# How to Remove a Browser Hijacker and Search Redirect

URL: https://www.mytechnician.tech/tips/remove-browser-hijacker-search-redirect/
Published: 2026-07-27 | Author: Ankit Kumar
Tags: Browser, Security, Privacy, Online Safety, Fix
Summary: Browser opening a search engine you never chose, or redirecting every result? Remove the hijacker properly: extensions, shortcuts, policies, scheduled tasks, and profiles.

## The Problem
A browser hijacker changes your search engine, home page, or new-tab page to something you did not choose, then keeps putting it back when you change it. The goal is ad revenue: your searches are routed through a page that injects sponsored results, and sometimes logs what you look for.

It usually arrives bundled with a free download, a "video downloader" extension, or a fake update prompt. The reason it seems impossible to remove is that it installs in **several places at once** — an extension, a modified shortcut, a scheduled task, and often an enterprise policy that locks the setting. Clear one and the others restore it.

Work through every step below in order, even the ones that look unnecessary.

> **Seeing fake virus warnings or a locked screen instead?** See [remove fake antivirus and scareware](https://www.mytechnician.tech/tips/remove-fake-antivirus-scareware-windows-11/). **Suspect a deeper infection?** Run [remove viruses and malware in Windows 11](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) first, then come back.

## Symptoms
* Searches from the address bar go to an unfamiliar engine.
* The home page or new-tab page resets itself after you change it.
* Search results redirect through an extra site before reaching the destination.
* New tabs and pop-ups open on their own, or ads appear on sites that normally have none.
* The browser's settings show **"Managed by your organisation"** on a personal PC.

## Step 1: Uninstall the Program That Installed It
Start in Windows, not in the browser.

1. Open **Settings** → **Apps** → **Installed apps**.
2. Sort by **Install date** to bring recent additions to the top.
3. Uninstall anything you do not recognise, especially names containing *search*, *toolbar*, *coupon*, *shopping*, *deals*, *PDF converter*, *media downloader*, or *driver updater*.
4. If an uninstall fails or the entry reappears, continue anyway — later steps remove it.
5. Related: [avoid malware in fake downloads](https://www.mytechnician.tech/tips/avoid-malware-fake-downloads/).

## Step 2: Remove the Extension in Every Browser
Check each browser installed, not only the one you use.

1. **Chrome:** open `chrome://extensions` → toggle off and **Remove** anything unfamiliar. Pay attention to extensions requesting **"Read and change all your data on all websites"**.
2. **Edge:** `edge://extensions`.
3. **Firefox:** `about:addons` → **Extensions**.
4. Remove anything you did not deliberately install. Legitimate extensions can be reinstalled in seconds; a hijacker cannot be trusted.
5. If **Remove** is greyed out with a note that it is installed by policy, go to Step 5 first, then return here.

## Step 3: Reset the Search Engine and Startup Pages
1. **Chrome:** `chrome://settings/search` → set **Search engine used in the address bar** back to Google or your choice → **Manage search engines and site search** → delete the hijacker entry.
2. Then `chrome://settings/onStartup` — remove unwanted startup pages.
3. **Edge:** `edge://settings/search` and `edge://settings/startHomeNTP`.
4. **Firefox:** `about:preferences#search` and `about:preferences#home`.
5. If a setting snaps back after a restart, something is still enforcing it — continue to Step 4.

## Step 4: Check the Browser Shortcut Target
An old but still common trick: the shortcut itself carries the hijacked URL, so the browser is clean and the shortcut is not.

1. Right-click the browser shortcut on the desktop or taskbar → **Properties**. For a pinned taskbar item, right-click the icon, right-click the browser name in the jump list, then **Properties**.
2. On the **Shortcut** tab, look at **Target**. It should end at the executable, for example:
   ```
   "C:\Program Files\Google\Chrome\Application\chrome.exe"
   ```
3. Delete anything after the closing quotation mark — a URL, `--load-extension=`, or any other argument.
4. Click **Apply** → **OK**.
5. Repeat for every browser shortcut, including any in the Start menu at `C:\ProgramData\Microsoft\Windows\Start Menu\Programs`.

## Step 5: Remove Enterprise Policies on a Personal PC
"Managed by your organisation" on a home PC means a policy was installed to lock your settings.

1. **Chrome:** open `chrome://policy` and note what is set. **Edge:** `edge://policy`.
2. Right-click **Start** → **Terminal (Admin)** and check for policy keys:
   ```
   reg query HKLM\SOFTWARE\Policies\Google\Chrome
   ```
   ```
   reg query HKLM\SOFTWARE\Policies\Microsoft\Edge
   ```
3. If entries exist that you did not create — typically `ExtensionInstallForcelist`, `HomepageLocation`, or `DefaultSearchProviderSearchURL` — remove the key:
   ```
   reg delete HKLM\SOFTWARE\Policies\Google\Chrome /f
   ```
   ```
   reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f
   ```
4. **On a work or school computer, stop here and contact your IT team** — those policies are legitimate and yours to leave alone.
5. Reboot and check `chrome://policy` again.

## Step 6: Delete the Scheduled Task That Reinstalls It
This is what makes a hijacker come back after a clean removal.

1. Press **Windows + R**, type `taskschd.msc`, press Enter.
2. Click **Task Scheduler Library** and read the list.
3. Look for tasks with random names, tasks that run every few minutes, or tasks whose **Actions** tab points at a path in `AppData`, `ProgramData`, or `Temp`.
4. Select a suspicious task, check the **Actions** and **Triggers** tabs, and if it is not something you recognise, right-click → **Delete**.
5. Also check **Task Manager** → **Startup apps** and disable anything unfamiliar: [disable startup programs](https://www.mytechnician.tech/tips/disable-startup-programs-speed-up-boot/).

## Step 7: Scan with Windows Security and Malwarebytes
1. Open **Windows Security** → **Virus & threat protection** → **Scan options** → **Microsoft Defender Antivirus (offline scan)** → **Scan now**. The PC restarts and scans before Windows loads, which catches things that hide from a normal scan.
2. Then run a free scan with **Malwarebytes**, which detects adware and potentially unwanted programs that antivirus tools deliberately ignore.
3. Quarantine everything found and reboot.
4. If Windows Security itself will not run, that is a strong infection signal: [fix Windows Defender not working](https://www.mytechnician.tech/tips/fix-windows-defender-not-working/).

## Step 8: Reset the Browser and Clear Its Data
Do this after the removal steps, not before.

1. **Chrome:** `chrome://settings/reset` → **Restore settings to their original defaults**.
2. **Edge:** `edge://settings/reset`.
3. **Firefox:** `about:support` → **Refresh Firefox**.
4. Reset does not delete bookmarks or saved passwords, but it does clear cookies and sign you out of sites.
5. Then clear the cache properly: [clear browser cache and cookies](https://www.mytechnician.tech/tips/clear-browser-cache-and-cookies/).
6. If the profile is badly damaged, create a fresh one — Chrome and Edge both support multiple profiles — and re-add only the extensions you trust.

## Step 9: Check DNS and the Hosts File
Some hijackers redirect at the network level, so a clean browser still lands on the wrong site.

1. In **Terminal (Admin)**:
   ```
   ipconfig /all
   ```
   Check the **DNS Servers** entry is your router or a resolver you chose, not an unfamiliar public address.
2. Open Notepad **as administrator** and open:
   ```
   C:\Windows\System32\drivers\etc\hosts
   ```
   Delete any lines you did not add — a normal file has only comment lines beginning with `#`.
3. Flush the cache:
   ```
   ipconfig /flushdns
   ```
4. Set trustworthy DNS deliberately: [how to change DNS servers in Windows 11](https://www.mytechnician.tech/tips/how-to-change-dns-servers-windows-11/).
5. Check the router as well — some attacks change DNS there: [secure your home Wi-Fi router](https://www.mytechnician.tech/tips/secure-your-home-wifi-router/).

## Step 10: Change Passwords for Anything Sensitive
A hijacker can read what you type on the pages it has access to.

1. From a **different, clean device**, change the passwords for email and banking first.
2. Turn on two-factor authentication where it is not already enabled: [set up two-factor authentication](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/).
3. Store the new passwords properly: [how to use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/).
4. If email was affected: [recover a hacked email account](https://www.mytechnician.tech/tips/recover-hacked-email-account/).

## What Not to Do
* **Don't install a second "anti-hijacker" tool** found through a search ad. That is how many people acquire the second infection.
* **Don't only reset the browser.** Without removing the task, policy, and shortcut changes, it returns within a day.
* **Don't sync a hijacked Chrome profile to another device.** Sign out of sync before you start, or you spread the extension.

## Still Not Working?
If the search engine still reverts after all ten steps, the reinstaller is running from somewhere you have not found. Boot into Safe Mode with Networking ([how to enter Safe Mode](https://www.mytechnician.tech/tips/how-to-enter-safe-mode-windows-11/)) and repeat the scan and the task check — many components cannot start there.

If that still fails, a clean install is the reliable end point: [how to clean install Windows 11](https://www.mytechnician.tech/tips/how-to-clean-install-windows-11/).

Related: [how to stop spam notifications from your browser](https://www.mytechnician.tech/tips/stop-browser-notification-spam-windows-11/) and [how to check whether a website is safe](https://www.mytechnician.tech/tips/how-to-check-if-a-website-is-safe/).

---
Source: https://www.mytechnician.tech/tips/remove-browser-hijacker-search-redirect/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt