how to remove browser hijacker from windows

Browser hijackers and adware on Windows are types of potentially unwanted programs (PUPs) that modify web browser settings, such as homepage, default search engine, and toolbars, without your knowledge. They redirect you to specific websites, inject ads everywhere, and often install unwanted extensions.

If your homepage changed without permission, search results keep redirecting to strange websites, or pop‑up ads appear on every page, your PC might be infected with a browser hijacker or adware. These threats not just redirect or display pop-up ads but also track your searches and browsing, collect personal data for advertising or even fraud, and slow down browsing and system performance.

However, you don’t need paid software to fix this. In this article, you’ll learn exactly how to remove a browser hijacker from Windows for free using built‑in tools and free browser hijacker removal tools like Malwarebytes, AdwCleaner, and Microsoft Defender.”

Quick steps to remove a browser hijacker from Windows (free)

  1. Uninstall suspicious apps from Settings → Apps.
  2. Run Malwarebytes AdwCleaner (free) and clean everything it finds.
  3. Reset your browser (Chrome/Edge/Firefox) to default settings.
  4. Run a Full scan with Microsoft Defender.
  5. If problems remain, follow the advanced manual removal section.
Quick steps to remove a browser hijacker from Windows

What Are Browser Hijackers & Adware?

Before you remove the browser Hijackers & Adware from Windows, let’s first understand what you’re fighting with.

Browser Hijackers (What They Are)

Microsoft describes A browser hijacker as unwanted software that changes your browser settings without your consent. It may also:

  • Replaces your homepage with a different site
  • Change your default search engine to a shady one
  • Adds unwanted toolbars or extensions
  • Opens new tabs and redirects to sponsored or malicious websites.

Their main goal is usually to generate advertising revenue or track your online activity.

Adware (What It Is)

Adware is software designed to display unwanted ads or collect your data to target you with more advertising. Adware can:

  • Display invasive pop‑ups and banners
  • Inject ads into websites that normally don’t have them
  • Redirect you to sponsored pages or fake search results
  • Significantly slows down your browser and PC

Common Symptoms of Browser Hijackers & Adware

You may be dealing with a hijacker or adware if you notice:

  • Your homepage or search engine changed on its own
  • Your browser keeps opening unknown search engines or sites
  • Constant pop‑up ads, banners, or in‑text ads on every page
  • Web pages are loading more slowly than usual
  • New extensions or toolbars you didn’t install
  • New programs in Apps & features you don’t recognize
Common Symptoms of Browser Hijackers & Adware

If this sounds familiar, move on to the removal steps below.

How Browser Hijackers & Adware Get Installed on Windows

Most browser hijackers don’t arrive alone. They usually get installed through:

  1. Bundled Freeware Installs: Many free programs (video converters, PDF tools, download managers, etc.) bundle Potentially Unwanted Programs (PUPs). If you click “Next, Next, Finish” without reading, you can easily install extra adware or a hijacker.
  2. Clicking Deceptive Ads: Fake “Download” buttons, misleading banners, and shady streaming sites may push installers that contain PUPs and adware.
  3. Fake Update Pop‑Ups: “Your browser is out of date” or “You must update Flash/Player to continue” pop‑ups often lead to malicious installers that add a browser hijacker.
  4. Extensions from Unofficial Sources: Browser extensions or add‑ons from third‑party sites (not from the Chrome Web Store, Microsoft Edge Add-ons, or Mozilla Add-ons) may contain adware, trackers, or hijackers.
How Browser Hijackers & Adware Get Installed on Windows

Understanding how they spread helps prevent future infections.

How to Remove Browser Hijackers and Adware from Windows

To remove browser hijackers and adware, run a full system scan with a reputable antivirus program (e.g., Malwarebytes or Bitdefender). Immediately uninstall suspicious programs via your system’s Control Panel or Apps settings, remove unfamiliar browser extensions, and reset your browser’s homepage and search engine settings to default. 

Step 1: Disconnect from the Internet

Disconnecting from the internet can prevent the hijacker from:

  • Downloading additional components
  • Communicating with its remote servers
  • Pushing more ads or redirects while you clean

What to do:

  • Disconnect Wi‑Fi or unplug your Ethernet cable.
  • Close all open programs and save your work.
  • Keep this guide open on another device (phone/tablet) if possible, so you can follow it offline.

Step 2: Boot Windows into Safe Mode

Safe Mode runs Windows with a minimal set of drivers and startup programs. Many malicious processes, services, and autostart entries won’t run, making them easier to delete.

How to boot into Safe Mode (Windows 10/11):

  • Press Win + R, type msconfig (System Configuration) and press Enter
  • Open the Boot tab
  • Check Safe bootMinimal
  • Restart your PC

Alternate method (Shift + Restart → Troubleshoot → Advanced → Startup Settings → Safe Mode) if you want to be thorough.

Step 3: Uninstall Suspicious Programs

Many hijackers and adware components are installed as regular Windows programs. Removing these PUPs (Potentially Unwanted Programs) cuts off the main source of the hijacker or ads.

  1. Open Settings → Apps → Installed apps
  2. Sort by Install date
  3. Look for unknown or suspicious software
  4. Click Uninstall and follow prompts

Avoid removing software you recognize or system‑related entries.

Tip: If you’re not sure about a program, search its name online with terms like “is [program name] safe” or “adware/PUP”. When in doubt, leave it for now and move to the next steps.

Step 4: Remove Adware Using a Free Cleanup Tool

Traditional antivirus tools often miss adware, PUPs, and browser hijackers because they’re not always classified as “full malware.” A specialized free adware remover like Malwarebytes AdwCleaner is designed specifically to detect and remove:

  • Adware
  • PUPs (Potentially Unwanted Programs)
  • Browser hijackers
  • Unwanted toolbars and browser plug‑ins
Remove Adware Using a Free Cleanup Tool

This is one of the most effective free browser hijacker removal tools available.

Note: Always download security tools from their official websites to avoid fake versions.

  1. In your browser, go to the official Malwarebytes website and search for “AdwCleaner”.
  2. Download Malwarebytes AdwCleaner (it’s a small, free standalone tool).
  3. Right‑click the downloaded file and choose Run as administrator.
  4. Click Scan Now (or similar) to start a full scan.
  5. When the scan finishes, review the detected items.
  6. Click Quarantine or Clean & Repair to remove the found adware and PUPs.
  7. Restart your PC if prompted.
Malwarebytes AdwCleaner

After reboot, run AdwCleaner again to confirm it finds no new threats.

Step 5: Reset Browser Settings

Even after removing the core adware, your browser settings may still be altered:

  • Homepage changed
  • Search engine replaced
  • New tab page hijacked

Using the built‑in browser reset tools restores default settings and is a key part of any browser redirect fix. In most modern browsers, resetting does not delete your bookmarks or saved passwords (but always read the prompt carefully before confirming).

Reset Google Chrome

  1. Open Chrome.
  2. Click the three dots (⋮) in the top‑right → Settings.
  3. On the left, click Reset settings (may be under AdvancedReset and clean up).
  4. Click Restore settings to their original defaults.
  5. Read what will be reset, then click Reset settings.
Reset Chrome to Default Settings

Reset Microsoft Edge

  1. Open Edge.
  2. Click the three dots (⋯)Settings.
  3. Go to Reset settings in the left sidebar.
  4. Click Restore settings to their default values.
  5. Confirm by clicking Reset.

Reset Mozilla Firefox

  1. Open Firefox.
  2. Click the menu (≡)HelpMore troubleshooting information.
  3. On the page that opens, click Refresh Firefox.
  4. Confirm by clicking Refresh Firefox again.
Refresh Firefox

After resetting, reopen your browser and check if the default homepage and search engine are back to normal.

Step 6: Clear DNS & Browser Cache

Some browser hijackers and adware change your DNS settings or use cached data to keep redirecting you even after removal. Clearing DNS and your browser cache helps remove leftover redirect settings.

Clear DNS Cache (Flush DNS)

  1. Press Windows key + R, type cmd, and press Ctrl + Shift + Enter to open Command Prompt as administrator.
  2. In the Command Prompt window, type: ipconfig /flushdns
  3. Press Enter.
  4. You should see: Successfully flushed the DNS Resolver Cache.
How to flush DNS cache windows 11

Reset DNS Settings to Automatic

  1. Press Windows key + R, type ncpa.cpl, press Enter.
  2. Right‑click your active network adapter → Properties.
  3. Select Internet Protocol Version 4 (TCP/IPv4)Properties.
  4. Make sure:
    • Obtain an IP address automatically is selected.
    • Obtain DNS server address automatically is selected (or change to a trusted DNS like Google DNS: 8.8.8.8 / 8.8.4.4).
  5. Click OK.
Change DNS address

Step 7: Remove Suspicious Browser Extensions

Many hijackers use malicious extensions or set browser policies that lock your homepage/search engine and re‑apply changes after every restart.

Remove Suspicious Extensions

Do this in every browser you use.

Chrome / Edge:

  1. Open browser.
  2. Type chrome://extensions/ (for Chrome) or edge://extensions/ (for Edge) in the address bar and press Enter.
  3. Look for extensions you don’t recognize or don’t use.
  4. Click Remove on suspicious items.

Firefox:

  1. Open Firefox.
  2. Press Ctrl + Shift + A to open Add-ons and themes.
  3. Go to Extensions.
  4. Remove any unknown or unwanted extensions.

If you’re unsure about an extension, search its name online before removing it.

Check for Browser Policies (Advanced)

Sometimes hijackers set managed policies to prevent changes.

  • In Chrome, type chrome://policy/ in the address bar and press Enter.
  • In Edge, type edge://policy/.

If you see policies like HomepageLocation, DefaultSearchProvider, or other settings you didn’t configure, it may indicate a deeper infection or group policy change.

Step 8: Run a Full Scan with Microsoft Defender

Running a full antivirus scan at the end ensures that anything AdwCleaner missed is detected and removed. This is your final layer of protection and verification.

You don’t necessarily need a paid antivirus. For many home users, Microsoft Defender (built into Windows 10/11) plus an on‑demand scanner like AdwCleaner is enough.

  • Open Windows Security
  • Go to Virus & threat protection
  • Select Scan options → Full scan
  • Click Scan now and wait until it finishes (this might take some time).
  • Follow the recommendations to quarantine or remove any detected threats.
Windows security full scan

Manual Removal (Advanced Users Only)

If the hijacker keeps coming back even after all the steps above, some settings or files may still be left behind. The following steps are advanced and can damage your system if done incorrectly.

Warning: Proceed only if you’re comfortable with Windows internals. Always create a backup or system restore point first.

Check and Fix the Hosts File

The hosts file can be modified to redirect legitimate sites to malicious addresses.

How to check the hosts file:

  1. Press Windows key + R, type: notepad C:\Windows\System32\drivers\etc\hosts then press Enter.
  2. If prompted, choose to open with Notepad.
  3. Look for any suspicious entries, especially lines redirecting common sites (like google.com, bing.com, etc.) to IP addresses.

A typical clean hosts file usually only has lines starting with # (comments) and maybe a default entry like:

127.0.0.1       localhost
::1             localhost

If you see obvious malicious or unknown entries, you can delete those lines and save the file.

Only remove lines you’re certain are malicious or unnecessary. When in doubt, search the line online.

⚠️ Always back up your system before making advanced changes.

Repair Browser Shortcuts

Hijackers sometimes alter your browser shortcuts to launch with a malicious URL.

How to fix browser shortcut targets:

  1. Right‑click your browser shortcut (on Desktop, Taskbar, or Start menu) → Properties.
  2. In the Shortcut tab, look at the Target field.
  3. The target should typically look like:
    • Chrome: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    • Edge: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
    • Firefox: "C:\\Program Files\\Mozilla Firefox\\firefox.exe"

If you see a URL or extra text added after .exe, such as:

"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" http://malicious-site.com

Remove everything after .exe", click Apply, then OK.

Repeat this for all browser shortcuts you use.

Registry Fixes (Advanced – Be Very Careful)

Editing the registry incorrectly can cause serious system problems. Always:

  • Create a System Restore Point.
  • Export any registry keys before modifying them.

Open Registry Editor:

  1. Press Windows key + R, type regedit, press Enter.
  2. Click Yes if prompted by UAC.

You can then check common hijacker locations, such as:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Policies\Google\Chrome
  • HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome
  • Similar keys under \Policies\Microsoft\Edge or browser‑specific paths.

Look for entries forcing:

  • A specific homepage
  • A specific search engine
  • Locked new tab settings

If you find clearly malicious or unwanted entries, right‑click and choose Delete. Only delete entries you’re sure about.

If you’re not very confident working in the registry, it is usually safer to skip this step and rely on tools and the earlier steps.

Free browser hijacker removal tools for Windows

Here’s a quick reference list of free tools that help with browser redirect fix, PUP removal, and hijacker cleanup.

ToolWhat it RemovesFree?
Malwarebytes AdwCleanerAdware, PUPs, browser hijackers, toolbarsYes (100% free)
Microsoft Defender (Full Scan)Malware, hijackers, some PUPsYes (built-in)
Microsoft Defender Offline ScanRootkits, stubborn malware & hijackersYes (built-in)
Browser Reset Tools (Chrome/Edge/Firefox built‑in reset)Browser settings, homepage, search, new tab changesYes
Optional: Spybot – Search & Destroy, SUPERAntiSpyware, etc.Adware, spyware, some trackersFree / donationware

How to Prevent Browser Hijackers & Adware in the Future

Once you’ve managed to remove adware Windows free and your browser works normally, you should tighten your defenses to avoid getting reinfected.

How to Prevent Browser Hijackers & Adware in the Future

Download Software Only from Trusted Sources

  • Use official websites or well‑known platforms (Microsoft Store, vendor sites, etc.).
  • Avoid third‑party download portals that bundle installers with PUPs.

Always Use “Custom” or “Advanced” Install

When installing free software:

  • Choose Custom or Advanced installation.
  • Uncheck extra offers like toolbars, “search protectors,” “system optimizers,” or unknown antivirus.
  • Decline changes to your homepage or search engine.

This is one of the best ways to prevent PUP removal from being necessary later.

Keep Windows & Browsers Updated

  • Turn on automatic updates in Windows.
  • Keep Chrome, Edge, Firefox, and other browsers updated.

Updates patch security holes that adware and hijackers can exploit.

Use Reputable Antivirus or Real-Time Protection

  • At a minimum, keep Microsoft Defender active and regularly updated.
  • Optionally, use a reputable third‑party security suite alongside on‑demand scanners like AdwCleaner.
  • Avoid installing multiple real-time antiviruses that conflict with each other.

Be Careful with Browser Extensions

  • Install extensions only from official stores (Chrome Web Store, Edge Add-ons, Mozilla Add-ons).
  • Regularly review installed extensions and remove ones you no longer use.

Final summary:

  • Browser hijackers and adware alter browser settings, causing pop-ups, redirects, and performance issues without user permission.
  • Common symptoms of infection include changes to the homepage, new toolbars, and frequent ad pop-ups.
  • To remove browser hijackers and adware for free, follow detailed steps that include safe mode, uninstalling suspicious apps, and running malware removal tools.
  • Regularly update software and use trusted sources to prevent future infections of browser hijackers and adware.
  • Important tools for removal include Malwarebytes AdwCleaner, Microsoft Defender, and built-in browser reset features for managing settings.

If you still see redirects or pop‑ups after following all these steps, consider asking for help in a trusted tech forum and share exactly what you’ve tried so far.

Frequently Asked Questions (FAQ)

What is a browser hijacker?

A browser hijacker is unwanted software that modifies your browser settings without permission. It often changes your homepage, default search engine, and new tab page, and can cause constant redirects and intrusive ads.

Are browser hijackers dangerous?

They can expose you to malicious websites, tracking, and further malware infections.

Will removing a hijacker delete my bookmarks?

No. Browser resets usually keep bookmarks and saved passwords.

Why does the hijacker keep coming back?

A hidden program, extension, or scheduled task may still exist. Re‑scan and review installed apps.

Do I need paid antivirus software?

Not necessarily. Free tools combined with Microsoft Defender are effective for most cases.

How can I tell if my PC is clean?

No redirects, no pop‑ups, normal browser speed, and clean scan results.

Steve Ballmer
With over 7 years of experience in the IT industry, I have experience in IT support, helpdesk, sysadmin, network admin, and cloud computing. Certified in Microsoft Technologies (MCTS and MCSA) and also Cisco Certified Professional in Routing and Switching.