How to remove Wcsoft.link pop up scam (Virus removal guide)

What is Wcsoft.link?

Wcsoft.link is a misleading website designed to promote SYSTEM NOTIFICATION, VPN Update and other scams. The fraudulent scheme is as follows: the website informs the visitor that the device is in danger, infected with a virus, or is using an insecure Internet connection. To solve this fake problem, the site offers to install a program. Programs that are promoted using this fraudulent scheme cannot be trusted, as potentially unwanted apps, trojans, adware, browser hijackers, etc. are often distributed this way.

The Wcsoft.link site first displays a notification prompting the visitor to read important information about their iOs device. If the user clicks OK, a page appears that looks like a message from Apple Security. This scam message says three viruses have been found on the device, the battery is infected and damaged. The user is prompted to remove the malware, otherwise iPhone will be damaged even more. We recommend not to trust this site, ignore warnings, do not click on links and the recommended buttons. Your best bet is to try closing this website as soon as it opens on your iPhone screen. Security experts warn that it is very dangerous to install any apps recommended by scam websites, and in case of accidental installation of such programs, immediately remove it and check the device for malware.

Text presented on the site:

(1) SYSTEM NOTIFICATION
Please Read Important Notification Regarding Your iOS Device.
OK

Apple Security

(3) Viruses have been detected on your iPhone and battery has been infected and damaged.
If you do not remove this malware now, it may cause more damage to your device. How to fix this:

Step 1: Tap the button below & install the recommended virus protection tool for free from the AppStore.

Step 2: Run the app to remove all malware to repair your phone to 100%

Download and Install
Detected By Apple.

Some research has shown that users can be redirected to Wcsoft.link from suspicious advertisements or by PUPs and adware. Adware can make big problem to your device. Adware also known as ‘ad-supported’ software is a malicious program which displays ads in form of pop-up windows, coupons, promos or even fake alerts on the web-browser. Adware can seriously affect your privacy, your iPhone’s performance and security.

Adware usually is bundled within some freeware that you download off of the Net. So, think back, have you ever download and run any freeware. In order to avoid infection, you should be be proactive and carefully read the ‘Terms of use’, the ‘license agreement’ and other installation screens. Also, always try to find a review of the program on the Net. Be careful and attentive!

Threat Summary

Name	Wcsoft.link
Type	SYSTEM NOTIFICATION scam, phishing, scam, iPhone virus
Distribution methods	push notifications, scam websites, misleading ads, adware, potentially unwanted apps
Affected devices	iPhone, iPad, iOS devices, Mac computer
Symptoms	advertising pop-ups won’t go away your browser is redirected to web-pages you did not want unexpected web browser plugins or toolbars keep coming back your web browser start page has replaced without your permission fast Internet but slow browsing speeds CPU usage seems unusually high
Removal	Wcsoft.link removal guide

 

If the Wcsoft.link scam keeps popping up on the device screen and, after closing it, it appears again and again, then try the following simple steps to solve the problem: turn on pop-up blocker; turn on fraudulent website warnings; delete web browsing data. Below we will demonstrate how to do this.

Open the Apple device settings, then scroll down the list of settings to Safari, tap on it.

In the list of settings, find switches “Block Pop-ups” and “Fraudulent Website Warning”, check if they are enabled. If any of the switches are off, then it must be turned on. Having done this, scroll down the settings and tap “Advanced”.

On the Advanced settings screen, tap “Website Data”, scroll down the list of web-domains and tap “Remove All Website Data”.

How to remove adware from Mac

Not all unwanted software such as adware software that causes Wcsoft.link popup scam are easily uninstallable. You might see pop-ups, deals, text links, in-text advertisements, banners and other type of advertisements in the Mozilla Firefox, Edge, Google Chrome and Internet Explorer and might not be able to figure out the application responsible for this activity. The reason for this is that many undesired applications neither appear in the Finder. Therefore in order to completely get rid of adware, you need to follow the steps below. Read this manual carefully, bookmark it or open this page on your smartphone, because you may need to shut down your web-browser or reboot your computer.

To remove Wcsoft.link, complete the following steps:

1. Remove unwanted profiles on Mac device
2. Check the list of installed applications
3. Remove Wcsoft.link related files and folders
4. Scan your Mac with MalwareBytes
5. Remove Wcsoft.link from Safari, Chrome, Firefox
6. How to stop Wcsoft.link pop-up scam

Remove unwanted profiles on Mac device

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac computer. If there is Profiles in the list, then click on it, then select a profile related to Wcsoft.link.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed applications

One of the first things to attempt for removal of adware is to check your Mac device installed programs screen and look for unwanted and questionable programs. If there are any applications you do not recognize or are no longer using, you should delete them. If that doesn’t work, then you may need to use malware removal utility such as MalwareBytes AntiMalware (MBAM).

Open Finder and click “Applications” as displayed in the figure below.

You will see a list of software installed on your PC system. We recommend to pay maximum attention to the program you installed last. Most probably, it’s the adware software which causes the Wcsoft.link scam. If you’re in doubt, you can always check the application by doing a search for her name in Google, Yahoo or Bing.

After the program which you need to uninstall is found, simply right press on its name, and select “Move to Trash”.

Don’t forget, choose Finder, then “Empty Trash”.

Remove Adware related files and folders

Now you need to try to find Adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: Wcsoft.plist, installapp.plist, search.plist, macsearch.plist and com.machelper.plist. Most often, browser hijackers, adware and PUPs create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.Wcsoft.plist, com.macsearch.plist, com.machelper.plist, com.installapp.plist and com.search.plist. In most cases, browser hijackers, adware software and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

If you are still having problems with Adware removal or just wish to scan your Mac device occasionally for adware and other malicious software, then download MalwareBytes Free. It is free for home use, and finds and deletes various undesired software that attacks your personal computer or degrades computer performance. MalwareBytes can delete toolbars, PUPs, browser hijackers and adware as well as malware, including ransomware and trojans.

MalwareBytes AntiMalware (MBAM) can be downloaded from the following link. Save it to your Desktop so that you can access the file easily.

After the download is complete, close all applications and windows on your computer. Run the saved file. Follow the prompts.

The MalwareBytes will automatically start and you can see its main screen like below.

Now click the “Scan” button to perform a system scan with this utility for the adware that causes multiple intrusive popups. This procedure can take some time, so please be patient. While the utility is scanning, you can see how many objects and files has already scanned.

After the checking is complete, you can check all threats detected on your PC. Make sure all threats have ‘checkmark’ and click the “Quarantine” button. The MalwareBytes Free will delete adware software responsible for unwanted ads and move the selected threats to the program’s quarantine.

Remove Wcsoft.link from Safari, Chrome, Firefox

This step will show you how to get rid of harmful plugins. This can delete Wcsoft.link scam and fix some browsing issues, especially after adware infection.

Google Chrome	Mozilla Firefox
In the top right corner, click on Chrome’s main menu button, represented by three vertical dots. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of Wcsoft.link pop-up scam by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with Wcsoft.link scam removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop Wcsoft.link pop-up scam

We recommend to install an ad blocking program which can block Wcsoft.link and other malicious web-sites. The adblocker tool such as AdGuard is a application which basically removes advertising from the Internet and blocks access to malicious websites. Moreover, security experts says that using adblocker programs is necessary to stay safe when surfing the Internet.

Download AdGuard from the following link.

When the downloading process is complete, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick tutorial. Click “Skip” button to close the window and use the default settings, or click “Get Started” to see an quick guidance which will help you get to know AdGuard better.

Each time, when you start your device, AdGuard will start automatically and stop intrusive popup ads, block Wcsoft.link pop-ups, as well as other harmful or misleading web pages.

Finish words

Now your PC should be free of the Wcsoft.link pop-up scam. We suggest that you keep AdGuard (to help you stop unwanted pop up advertisements and intrusive harmful web-sites) and Zemana Anti-Malware (ZAM) (to periodically scan your device for new adware softwares and other malware). Probably you are running an older version of Java or Adobe Flash Player. This can be a security risk, so download and install the latest version right now.

If you are still having problems while trying to remove Wcsoft.link scam from the Chrome, Mozilla Firefox, Internet Explorer and Microsoft Edge, then ask for help here here.