Remove Safeplex Search (Virus Removal Instructions)

Safeplex Search is an extension for Chrome and Mozilla Firefox web browsers that falls for PUP category due to various manipulations on settings

Safeplex Search is a potentially unwanted program (PUP) also dubbed as a browser hijacker. Developed by Innover Group Inc, the program is promoted as a secure search app for Google Chrome and Mozilla Firefox web browsers. It's developers boast about the app's in-built real-time threat protection that can prevent ransomware attacks^[1] and other cyber infections. However, it has been revealed that Safeplex Search redirects to affiliate sites and may show sponsored search results by manipulating web browser's settings.

Upon the installation, the Safeplex Search hijacker replaces a search engine to search.yahoo.com, sets a new start page, new tab window, and adds a related toolbar to the default web browser. Besides, the injected extension gets administrative privileges and starts managing Chrome's and Mozilla's settings to prevent easy removal. Although in general, this search provider is non-malicious, keeping it on the system will bring about an unpleasant experience, such as an increased amount of ads, inappropriate search results, and continuous redirects to safeplexsearch.com sites.

Name	Safeplex Search
Type of malware	Browser hijacker / Potentially Unwanted Program (PUP)
Developer	Innover Group Inc.
Compatibility	Windows and Mac OS. The extension is compatible with Google Chrome and Mozilla Firefox web browsers
Distribution	There are several distribution strategies used for this PUP: Official website Google Play Store Software bundles
Symptoms	The symptom of the Safeplex Search hijack is very obvious, i.e. replacement of start page and search provider, injection of related toolbars, redirects to sponsored Yahoo search, increment in ads, in-text links on random websites, inability to modify certain web browser's settings
Risks	Users may be tricked into installing other potentially unwanted programs or unconsciously disclose personal information.
Termination	You can select from manual or automatic removal of the browser hijacker. You can either use security software or check our manual removal guide below
Optimization and recovery	Browser hijackers and other PUPs are known for altering web browser's settings. However, they can also modify registries and scatter system's files. Consequently, the system may start showing errors. To prevent such a scenario, we recommend optimizing the system with Fortect Intego tool

Sometimes people describe this search provider as a Safeplex Search virus. The main reason for such reference is related to stealthy infiltration and aggressive modification of the web browser's settings. Although it has an official website and can also be downloaded from the reputable Google Play Store^[2], most of its downloads are indirect – via freeware and shareware apps.

Seeing an app for the first time and not reading its reviews on the web can hardly make people think of this extension as a Safeplex Search virus. In contrast, the extension is represented as a security tool, which provides real-time protection, indicates threats instantly, and ensures non-intrusive experience. An excerpt from the official website states as follows:

Get a report on threats detected from your toolbar, view safety badges on the search results page to avoid visiting harmful sites and get custom web search from your browser search bar.

However, the official website does have any legal document indicating which AV vendors it is cooperating with, neither does it provide details on how is it able to protect users' web browsers from ransomware and other malware attacks. It seems that these promises are bogus since browser extensions, in general, are not that powerful to decontaminate the most dangerous cyber threats. Ar best, Safeplex Search virus detection mat be able to block ads with malicious scripts.

Those who have already been tricked into installing this PUP should consider Safeplex Search removal due to privacy infringements. A close investigation of the Privacy Policy provided on the official website revealed that the extension is powerful enough to harvest the following user data:

package tracking numbers
flight information and routes
notifications
uploaded files
to-do list
map search queries
IP address
names
ISP
browser-related information, etc.

The type of information depends on the specific Extension but may include package tracking numbers, flight information and routes, downloaded wallpapers, notifications, and (on a temporary basis and in no case for more than seven days) certain files you choose to upload. Other types of information necessary to the Extension may be collected but stored only on your computer (i.e., we do not store it on our server). This latter category depends on the specific Extension but may include your astrological sign, your reminders and to-do lists, your recipe search terms and recipes, and your map search queries.

Although it is stated that the Safeplex Search hijacker collects such information for marketing purposes only, collecting and analyzing personally identifiable information is illicit and can lead to identity theft.

Besides, do not fall for believing that this doubtful extension will provide a safe web browsing experience. Its main purpose is to generate from affiliate marketing. That is why it replaces the existing search engine and search provider to sponsored Yahoo search. Upon the changes, Safeplex Search redirects to sponsored websites regularly and promotes affiliated content via ads, banners, and pop-ups.

Unfortunately, there's no way to guarantee that some of the Safeplex Search ads will not redirect to phishing websites, rogue online surveys, x-rated domains, or sites that promote PUPs and malware. Every redirect triggered by this extension poses a potential risk, so it's better to get rid of it asap.

According to NoVirus.uk^[3] experts, the best option for Safeplex Search removal is a professional security tool. This potentially unwanted program can infiltrate PCs via freeware and actively promote other PUPs, meaning that your PC may be highly obfuscated. A full scan with SpyHunter Combo Cleaner, Malwarebytes Malwarebytes, or similar tools would help. Besides, do not underestimate the need to optimize the system after the malware attack. To fix corrupted system files and processes, run a scan with Fortect Intego after you remove Safeplex Search virus.

Browser hijackers use tricks to get user's permission to modify browser's settings

Browser hijackers fall for Potentially Unwanted Programs (PUP) category due to misleading distribution strategy known as bundling. In other words, they are often disseminated as pre-selected parts of freeware installers. The user's option of the express installation stands for permission to install the entire bundle.

Such distribution lacks the user's choice since he or she is not explicitly informed of what software is going to be installed, how it behaves, what are its intentions, and capabilities. In any case, if the software limits the user's choice and exhibits rather aggressive changes on the web browser and the system, it has no right to stay on the system.

As for this particular web browser, it spreads in several ways:

Users may be redirected to the official website after clicking on ads provided by the adware-program. The website contains all the necessary information and direct download links. There's nothing suspicious.
It is promoted on the Google Play Store. However, it's very difficult to detect the extension there, thus it's very likely that people get redirected to the store with the help of adware.
The last and most successful distribution method of this hijacker is dubbed bundling. It may spread in the disguise of freeware and share installers as an optional component. However, the term “optional” is not appropriate here because the additional extension is typically pre-checked and hidden under the Express installation setup. This way, it gets installed without the user even noticing it.

A full guide on Safeplex Search malware removal

No matter how intrusive this browser hijacker can be, Safeplex Search removal is not a big problem. To assist our visitors, we have submitted a comprehensive elimination tutorial that you can find down below. Make sure to follow each step and the PUP should successfully be removed.

Alternatively, it's advisable to remove Safeplex Search virus using a professional AV program. This way, you will ensure a full system's protection and PUP elimination. Our recommended programs are SpyHunter Combo Cleaner and Malwarebytes Malwarebytes, though you can use any preferred security tool.

Once you remove Safeplex Search related PUP from the system, it's important to disable the extension on Google Chrome or Mozilla Firefox browser depending on which it settled down. Finally, scan with system with Fortect Intego or similar optimization tool fo repair any damage that malware has done to the system.

Uninstall from Windows

Uninstall from Windows 10/8:

Type Control Panel into the Windows search box and open the result.
Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:

Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:

In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS

Remove the unwanted application:

From the menu bar, select Go > Applications.
In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:

Select Go > Go to Folder.
Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
Finally, empty the Trash to permanently remove the leftovers.

Reset Internet Explorer

Remove dangerous add-ons:

Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
Pick Manage Add-ons.
You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.

Change your homepage if it was altered:

Open IE and click on the Gear icon.
Select Internet Options.
In the General tab, delete the Home page address and replace it by your preferred one (for example, Google.com).
Click Apply and then select OK.

Delete temporary files:

Press on the Gear icon and select Internet Options.
Under Browsing history, click Delete...
Select relevant fields and press Delete.

Reset Internet Explorer:

Click on Gear icon > Internet options and select Advanced tab.
Select Reset.
In the new window, check Delete personal settings and select Reset.

Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
From the list, pick the extension and click on the Gear icon.
Click Remove.

Clear cookies and other browser data:

Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
Under Clear browsing data, pick Choose what to clear.
Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:

Click the menu icon and choose Settings.
Then find On startup section.
Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

Press on Ctrl + Shift + Esc to open Task Manager.
Click on More details arrow at the bottom of the window.
Select Details tab.
Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

Open Edge and click select Settings > Extensions.
Delete unwanted extensions by clicking Remove.

Clear cache and site data:

Click on Menu and go to Settings.
Select Privacy, search and services.
Under Clear browsing data, pick Choose what to clear.
Under Time range, pick All time.
Select Clear now.

Reset Chromium-based MS Edge:

Click on Menu and select Settings.
On the left side, pick Reset settings.
Select Restore settings to their default values.
Confirm with Reset.
This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
Select Add-ons.
In here, select the unwanted extension and click Remove.

Reset the homepage:

Click three horizontal lines at the top right corner to open the menu.
Choose Settings.
Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

Click Menu and pick Settings.
Go to Privacy & Security section.
Scroll down to locate Cookies and Site Data.
Click on Clear Data...
Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

Open Mozilla Firefox browser and click the Menu.
Go to Help and then choose Troubleshooting Information.
Under Give Firefox a tune up section, click on Refresh Firefox...
Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:

Click on Menu and pick Settings.
Under Privacy and security, select Clear browsing data.
Select Browsing history, Cookies and other site data, as well as Cached images and files.
Click Clear data.

Change your homepage:

Click menu and choose Settings.
Look for a suspicious site in the On startup section.
Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

Click on Menu and select Settings.
In the Settings, scroll down and click Advanced.
Scroll down and locate Reset and clean up section.
Now click Restore settings to their original defaults.
Confirm with Reset settings.

Delete from Safari

Remove dangerous extensions:

Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:

Click Safari in the menu and pick Clear History.
Set Clear to all history and confirm with Clear History.

Reset Safari:

Click Safari in the menu and select Preferences > Advanced.
Enable Show Develop menu in menu bar.
From the menu bar, click Develop and select Empty Caches.

How to remove Safeplex Search

Safeplex Search is an extension for Chrome and Mozilla Firefox web browsers that falls for PUP category due to various manipulations on settings

Browser hijackers use tricks to get user's permission to modify browser's settings