also went to “Applications” and sorted by most recently added to see if anything suspicious has been added, and removed that.
5. Then I restarted my Mac and it’s fixed!

Bypass message – “HPDeviceMonitoring.framework” will damage your computer 

Apple has not officially announce that this is a false positive so we strongly advise you not to take this step unless you are sure what you are doing. For all we know MacOS may have found something malicious or exploits that can jeopardies your machine.

Bypass Solution for Mac

Instead of double clicking on the app, just right click and press Open.
You will get a notice “HPDeviceMonitoring.framework” will damage your computer, however you will still get the option to open the program 

Bypass Additional Option

1. Open Finder and find HPDeviceMonitoring.framework
2. Control-Click on the application.
3. Access the shortcut menu and click Open. After you do this, the app will be whitelisted and you will be able to open it from now on without getting the “macOS cannot verify that this app is free from malware” warning.
4. Another way to whitelist an app is to click the Open Anyway available in Security & Privacy Preferences. Note that this button would only be available for an hour after you try to open a blocked app. To reach this button, open the Apple Menu, go to System Preferences, click on Security & Privacy, and select General.

Am I safe?

This HP framework is most likely safe and free from any malware. However this can lead to exploits that are used by hackers. We recommend scanning your system for any other files that can cause trouble in the future. ComboCleaner is an anti-malware that scans and removes any hidden threats.