Fix a hijacked browser: unwanted homepage, search engine and pop-ups

Work through the steps in order: the reset near the end only lasts once the source of the changes has gone. Allow about ten minutes per browser.

1. Uninstall the program that brought it

   Hijackers usually arrive bundled with a free download, such as a PDF converter or a “search helper”. While that program is installed, it can put the changes straight back.

   1. Close every browser window.
   2. Open Settings › Apps › Installed apps (Windows 10: Apps & features) and sort the list by install date.
   3. Uninstall anything you do not recognize from around the time the trouble began. Leave alone items from Microsoft, your PC maker, or your printer or graphics card maker.

   Then run a Defender scan. Defender can remove hijacker settings that an uninstaller leaves behind.

2. Remove extensions you did not add

   Type the address shown into the browser’s address bar and press Enter.

   If you use	Then
   Chrome	Go to chrome://extensions and select Remove on each extension you do not want.
   Edge	Go to edge://extensions and select Remove on each extension you do not want.
   Firefox	Go to about:addons, choose Extensions, select the three-dot button beside an extension, and choose Remove.

   If unsure, switch an extension off and see whether the problem stops. An extension that cannot be removed is dealt with in step 4.

3. Block notification pop-ups from websites

   Pop-ups in the corner of the screen, often claiming a virus or offering a prize, usually come from a site you once allowed to send notifications.

   • Chrome: go to chrome://settings/content/notifications. Under Allowed to send notifications, select the three-dot button beside each site you do not trust and choose Block.
   • Edge: go to edge://settings/content/notifications. Under Allow, select the three-dot button beside each unwanted site and choose Block.
   • Firefox: go to about:preferences#privacy, scroll to Permissions, and select Settings beside Notifications. Set each unwanted site to Block, then select Save Changes.

   Each of these pages also has an option to stop sites asking at all. Its exact wording differs between browsers and versions.

4. Remove forced policies on a home PC

   Employers lock browser settings through policies, and hijackers misuse the same feature. That is why a home PC can suddenly show Managed by your organization, or similar wording in Edge and Firefox. A policy overrides your own settings, and a reset does not remove it.

   To see what is being forced, go to chrome://policy, edge://policy or about:policies. On a personal PC, a policy that sets the homepage, the search engine or a forced extension is almost certainly unwanted.

   1. Select Start, type regedit, open Registry Editor, and select Yes.
   2. Paste HKEY_LOCAL_MACHINE\SOFTWARE\Policies into the address bar at the top and press Enter.
   3. Look for Chrome inside Google, Edge inside Microsoft, or Firefox inside Mozilla. Right-click the browser’s key, choose Export to save a backup to your desktop, then right-click it again and choose Delete. Leave the other keys beside it alone.
   4. Repeat with HKEY_CURRENT_USER\SOFTWARE\Policies.
   5. For Firefox, also open C:\Program Files\Mozilla Firefox\distribution in File Explorer. If it holds a file named policies.json that you did not put there, delete it.

   Restart the browser and check the policy page again. If the policies return, a program is still adding them: repeat step 1 and the scan.

5. Reset Chrome or Edge, or refresh Firefox

   A reset returns the homepage, start-up pages, search engine and site permissions to their defaults and turns off every extension. Bookmarks and saved passwords are kept. Chrome and Edge also clear cookies, which signs you out of websites.

   • Chrome: go to chrome://settings/reset, select Restore settings to their original defaults, then Reset settings. If you sign in to Chrome, the reset applies on your other devices too.
   • Edge: go to edge://settings/reset, select Restore settings to their default values, then Reset.
   • Firefox: go to about:support and select Refresh Firefox, then confirm. Mozilla explains what is kept on its Refresh Firefox page.

   Afterwards, turn back on only the extensions you know and use.

6. Check the browser’s shortcuts

   Some hijackers add a web address to the shortcut that starts the browser, so the unwanted page opens even after a reset.

   1. Right-click the browser’s desktop shortcut and choose Properties. For a taskbar icon, right-click it, right-click the browser’s name in the menu that opens, and choose Properties.
   2. On the Shortcut tab, look at the end of the Target box. It should end with chrome.exe", msedge.exe" or firefox.exe", sometimes followed by a profile setting.
   3. If a web address follows, delete that address and select OK.

7. Confirm the fix and keep it that way

   Restart the PC, open the browser, and check the homepage, a search and the policy page from step 4. If all is well, choose your preferred search engine and homepage in the browser’s Settings.

   To avoid a repeat, download programs only from their makers’ own websites, and choose Custom or Advanced installation so you can clear any extra offers. When a website asks to show notifications, choose Block unless you trust it.