PlusSpecial Adware - How to remove

PlusSpecial causes strange system pop-ups, fills the browser with ads, redirects searches, and causes a bunch of other issues with the browser. It spies on its victims and delivers low-quality ads. Thus, in the long run, PlusSpecial causes more serious problems than pop-up ads. Removing PlusSpecial is more complicated than deleting a single app – various files and system settings are all part of the hijacking scheme. Luckily, you can definitely get PlusSpecial off your Mac for good with a little bit of effort.

Details on PlusSpecial:

Classification	Trojan, adware.
How PlusSpecial gets installed	Bunded with free apps, advertised by fake Adobe sites.
Issues and problems	PlusSpecial fills the browser with ads, steals private information, forces unwanted search settings in the browser.
How to remove PlusSpecial	Find and delete malicious files (Combo Cleaner, Malwarebytes, etc.), repair system settings and remove unwanted browser extensions.

How PlusSpecial works

Unwanted installation

PlusSpecial gets installed on a Mac without its owner knowing about it. One of the most common ways that it happens is through malicious pop-ups and ads online. Crooks impersonate Adobe or Apple by creating a website that looks similar to the official one. The fake site shows a message saying about an update needing to be installed. Downloading the file from one of these fake sites and running it then installs PlusSpecial and a bunch of other adware.

The file that was carrying PlusSpecial may or may not have had the real software update. It really doesn’t matter. Any malicious actor can take the official Flash Player installer, wrap it in a bunch of adware, and then upload it on their own fake site.

It is also possible that PlusSpecial was bundled with an app. Some apps, especially ones that are hosted on disreputable websites, come bundled with adware and other junkware. You think you’re installing one app, but five others get installed at the same time.

Fake system pop-ups

Apple secures macOS with security and privacy restrictions and with Gatekeeper. Trojans get around Gatekeeper and then download adware and other dangerous apps.

Once the trojan is downloaded and run, the Mac may show bizarre pop-ups – big, mostly blank windows that say things like “Installation Complete”, “Safari is up to date”, and similar messages that only ask the user to click their “OK” buttons. PlusSpecial uses these to overlay system warnings about installing the PlusSpecial extension on the browser. To restrict the user’s actions, PlusSpecial causes the mouse cursor to be locked inside the window. Thus, PlusSpecial is able to get inside a Mac unnoticed.

The harm caused by PlusSpecial

Once PlusSpecial is installed, it gets access to the browser and takes advantage of it:

• PlusSpecial changes the browser’s new tab page and search settings. This usually causes Yahoo, Trovi, and other sites to deliver internet search results.
• Besides the searches being messed up, pop-up ads, new tabs with promo content, and other aggressive ads are injected into websites by the PlusSpecial browser extension.
• Passwords, usernames, and other sensitive data can be logged by PlusSpecial and sent to cybercriminals to use in later attacks or to be sold.

Some (probably) unintentional troubles caused by PlusSpecial include:

• Online apps, such as the Email app, locking up or crashing.
• Internet just not being accessible sometimes.
• Certain websites, especially Apple’s iCloud, iTunes, and others not loading.
• Safari opening and crashing by itself.

Deleting PlusSpecial only works up until the next reboot when this annoying adware app returns by itself.

Malicious entries in System Preferences -> Profiles make sure that the browser settings can’t be fixed. (Profiles are used to enforce settings on a Mac.) System Preferences -> Network -> Advanced -> Proxies may have some unusual settings, such as the “SOCKS” option ticked – because PlusSpecial needs to redirect the victim’s traffic through a malicious server. And PlusSpecial’s browser extension can read and change data on all the opened websites, giving it incredible power to make any changes to the ads and read all the private data it can. This data can later be used to perform targeted phishing attacks.

Thus, despite being just adware, PlusSpecial is quite dangerous to both the user experience (making web browsing really frustrating) and to the user’s privacy and security.

How to remove PlusSpecial

The fastest way to find and delete PlusSpecial is with the help of an anti-malware app, such as Combo Cleaner, Malwarebytes, or others. That’s because, to truly delete PlusSpecial once and for all, one needs to find the files that it hid on the infected Mac and delete them. In addition, PlusSpecial is likely to be only one of a few infections, and those other malicious files need to be deleted, too.

You may be asked to reboot your Mac in Safe Mode. This mode stops unnecessary apps from running and it helps when removing malware.

You might need to open the folders ~/Library/LaunchAgents, /Library/LaunchDaemons, ~/Library/Application Support, and /Library/Application Support and find PlusSpecial’s files in these folders. The files may be named com.PlusSpecial.plist, com.PlusSpecialDaemon.plist, and similar names. They should be deleted.

Likely, some other files need to be removed, as well. Anti-malware apps should help you find them. And you yourself might need to fix a few things:

• Malicious entries in System Preferences -> Profiles need to be removed.
• PlusSpecial in Finder -> Applications needs to be deleted.
• Files that carried PlusSpecial to your Mac need to be removed from Downloads.
• All suspicious browser extensions need to be removed.

Watch out for other malware that’s very similar to PlusSpecial, such as PublicAdviseSearch, PathBrand, InetWebSearch, UtilityData, etc.

Finally, consider setting new passwords. If you suspect that PlusSpecial might have stolen any (because they were saved in your browser), then it is very important to at least have 2-step verification on for those accounts so that you’re always warned about suspicious login attempts.

Automatic Malware removal tools

Restore browser settings

How to remove PlusSpecial Adware from Safari:Top

Remove malicious extensions

• Click on Safari menu on the top left corner of the screen. Select Preferences.
  
• Select Extensions and uninstall PlusSpecial Adware and other suspicious extensions.
  
• If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
  

(Optional) Reset your browser’s settings(older versions) If you are still experiencing any issues related to PlusSpecial Adware, reset the settings of your browser to its default settings.

• Click on Safari menu on the top left corner of the screen. Select Reset Safari…
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopHow to remove PlusSpecial Adware from Google Chrome on Mac:

• Open Chrome browser.
• Enter in the url field “chrome://extensions” address and hit Enter.
• Find PlusSpecial Adware on the extensions list and click on the recycle bin icon next to it.
• Click on 'Chrome' button at the top left corner. Select 'Preferences' on a drop-down menu box.
• Find 'Search' options on Settings tab. If your search engine is changed, click 'Manage Search Engines' and set your preferred search engine.
• On the same page find 'Show home button' checkbox and change your homepage.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to PlusSpecial Adware, reset the settings of your browser to its default settings.

• On the 'Preferences' menu window, scroll down to the bottom and find 'Reset settings' button. Click it.
• Confirm your selection and click 'Reset' on the following window.

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program. Top

How To remove PlusSpecial Adware from Firefox on Mac OS:

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press cmd+Shift+A on your keyboard).
• Go through Extensions list, remove everything PlusSpecial Adware related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
• Enter “about:preferences” in URL bar and hit enter.
• Open Search settings tab.
• If your search engine is changed, click 'Default Search Engines' and set your preferred search engine.
• If your homepage was changed, click on the Firefox menu in the top right corner, select Preferences-> General. Enter a preferable URL to the home page field.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to PlusSpecial Adware, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
• Choose Troubleshooting Information on the Help menu.
• Click on the Refresh Firefox button.
• Click on the Refresh Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.

If the problem persists, scan your system with an anti-malware program to identify malicious entries.