Browser Hijacked? How to Remove Unwanted Toolbars, Redirects and Search Engines

You open your browser and the homepage isn't yours. Searches go through an unfamiliar search engine. Ads appear on sites that never had them. These are classic signs of a browser hijacker, unwanted software that takes over your browser settings, usually to make money from your searches and clicks.

• Your homepage or new tab page has changed.
• Your default search engine is one you've never heard of.
• You're redirected to strange sites.
• New toolbars or extensions appear.
• Extra pop-ups and ads everywhere.
• A message saying your browser is "managed by your organization" on a personal computer.

Hijackers usually arrive bundled with free software: a PDF converter, video downloader or "system optimizer" whose installer had pre-ticked boxes for extra programs. Sometimes they come from a malicious extension installed from a pop-up prompt.

• Chrome: Menu (⋮) → Extensions → Manage Extensions
• Edge: Menu (⋯) → Extensions → Manage extensions
• Firefox: Menu (☰) → Add-ons and themes
• Safari: Safari → Settings → Extensions

Remove anything you don't recognize or don't use. When in doubt, remove it. You can always reinstall legitimate ones.

• Windows: Settings → Apps → Installed apps. Sort by install date and look for anything installed around when the problems started.
• Mac: Check your Applications folder and System Settings → General → Login Items.

This restores your search engine, homepage and startup pages, and disables extensions. Your bookmarks and saved passwords are kept.

• Chrome: Settings → Reset settings → Restore settings to their original defaults
• Edge: Settings → Reset settings → Restore settings to their default values
• Firefox: Help → More troubleshooting information → Refresh Firefox

On a personal computer, this message can mean unwanted software installed a browser policy to lock your settings. Run a malware scan (Step 5), which often removes these. If it persists, the policies are stored in the Windows Registry or macOS configuration profiles. Check System Settings → Privacy & Security → Profiles on a Mac (on older macOS versions, System Settings → General → Device Management) and remove anything unfamiliar. If this is a work computer, the message is normal.

Run a full scan with Windows Security and a second-opinion scanner such as Malwarebytes, which is particularly good at catching adware and potentially unwanted programs (PUPs).

Some hijackers modify your desktop or taskbar shortcut to open a specific site. On Windows, right-click the browser shortcut → Properties and check the Target field. It should end with the browser's .exe", with no web address after it.

If you're getting pop-up ads on your desktop, a website may have tricked you into allowing notifications. Remove unfamiliar sites under your browser's Site settings → Notifications.

• Download software only from official websites or app stores.
• Choose Custom/Advanced install options and untick bundled offers.
• Don't install extensions from pop-ups or ads.
• Never click "Allow" on notification requests from sites you don't trust.

Remove unknown extensions and programs, reset the browser, and scan for malware. Your browser will be back to normal in about 15 minutes.