Skip to main content

How to uninstall Global Protect VPN from Mac

This tutorial provides steps to remove GlobalProtect VPN app from Mac if its previously reported vulnerabilities are at odds with one’s security principles.

In today’s online world chock-full of privacy concerns and security issues, the use of a virtual private network (VPN) tool is an increasingly judicious route to take. If selected wisely, the software will encrypt all traffic and stop eavesdropping in its tracks. This necessity has grown significantly in light of the current healthcare-related circumstances that have coerced numerous organizations to switch to remote workforce implementation. When performing day-to-day duties from outside the office, employees need to be confident that their Internet traffic is reliably hidden from snoops, whether those are unscrupulous competitors or cybercriminals trying to hunt down much-coveted corporate secrets. GlobalProtect by Palo Alto Networks is a popular VPN client for Mac that brings a decent level of privacy to the customers’ online routine, and yet it’s not flawless. This is generally okay, given that no software is immaculate in every way. But, a number of bugs recently discovered in this solution might make some users frown.

Local privilege escalation vulnerability in older macOS versions of GlobalProtect

Before moving on with this subject, it makes sense to lay stress on the fact that the potentially impactful security loopholes in GlobalProtect VPN utility have been patched by the time of this publication. However, the software update hygiene of many individuals and companies leaves a lot to be desired. In this context, it means that the issues may continue to make themselves felt across the board simply because a good deal of users are still running known-vulnerable old versions of this product. The image above reflects the vendor’s official security advisory regarding one such weakness that applies to macOS and Linux builds of the product alike. Notice the details about the affected iterations of the GlobalProtect Agent for Mac (v5.0.4 and earlier). In plain words, from the release of v5.0.5 onward, this hasn’t been a problem. Considering that the latest version at the time of writing is 5.1.4, this concern should have become obsolete a long time ago. However, plenty of users are still exposed to last year’s vulnerability because they are stuck with a buggy build of GlobalProtect and don’t bother updating it.

In April 2020, analysts from the California-based CrowdStrike cybersecurity firm unearthed exhaustive details pertaining to the vulnerability referenced above. It’s catalogued as CVE-2019-17436. The gist of exploitation revolving around this flaw is to pull off a local privilege escalation attack on a Mac computer. Here’s some wiki knowledge that helps understand how this scheme works: the GlobalProtect macOS client includes a GUI application called PanGPA and the PanGPS executable launched automatically at system startup. The former spawns a series of .dat files in the Home directory and manages commands as well as network responses. The latter negotiates VPN connections and is responsible for configuring network equipment. When the app is running, it derives an AES encryption key from the program’s automatically generated password and uses this key to scramble the above-mentioned .dat files. An attacker can use a specially crafted command to obtain this password from the victim’s keychain. This, in turn, allows the malefactor to unveil the secret AES string and thereby to decrypt the communication between PanGPS and PanGPA components.

As previously mentioned, this privilege escalation vulnerability was addressed in one of the past updates of the GlobalProtect app. Therefore, it isn’t an issue for users who are running the latest version to safeguard their web sessions. There is an additional concern, though. As it often happens, cybercrooks may try to jump on the popularity hype train by creating malware-riddled copycat tools or by distributing malicious code surreptitiously bundled with the legitimate solution. That being said, Mac users should download and install GlobalProtect via the publisher’s official web portal only. When in doubt whether or not to keep using GlobalProtect, it’s best to err on the side of caution and remove it from a Mac computer. If it’s a must-have for telework or other purposes, there is always an option to reinstall it. The following paragraphs provide the walkthrough to get rid of this application.

Uninstall GlobalProtect client from Mac manually

The steps listed below will walk you through the removal of this application. Be sure to follow the instructions in the specified order.

  1. Open your browser and sign into the GlobalProtect portal by entering your username and password.

    Sign into GlobalProtect portal

  2. Head to the software download page and click on the “Download Mac 32/64 bit GlobalProtect agent” link.
  3. Execute the GlobalProtect installer and click Continue.
  4. Once the “Destination Select” screen appears, click Continue once again.
  5. On the subsequent screen called “Installation Type”, enable the Uninstall GlobalProtect checkbox and click Continue.

    Choose the ‘Uninstall GlobalProtect’ option

  6. The uninstall process will then trigger a prompt where you need to type in user username and password. When done, click Install Software. Don’t be confused by the wording – the tool is actually going to uninstall the VPN from your machine as long as you have picked the right option in the previous step.

    Confirm that you’d like to uninstall GlobalProtect client from Mac

  7. Wait until the uninstall agent displays a message about the removal of this product from Mac.

    GlobalProtect Mac removal completed

After GlobalProtect has been successfully removed from your Mac, make sure it’s no longer influencing your web surfing activities. If it is, go ahead and tidy up your preferred web browser to complete the procedure.

Get rid of GlobalProtect virus in web browser on Mac

To begin with, the web browser settings taken over by the GlobalProtect virus should be restored to their default values. Although this will clear most of your customizations, web surfing history, and all temporary data stored by websites, the malicious interference should be terminated likewise. The overview of the steps for completing this procedure is as follows:

  1. Remove GlobalProtect virus from Safari
    • Open the browser and go to Safari menu. Select Preferences in the drop-down list.

      Go to Preferences in Safari

    • Once the Preferences screen appears, click on the Advanced tab and enable the option saying “Show Develop menu in menu bar”.

      Advanced tab under Safari Preferences

    • Now that the Develop entry has been added to the Safari menu, expand it and click on Empty Caches.

      Empty Caches in Safari

    • Now select History in the Safari menu and click on Clear History in the drop-down list.

      Clear history in Safari

    • Safari will display a dialog asking you to specify the period of time this action will apply to. Select all history to ensure a maximum effect. Click on the Clear History button to confirm and exit.

      Select all history to clear

    • Go back to the Safari Preferences and hit the Privacy tab at the top. Find the option that says Manage Website Data and click on it.

      Manage Website Data option under Privacy tab

    • The browser will display a follow-up screen listing the websites that have stored data about your Internet activities. This dialog additionally includes a brief description of what the removal does: you may be logged out of some services and encounter other changes of website behavior after the procedure. If you’re okay with that, go ahead and click on the Remove All button.

      Confirmation dialog

    • Restart Safari
  2. Remove GlobalProtect in Google Chrome
    • Open Chrome, click the Customize and control Google Chrome (⁝) icon in the top right-hand part of the window, and select Settings in the drop-down

      Chrome Settings

    • When on the Settings pane, select Advanced
    • Scroll down to the Reset settings section.

      Reset settings in Chrome on Mac

    • Confirm the Chrome reset on a dialog that will pop up. When the procedure is completed, relaunch the browser and check it for malware activity.

      Here’s how to reset settings in Chrome on Mac

  3. Remove GlobalProtect from Mozilla Firefox
    • Open Firefox and go to Help – Troubleshooting Information (or type about:support in the URL bar and press Enter).

      Open Firefox and go to Help

      Select Troubleshooting Information

    • When on the Troubleshooting Information screen, click on the Refresh Firefox button.

      Refresh Firefox on Mac

    • Confirm the intended changes and restart Firefox.

Get rid of GlobalProtect using Combo Cleaner removal tool

The Mac maintenance and security app called Combo Cleaner is a one-stop tool that will help you remove the GlobalProtect app. This technique has substantial benefits over manual cleanup because the automatic solution will find the core files of the application deep down the system structure, which might otherwise be a challenge to locate. Furthermore, the utility gets hourly virus definition updates and can accurately spot Mac infections, even the newest ones. Here’s a walkthrough to sort out your issue using Combo Cleaner:

  1. Download Combo Cleaner installer. When done, double-click the combocleaner.dmg file and follow the prompts to install the tool onto your Mac.

    Download Combo Cleaner

    By downloading any applications recommended on this website you agree to our Terms and Conditions and Privacy Policy. The free scanner checks whether your Mac is infected. To get rid of malware, you need to purchase the Premium version of Combo Cleaner.

  2. Open the app from your Launchpad and let it run the update of malware signature database to make sure it can identify the latest threats.
  3. Click the Start Combo Scan button to check your Mac for malicious activity as well as performance issues.

    Combo Cleaner Mac scan progress

  4. Examine the scan results. If the report says “No Threats”, then you are on the right track with the manual cleaning and can safely proceed to tidy up the web browser that may continue to act up.

    Combo Cleaner scan report – no threats found

  5. In case Combo Cleaner has detected malicious code, click the Remove Selected Items button and have the utility remove viruses, PUPs (potentially unwanted programs), or junk files that don’t belong on your Mac.

    Combo Cleaner – threats found

  6. Click Uninstaller in the Combo Cleaner sidebar, select GlobalProtect, and hit the Remove Selected Items button to get rid of the application thoroughly.
  7. Once you have made doubly sure that the app is uninstalled, the browser-level cleaning might still be on your to-do list. If your preferred browser is affected, resort to the previous section of this tutorial to revert to hassle-free web surfing.
3

Was this article helpful? Please, rate this.

There are no comments yet.
Authentication required

You must log in to post a comment.

Log in