SCAM ALERT : VPN Update pop-ups (Virus removal)

What is VPN Update SCAM

According to IT security professionals, VPN Update is a webpage which uses social engineering methods to make unsuspecting users believe they need to install a free VPN app from Apple Store to watch videos. Usually scammers create such web-pages with the aim of making money in one way or another. According to experienced security specialists, such scam sites are opened in the web-browser by potentially unwanted programs (PUPs), adware, or by clicking on deceptive links.

This website shows a pop-up window containing a message that in order to continue watching the video in safe mode, the visitor needs to download the free VPN app from the Apple store. This message is a scam that uses social engineering techniques to lure the users into installing unnecessary programs. Moreover, since the app offered for installation is a VPN client, after its installation, all user traffic will pass through this program, which will allow its authors to spy on the user, as well as insert ads into the sites viewed by the user. Therefore, security experts warn that it is very dangerous to install any apps recommended by scam websites, and in case of accidental installation of such programs, immediately remove it and check the device for malware.

Text presented in the VPN Update pop-up:

VPN Update
Please download the free VPN app from the Apple Store to continue watching in safe mode

As we said above, most often this scam is opened by potentially unwanted programs installed on the Mac. These programs have the ability to open scam sites, as well as collect information about the user and the infected computer. Attackers can obtain the following information: IP, geolocation, addresses of pages opened by the user, user search queries, and so on. In addition to the above, these programs can display intrusive and deceptive advertisements. When clicking on this advertisement, the user can be redirected to malicious and deceptive sites, other malware and Trojans can be installed on the computer. Most often, these malicious ads are presented in the form of coupons, pop-ups with discounts, various online surveys and offers to win a free prize.

Another variant of this scam (VPN update is recommended)

Text presented in this pop-up scam:

●●●●● 19:05

VPN update is recommended
Your browser might not display the webpage correctly.

Please install the recommended free VPN app to solve a potential problem.

Cancel Install

Another variant of this scam (VPN highly suggested for this site)

Text presented in this pop-up scam:

VPN highly suggested for this site
Your browsing, streaming and download activity may be not private and may be unsecured.

Cancel Instal

Threat Summary

Name	VPN Update
Type	phishing, scam, fake alerts
Associated domains	peachlandus.com, allbestsecureus.com, peachlandeu.com, peachlandcn.com, mybestsecurecn.com, berrigroun.com
Symptoms	browser pop-ups appear and recommend fake Jave updates you keep getting redirected to suspicious web-pages unexpected toolbars in your web-browser unexpected changes in your web-browser like using a new default search engine low ping but slow Internet CPU usage seems unusually high
Removal	VPN Update removal guide

How does Adware and PUPs get on your MAC system

Adware and PUPs gets on your MAC along with some free applications. So always read carefully the installation screens, disclaimers, ‘Terms of Use’ and ‘Software license’ appearing during the install process. Additionally pay attention for optional applications which are being installed along with the main program. Ensure that you unchecked all of them! Also, use an ad blocking application that will help to block shady and untrustworthy web sites.

How to Remove VPN Update scam (removal steps)

Not all unwanted apps such as PUPs and Adware are easily uninstallable. You might see pop ups, deals, text links, in-text advertisements, banners and other type of advertisements in the Firefox, Safari and Google Chrome and might not be able to figure out the application responsible for this activity. The reason for this is that many unwanted apps neither appear in the Finder. Therefore in order to fully remove VPN Update pop-up scam, you need to use the steps below. Certain of the steps below will require you to close this web-page. So, please read the step-by-step instructions carefully, after that bookmark it or open it on your smartphone for later reference.

To remove VPN Update pop-up scam, use the following steps:

1. Remove malicious profiles created by PUPs
2. Check the list of installed software
3. Remove adware related files and folders
4. Scan your Mac with MalwareBytes
5. Remove VPN Update pop-ups from Safari, Chrome, Firefox
6. How to stop VPN Update scam
7. Finish words

Remove malicious profiles created by PUPs

PUPs and Adware can install a malicious configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac. If there is Profiles in the list, then click on it, then select a profile related to malware.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed software

One of the first things to attempt for removal of adware software is to check your Mac computer installed programs screen and look for unwanted and dubious programs. If there are any programs you do not recognize or are no longer using, you should delete them. If that doesn’t work, then you may need to use malware removal utility such as MalwareBytes Free.

Open Finder and click “Applications”.

Very carefully look around the entire list of apps installed on the MAC OS. Most likely, one of them is a PUP responsible for the VPN Update pop-up scam. Once you’ve found a dubious, unwanted or unused program, right click to it and choose “Move to Trash”. Another method is drag the program from the Applications folder to the Trash.

Don’t forget, select Finder -> “Empty Trash”.

Remove adware related files and folders

Now you need to try to find adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, search.plist, macsearch.plist and installapp.plist. Most often, PUPs, adware software and browser hijackers create several files with similar names.

Check for PUPs generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for PUPs generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.plist, com.installapp.plist, com.machelper.plist and com.search.plist. In most cases, browser hijackers, adware and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

You can delete Adware related files automatically with a help of MalwareBytes. We recommend this free malicious software removal utility because it can easily delete potentially unwanted programs, toolbars, adware software and browser hijackers with all their components such as files, folders and system entries.

Click the following link to download MalwareBytes.

After the download is finished, close all windows on your MAC system. Further, start the saved file. Follow the prompts.

The MalwareBytes Anti-Malware (MBAM) will automatically launch and you can see its main window like the one below.

Next, click the “Scan Now” button to perform a system scan with this tool for the adware related to the VPN Update pop-up scam. This procedure can take some time, so please be patient. During the scan MalwareBytes Anti-Malware (MBAM) will scan for threats exist on your machine.

When MalwareBytes Anti Malware (MBAM) is finished scanning your machine, you’ll be shown the list of all found threats on your MAC system. Make sure to check mark the items that are unsafe and then press the “Quarantine” button.

The MalwareBytes will remove the found adware and PUPs.

Remove VPN Update pop-ups from Safari, Chrome, Firefox

If you’re still getting VPN Update scam, then you can try to remove it by uninstalling malicious addons.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Chrome menu. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove VPN Update popup scam by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with VPN Update scam removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop VPN Update scam

Use an ad blocking tool like AdGuard will protect you from harmful ads and content. Moreover, you can find that the AdGuard have an option to protect your privacy and block phishing and spam web-pages. Additionally, ad blocker apps will allow you to avoid unwanted ads and unverified links that also a good way to stay safe online.

Download AdGuard on your machine from the link below.

Once the download is done, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick guide. Click “Skip” button to close the window and use the default settings, or click “Get Started” to see an quick tutorial which will allow you get to know AdGuard better.

Each time, when you start your MAC, AdGuard will start automatically and stop unwanted popup ads, block VPN Update scam, as well as other harmful or misleading websites.

Finish words

Once you have done the instructions above, your MAC should be clean from this adware and other malware. The Google Chrome, Firefox and Safari will no longer open the VPN Update scam when you surf the World Wide Web. Unfortunately, if the guide does not help you, then you have caught a new adware software, and then the best way – ask for help.

Please create a new question by using the “Ask Question” button in the Questions and Answers. Try to give us some details about your problems, so we can try to help you more accurately. Wait for one of our trained “Security Team” or Site Administrator to provide you with knowledgeable assistance tailored to your problem with the VPN Update pop-ups.