The Problem

A browser hijacker changes your search engine, home page, or new-tab page to something you did not choose, then keeps putting it back when you change it. The goal is ad revenue: your searches are routed through a page that injects sponsored results, and sometimes logs what you look for.

It usually arrives bundled with a free download, a "video downloader" extension, or a fake update prompt. The reason it seems impossible to remove is that it installs in several places at once — an extension, a modified shortcut, a scheduled task, and often an enterprise policy that locks the setting. Clear one and the others restore it.

Work through every step below in order, even the ones that look unnecessary.

Seeing fake virus warnings or a locked screen instead? See remove fake antivirus and scareware. Suspect a deeper infection? Run remove viruses and malware in Windows 11 first, then come back.

Symptoms

Searches from the address bar go to an unfamiliar engine.
The home page or new-tab page resets itself after you change it.
Search results redirect through an extra site before reaching the destination.
New tabs and pop-ups open on their own, or ads appear on sites that normally have none.
The browser's settings show "Managed by your organisation" on a personal PC.

Step 1: Uninstall the Program That Installed It

Start in Windows, not in the browser.

Open Settings → Apps → Installed apps.
Sort by Install date to bring recent additions to the top.
Uninstall anything you do not recognise, especially names containing search, toolbar, coupon, shopping, deals, PDF converter, media downloader, or driver updater.
If an uninstall fails or the entry reappears, continue anyway — later steps remove it.
Related: avoid malware in fake downloads.

Step 2: Remove the Extension in Every Browser

Check each browser installed, not only the one you use.

Chrome: open chrome://extensions → toggle off and Remove anything unfamiliar. Pay attention to extensions requesting "Read and change all your data on all websites".
Edge: edge://extensions.
Firefox: about:addons → Extensions.
Remove anything you did not deliberately install. Legitimate extensions can be reinstalled in seconds; a hijacker cannot be trusted.
If Remove is greyed out with a note that it is installed by policy, go to Step 5 first, then return here.

Step 3: Reset the Search Engine and Startup Pages

Chrome: chrome://settings/search → set Search engine used in the address bar back to Google or your choice → Manage search engines and site search → delete the hijacker entry.
Then chrome://settings/onStartup — remove unwanted startup pages.
Edge: edge://settings/search and edge://settings/startHomeNTP.
Firefox: about:preferences#search and about:preferences#home.
If a setting snaps back after a restart, something is still enforcing it — continue to Step 4.

Step 4: Check the Browser Shortcut Target

An old but still common trick: the shortcut itself carries the hijacked URL, so the browser is clean and the shortcut is not.

Right-click the browser shortcut on the desktop or taskbar → Properties. For a pinned taskbar item, right-click the icon, right-click the browser name in the jump list, then Properties.
On the Shortcut tab, look at Target. It should end at the executable, for example:
```
"C:\Program Files\Google\Chrome\Application\chrome.exe"
```
Delete anything after the closing quotation mark — a URL, --load-extension=, or any other argument.
Click Apply → OK.
Repeat for every browser shortcut, including any in the Start menu at C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

Step 5: Remove Enterprise Policies on a Personal PC

"Managed by your organisation" on a home PC means a policy was installed to lock your settings.

Chrome: open chrome://policy and note what is set. Edge: edge://policy.

Right-click Start → Terminal (Admin) and check for policy keys:

reg query HKLM\SOFTWARE\Policies\Google\Chrome

reg query HKLM\SOFTWARE\Policies\Microsoft\Edge

If entries exist that you did not create — typically ExtensionInstallForcelist, HomepageLocation, or DefaultSearchProviderSearchURL — remove the key:
```
reg delete HKLM\SOFTWARE\Policies\Google\Chrome /f
```
```
reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f
```
On a work or school computer, stop here and contact your IT team — those policies are legitimate and yours to leave alone.
Reboot and check chrome://policy again.

Step 6: Delete the Scheduled Task That Reinstalls It

This is what makes a hijacker come back after a clean removal.

Press Windows + R, type taskschd.msc, press Enter.
Click Task Scheduler Library and read the list.
Look for tasks with random names, tasks that run every few minutes, or tasks whose Actions tab points at a path in AppData, ProgramData, or Temp.
Select a suspicious task, check the Actions and Triggers tabs, and if it is not something you recognise, right-click → Delete.
Also check Task Manager → Startup apps and disable anything unfamiliar: disable startup programs.

Step 7: Scan with Windows Security and Malwarebytes

Open Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now. The PC restarts and scans before Windows loads, which catches things that hide from a normal scan.
Then run a free scan with Malwarebytes, which detects adware and potentially unwanted programs that antivirus tools deliberately ignore.
Quarantine everything found and reboot.
If Windows Security itself will not run, that is a strong infection signal: fix Windows Defender not working.

Step 8: Reset the Browser and Clear Its Data

Do this after the removal steps, not before.

Chrome: chrome://settings/reset → Restore settings to their original defaults.
Edge: edge://settings/reset.
Firefox: about:support → Refresh Firefox.
Reset does not delete bookmarks or saved passwords, but it does clear cookies and sign you out of sites.
Then clear the cache properly: clear browser cache and cookies.
If the profile is badly damaged, create a fresh one — Chrome and Edge both support multiple profiles — and re-add only the extensions you trust.

Step 9: Check DNS and the Hosts File

Some hijackers redirect at the network level, so a clean browser still lands on the wrong site.

In Terminal (Admin):
```
ipconfig /all
```
Check the DNS Servers entry is your router or a resolver you chose, not an unfamiliar public address.
Open Notepad as administrator and open:
```
C:\Windows\System32\drivers\etc\hosts
```
Delete any lines you did not add — a normal file has only comment lines beginning with #.
Flush the cache:
```
ipconfig /flushdns
```
Set trustworthy DNS deliberately: how to change DNS servers in Windows 11.
Check the router as well — some attacks change DNS there: secure your home Wi-Fi router.

Step 10: Change Passwords for Anything Sensitive

A hijacker can read what you type on the pages it has access to.

From a different, clean device, change the passwords for email and banking first.
Turn on two-factor authentication where it is not already enabled: set up two-factor authentication.
Store the new passwords properly: how to use a password manager safely.
If email was affected: recover a hacked email account.

What Not to Do

Don't install a second "anti-hijacker" tool found through a search ad. That is how many people acquire the second infection.
Don't only reset the browser. Without removing the task, policy, and shortcut changes, it returns within a day.
Don't sync a hijacked Chrome profile to another device. Sign out of sync before you start, or you spread the extension.

Still Not Working?

If the search engine still reverts after all ten steps, the reinstaller is running from somewhere you have not found. Boot into Safe Mode with Networking (how to enter Safe Mode) and repeat the scan and the task check — many components cannot start there.

If that still fails, a clean install is the reliable end point: how to clean install Windows 11.

How to Remove a Browser Hijacker and Search Redirect