How to Remove Special Search Option (SSOption): Malwarebytes Cleanup Guide

Special Search Option—also called SSOption or SpecialSearchOffer—is a historical potentially unwanted program (PUP) associated with adware and browser-hijacking behavior. Run a current Malwarebytes scan, use AdwCleaner if redirects remain, remove unknown extensions and installed programs, then verify your browser settings after a restart. Do not treat every Yahoo result or unfamiliar file as proof of this specific infection.

What Special Search Option is

Malwarebytes’ historical sample classified Special Search Option as a PUP, adware and browser hijacker. It could display advertisements unrelated to the websites being viewed, change the homepage, new-tab page and search provider, install browser extensions, and redirect searches through Yahoo-powered or related infrastructure. The documented sample arrived as a bundled installer component rather than as a normal browser feature.

#	Preview	Product	Price
1		Website Malware Removal and Prevention Guide	$12.10	Buy on Amazon
2		A Simple Guide to Virus Removal | Malware-Trojans-Spyware (Updated Nov30 2011)	$0.99	Buy on Amazon
3		Simple and Effective Malware Removal Guide	$2.99	Buy on Amazon
4		Remove Malware, Spyware and Viruses From Your PC: Guide to increase your computer's security and...	$7.99	Buy on Amazon
5		Wipe It Clean: The No-BS Guide to Removing Viruses, Malware & System Threats	$14.99	Buy on Amazon

Names that may refer to the same campaign or related detections include Special Search Option, SSOption, SpecialSearchOffer, Adware.SpecialSearchOffer.Generic, PUP.Optional.WinYahoo and SearchProvide. Detection names vary by security product and definition database; they should not automatically be interpreted as separate infections. The historical guide associated the sample with both Adware.SpecialSearchOffer.Generic and PUP.Optional.WinYahoo. Historical removal evidence

The original report dates from January 2019 and used Windows 7 and Malwarebytes 3.6.1.2711. Its file names and screenshots are useful identification clues, but its interface labels are not current Malwarebytes instructions.

#1 Best Overall

Website Malware Removal and Prevention Guide

$12.10

Buy on Amazon

Signs your computer may be affected

• The homepage, new-tab page or default search engine changed without permission.
• Searches redirect through unfamiliar domains or unexpected Yahoo-powered URLs.
• Pop-ups or injected advertisements appear on sites that normally do not show them.
• An extension named SpecialSearchOffer or a similar unfamiliar name appears.
• An installed program named SSOption, Special Search Option or ThetaSoft is present.
• A service or executable associated with ThetaSoftQZO appears.
• Malwarebytes reports Adware.SpecialSearchOffer.Generic or PUP.Optional.WinYahoo.

A Yahoo result by itself is not evidence of infection: Yahoo can be a legitimate chosen provider. Unauthorized changes combined with an unknown extension, program, service or matching detection are more meaningful.

Before you remove it

1. Stop entering passwords or financial information into redirected or unfamiliar pages. If you entered credentials, change them from a known-clean device and enable multifactor authentication where possible.
2. Close suspicious tabs and save open work. Cleanup tools may restart Windows.
3. Download Malwarebytes and AdwCleaner only from their official pages.
4. Do not manually delete registry keys, services or program folders as a first step. Preserve logs and make a backup before advanced changes.

The historical sample was reported as arriving through a bundler. That means it was packaged with another installer and could be accepted accidentally when a user used default options instead of reviewing Custom or Advanced setup screens. This explains the documented sample; it does not prove that every later case used the same distributor.

Removal method 1: run current Malwarebytes

Use the current Malwarebytes for Windows application rather than copying labels from the 2019 guide.

Rank #2

A Simple Guide to Virus Removal | Malware-Trojans-Spyware (Updated Nov30 2011)

$0.99

Buy on Amazon

1. Download Malwarebytes from the official Malwarebytes page and install it.
2. Allow the application and detection database to update.
3. Start the available malware or threat scan in the current interface.
4. Review the results and quarantine detected PUPs, adware and associated artifacts.
5. Accept the restart prompt, then sign in again and review the scan report.

The historical scan quarantined a ThetaSoftQZO.exe process, its Windows service, Chrome extension data, a Firefox extension and search-plugin data, Internet Explorer SearchScopes and preference entries, and an installer named SPECIALSEARCHOPTION.EXE. Current detection names and interface controls may differ.

Removal method 2: use AdwCleaner for browser hijacking

Malwarebytes AdwCleaner is a free utility designed for adware, PUPs, browser hijackers and unwanted preinstalled software.

1. Download and install AdwCleaner using Malwarebytes’ official instructions.
2. Open AdwCleaner and click Scan Now.
3. Review detected items and select the PUPs or adware you want quarantined.
4. Click Next, then choose Quarantine where offered.
5. Save and close documents when prompted; a restart may be required.
6. After signing in, review the cleanup log and run another scan if symptoms remain.

Do not use Run Basic Repair unless a qualified support agent directs you. AdwCleaner’s repair controls and quarantine behavior are documented in its application overview and quarantine guidance.

Rank #3

Simple and Effective Malware Removal Guide

$2.99

Buy on Amazon

Current requirements list Windows 10, Windows 11 and Windows 8.1. Windows XP, Vista, 7 and 8 are no longer supported: AdwCleaner system requirements. On an unsupported system, upgrade where possible or use security software that explicitly supports that Windows version.

Clean each browser

Chrome and Chromium browsers

1. Open the browser’s Extensions page and remove extensions you do not recognize or no longer need.
2. Check the homepage, startup and new-tab settings.
3. Set the default search engine to the provider you chose.
4. If an extension or search setting is locked, inspect browser policies instead of deleting profile files manually.

The historical guide recorded Chrome extension ID mpicjgpamgcnpiacdciefbgahmkhhogc. Treat it as a historical indicator, not a universal identifier for current variants.

Firefox

1. Open Add-ons and Themes and remove unknown extensions.
2. Check homepage, new-tab and search settings.
3. Restart Firefox and confirm the settings stay unchanged.
4. If they return, inspect the affected profile and synchronization settings.

Historical artifacts included specialsearchoffer-1.1.1-an+fx.xpi and a search-plugin file named Yahoo power search.xml. These names alone do not prove an active infection today.

Rank #4

Remove Malware, Spyware and Viruses From Your PC: Guide to increase your computer's security and speed by removing malicious viruses, malware, and spyware.

$7.99

Buy on Amazon

Internet Explorer and legacy settings

The original Windows 7 evidence showed altered Internet Explorer start-page and SearchScopes registry values. Treat those instructions as legacy evidence; do not edit the registry blindly on a modern system.

Remove the associated installed program

1. Open Installed apps (or Apps & features).
2. Search for SSOption, Special Search Option, ThetaSoft or a program installed at the same time as the browser changes.
3. Uninstall only an entry that clearly matches the unwanted software, then restart.

The historical uninstall entry was HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallThetaSoft, with C:Program Files (x86)ThetaSoftuninstall.exe. An unfamiliar publisher or folder without corroborating evidence is not automatically malicious.

Check persistence only when symptoms remain

The historical FRST log contained C:Program Files (x86)Common FilesThetaSoftQZOThetaSoftQZO.exe and a service named ThetaSoftQZO. Filename matching is not conclusive: confirm the path, publisher and digital signature, installed-program entry, browser changes, scan detections and file dates.

Best Value

Wipe It Clean: The No-BS Guide to Removing Viruses, Malware & System Threats

$14.99

Buy on Amazon

If a service, executable or setting survives automated cleanup, save the scan logs and seek a reputable malware-removal forum or qualified technician. Do not run random registry cleaners, “take ownership” scripts or FRST fixes you do not understand.

If the hijack keeps returning

• Check every installed browser, not just the one you normally use.
• Review extensions, installed programs, browser policies, scheduled tasks and startup items.
• Check security-software logs for a second infection.
• Review synchronization. Chrome Sync can restore a removed extension or setting; Malwarebytes documents resetting Chrome Sync for recurring browser detections: Chrome synchronization guidance.
• AdwCleaner includes a Reset Chrome Policies option, but do not use Basic Repair without qualified guidance.

If the scanner finds nothing, the original PUP may already be gone, only browser settings may remain, the setting may be legitimate, the browser may be organization-managed, or another hijacker may be responsible. A wrong homepage alone is not a reason to delete registry keys.

Verify that cleanup worked

• No SSOption, Special Search Option or matching ThetaSoft entry remains in Installed apps.
• No suspicious extension remains in any installed browser.
• The homepage, new-tab page and default search engine are expected.
• Searches no longer redirect and injected advertising has stopped.
• A follow-up scan is clean or no longer detects the same items.
• The ThetaSoftQZO service or executable does not reappear.
• Settings remain unchanged after a reboot and ordinary browsing.
• Synchronization is not restoring the removed extension or setting.

When to get professional help

Escalate beyond a routine PUP cleanup if the infection repeatedly returns, security tools are blocked, unknown user accounts or suspicious logins appear, ransomware or credential theft is suspected, multiple malware families are detected, or the computer contains sensitive business or financial data. A paid Malwarebytes plan can provide ongoing real-time protection, but purchasing it is not required to remove the historical PUP. AdwCleaner is the free first-line option for adware and browser hijacking; it is not a substitute for incident response in a broader compromise.

The Bottom Line

Use current Malwarebytes first, follow with AdwCleaner when browser hijacking remains, then remove unknown extensions and programs and verify settings after a restart. Historical names such as SSOption, ThetaSoftQZO and the recorded extension IDs help investigation, but none proves infection without supporting scan, path and behavior evidence.

Quick Recap

Bestseller No. 1

Website Malware Removal and Prevention Guide

$12.10

Bestseller No. 2

A Simple Guide to Virus Removal | Malware-Trojans-Spyware (Updated Nov30 2011)

$0.99

Bestseller No. 3

Simple and Effective Malware Removal Guide

$2.99

Bestseller No. 4

Remove Malware, Spyware and Viruses From Your PC: Guide to increase your computer's security and speed by removing malicious viruses, malware, and spyware.

$7.99

Bestseller No. 5

Wipe It Clean: The No-BS Guide to Removing Viruses, Malware & System Threats

$14.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.