How to remove Protectconnection.icu pop-up scam (Virus removal guide)

What is Protectconnection.icu?

Protectconnection.icu is one of the sites promoting the (3) Viruses have been detected on your iPhone scam. It claims that the visitor’s phone has been infected with viruses and recommends installing a “virus protection tool” to remove the supposedly existing viruses.

It is important to emphasize that there are no websites capable of detecting that an iPhone has been infected, therefore sites making such claims are always scams. The purpose of this scam is to trick users into installing untrustworthy apps.

Protectconnection.icu pop-ups are a SCAM

Protectconnection.icu is posing as a legitimate Apple Security site. Initially, it displays a fake alert prompting users to read the notification about their iOs device. Clicking on the OK button closes this notification and opens a message that says that 3 viruses have been detected on the iPhone. The message states that if the detected viruses is not removed, it may damage the device. The scam prompts users to click the “Download and Install” button to download and install the recommended virus protection tool to completely remove viruses and repair iPhone.

Text presented in the scam pop-ups:

(1) SYSTEM NOTIFICATION
Please Read Important Notification Regarding Your iOS Device
OK

Apple Security

(3) Viruses has been detected on your iPhone and battery has been infected and damaged.
If you do not remove this malware now, it may cause more damage to your device. How to fix this:

Step 1: Tap the button below & install the recommended virus protection tool for free from the AppStore.
Step 2: Run the app to remove all malware to repair your phone to 100%

Download and Install
Detected By Apple.

The scam can promote legitimate software, but is more often used to distribute potentially unwanted applications (PUAs). Although these apps look harmless, they often have malicious capabilities. Such applications can forcibly redirect users to deceptive sites, promise fake features that they really do not have (for example, remove viruses, block ads), display unwanted ads, change browser settings to promote fake search engines, collect user personal data (including logins and passwords, browser history) and so on.

To summarize, the Protectconnection.icu site cannot be trusted! The scam can lead to malware infection, loss of data, financial losses, theft of personal information and other serious problems.

How to protect against the Protectconnection.icu scam

To avoid becoming a victim of scammers, it is important to always keep in mind:

There are no sites that can detect viruses and other security threats.
Never install software promoted by scam sites, as it can be useless, and besides, it can be dangerous for you and your device.
Close the Protectconnection.icu site as soon as it appears on your device screen. Scammers can prevent you from closing it in various ways. In such cases, close your browser using the App Switcher (Open the App Switcher, Tap and hold on the web-browser until the red circles with a minus sign appears. Tap the minus sign on it to Force Quit the web-browser). If the next time you launch the browser, it prompts you to restore the previous session, abandon it, otherwise this scam will reopen on your screen.

Threat Summary

Name	Protectconnection.icu
Type	scam, phishing, fake alerts
Fake claims	(3) Viruses has been detected on your iPhone, battery has been infected and damaged
Symptoms	advertising banners appear in places they shouldn’t be you keep getting redirected to unfamiliar websites unexpected apps installed without your knowledge your web-browser start page or search engine keeps changing or is not set to Google anymor
Removal	Protectconnection.icu removal guide

Protectconnection.icu isn’t the only one on the Internet that aims to trick victims into installing untrustworthy software. We have already reported on other sites, some of the most recent: Socerapp.xyz, Systemupdati.xyz, Betterex.xyz. None of these websites can be trusted, you should not download any apps recommended by these sites.

Usually, victims end up on Protectconnection.icu and similar scams by going to a misspelled URL or clicking on a fake link. In addition, they can be redirected to this scam by malicious advertisements (malvertising) and Adware.

Adware is considered a potentially security threat because it often installed without the knowledge of the user. Adware’s basic purpose is to display ads. These ads are often displayed as advertising banners, pop-ups or push notifications. Clicks on the ads produce a monetary payoff for the adware makers. Adware can work like Spyware, since it sends user information such as searches and trends to advertisers.

Adware spreads along with various freeware. This means that you need to be very careful when installing free and paid applications downloaded from the Internet, even from Apple AppStore. Be sure to read the Terms of Use and the Software license, select only the Manual, Advanced or Custom setup option, switch off all unwanted web browser add-ons and applications are offered to install.

If the Protectconnection.icu scam keeps popping up on the device screen and, after closing it, it appears again and again, then try the following simple steps to solve the problem: turn on pop-up blocker; turn on fraudulent website warnings; delete web browsing data. Below we will demonstrate how to do this.

Open the Apple device settings, then scroll down the list of settings to Safari, tap on it.

In the list of settings, find switches “Block Pop-ups” and “Fraudulent Website Warning”, check if they are enabled. If any of the switches are off, then it must be turned on. Having done this, scroll down the settings and tap “Advanced”.

On the Advanced settings screen, tap “Website Data”, scroll down the list of web-domains and tap “Remove All Website Data”.

How to remove Protectconnection.icu pop-ups from Mac (Adware removal guide)

If you have constant pop ups or unwanted advertisements, slow MAC, crashing MAC issues, you are in need of adware software removal assistance. The instructions below will guide you forward to get Protectconnection.icu pop-ups removed and will allow you get your MAC operating at peak capacity again.

To remove Protectconnection.icu, complete the steps below:

Remove profiles created by Protectconnection.icu
Delete Protectconnection.icu associated software by using the Finder
Remove Protectconnection.icu related files and folders
Scan your Mac with MalwareBytes
Remove Protectconnection.icu from Safari, Chrome, Firefox
How to stop Protectconnection.icu pop-ups

Remove profiles created by Protectconnection.icu

Adware can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to Protectconnection.icu.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac device, which is normal.

Delete Protectconnection.icu associated software by using the Finder

It is of primary importance to identify and remove browser hijackers, potentially unwanted programs and adware software through ‘Applications’ section of your Finder.

Make sure you have closed all web-browsers and other software. Next, uninstall any unwanted and suspicious software from machine using the Finder.

Open Finder and click “Applications”.

Look around the entire list of apps installed on your MAC system. Most probably, one of them is the adware responsible for Protectconnection.icu pop-ups. Choose the dubious application or the application that name is not familiar to you and delete it.

Drag the suspicious program from the Applications folder to the Trash.

Most important, don’t forget, choose Finder -> Empty Trash.

Remove Protectconnection.icu related files and folders

Now you need to try to find Protectconnection.icu related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: , macsearch.plist, search.plist, installapp.plist and com.machelper.plist. Most often, adware, browser hijackers and PUPs create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.search.plist, com.installapp.plist, com.machelper.plist and com.macsearch.plist. In most cases, adware, PUPs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes to scan the Mac for PUPs, browser hijackers and adware. This free utility is an advanced malware removal program created by (c) Malwarebytes lab. This program uses the world’s most popular anti-malware technology. It’s able to help you get rid of malware and other security threats from your Mac computer for free.

Installing the MalwareBytes Anti-Malware is simple. First you’ll need to download MalwareBytes Anti-Malware from the following link. Save it on your MS Windows desktop.

Malwarebytes Anti-malware (Mac)
20841 downloads
Author: Malwarebytes
Category: Security tools
Update: September 10, 2020
When the download is done, close all apps and windows on your machine. Open a directory in which you saved it. Run the downloaded file and follow the prompts.
Click the “Scan” button to perform a system scan for the adware that causes multiple unwanted pop ups. This procedure can take quite a while, so please be patient. When a threat is found, the number of the security threats will change accordingly.
After that process is done, MalwareBytes Anti-Malware will produce a list of unwanted applications and adware software. Once you’ve selected what you wish to delete from your MAC system press “Quarantine”.

Remove Protectconnection.icu from Safari, Chrome, Firefox

If you’re still getting Protectconnection.icu pop ups, then you can try to remove it by uninstalling malicious addons.

Google Chrome	Mozilla Firefox
In the top right corner, click on Google Chrome’s main menu button, represented by three vertical dots. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of Protectconnection.icu popup scam by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with Protectconnection.icu scam removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

Google Chrome

Mozilla Firefox

In the top right corner, click on Google Chrome’s main menu button, represented by three vertical dots.
In the menu go to ‘More tools’, then ‘Extensions’.
Click ‘Remove’ to uninstall an extension.
Click ‘Remove’ in the dialog box.

You can also try to get rid of Protectconnection.icu popup scam by reset Google Chrome settings.

Click on ‘menu’ button and select ‘Add-ons’.
Go to ‘Extensions’ tab.
To uninstall an add-on, click on ‘Remove’ button next to it.

If you are still experiencing issues with Protectconnection.icu scam removal, you need to reset Mozilla Firefox browser.

Safari

On the top menu select ‘Safari’, then ‘Preferences’.
Select ‘Extensions’ tab.
Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop Protectconnection.icu pop-ups

Run an ad blocker utility such as AdGuard will protect you from harmful advertisements and scam content. Moreover, you can find that the AdGuard have an option to protect your privacy and block phishing and spam web sites. Additionally, ad blocker apps will help you to avoid annoying popup advertisements and unverified links that also a good way to stay safe online.

Visit the page linked below to download the latest version of AdGuard for Microsoft Windows. Save it on your Desktop.

Once the downloading process is complete, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you run your MAC, AdGuard will run automatically and stop annoying pop-up advertisements, block Protectconnection.icu, as well as other malicious or scam web pages.

To sum up

Once you have removed the adware software using the guide, Safari, Google Chrome and Firefox will no longer redirect you to various scam webpages similar to Protectconnection.icu. Unfortunately, if the steps does not help you, then you have caught a new adware, and then the best way – ask for help here.