How to clean a browser hijacker manually

A browser hijacker can change a browser's homepage, default search engine, startup pages, extensions or proxy settings without replacing the browser itself. The damage often sits in profile data or a policy file, so manual cleanup can reverse it when security scans show no active payload.

This guide explains how to clean a browser hijacker that modifies the browser's configuration file manually. It covers Chromium-based browsers, Firefox and the limited changes Safari exposes. Back up the profile first, because editing the wrong file can remove bookmarks, saved logins or an active sync configuration.

Australian homes and small offices in Sydney, Melbourne and Brisbane commonly run mixed Windows and Mac fleets, while Chrome and Edge dominate Windows and Safari is common on Macs. Aussies may call the symptoms “dodgy pop-ups” that keep hijacking searches; the settings and paths still follow the same basic rules.

Recognise signs of browser tampering

Configuration tampering usually affects settings shared by normal browsing and unwanted redirects. Check whether the changes follow a browser profile, a signed-in Google or Microsoft account, or every program on the computer.

Symptom	Likely source	Key area
Homepage and search engine change	Profile preferences	homepage, search_provider
Unknown startup pages or toolbar items	Extensions or sync data	startup_urls, extensions.settings
Settings return after every reset	Managed policy or malware	chrome://policy, edge://policy
Redirects appear outside the browser	Proxy, DNS or hosts file	Operating system network settings

Unwanted notifications and injected ads can accompany a hijacker but may also come from an advertising extension. The site's detailed adware removal guidance explains how to separate advertising abuse from changes to the browser's core configuration.

Prepare a safe working copy

Disconnect the internet, close every browser window, and end remaining browser processes in Task Manager or Activity Monitor. This stops sync, extensions and background malware from restoring altered values while you work.

Locate the active profile rather than assuming it is called Default. Profile icons appear beside the browser's address bar, and several family or work profiles may exist under the user-data folder.

Copy the whole profile folder to an external drive or a clearly named local backup. Keep the original untouched until the cleaned copy works; a date written as DD/MM/YYYY also avoids confusion when choosing a restore point.

Locate the altered configuration files

On Windows, Chrome uses %LocalAppData%\Google\Chrome\User Data and Edge uses %LocalAppData%\Microsoft\Edge\User Data. On macOS, the equivalent folders begin with ~/Library/Application Support/. Look inside the active profile for Preferences, Secure Preferences and extension data.

Firefox stores profile data under %APPDATA%\Mozilla\Firefox\Profiles on Windows and ~/Library/Application Support/Mozilla/Firefox/Profiles on macOS. Relevant files include prefs.js and any user.js override. Safari uses com.apple.Safari.plist, but its binary format makes direct editing riskier.

Chrome and Edge also read managed policies from the registry and policy JSON files. Inspect chrome://policy or edge://policy; user policies can sit under the corresponding HKCU or HKLM\Software\Policies keys.

Correct the hijacked browser settings

Work on the active profile's Preferences file in a plain-text editor. Search for homepage, search_provider, startup_urls, extensions.settings and proxy. Restore legitimate values and remove only entries clearly tied to the hijacker; unfamiliar nested settings are too risky to delete blindly.

Firefox users should search prefs.js for browser.startup.homepage, browser.search.defaultEngineName and network.proxy. If an unknown user.js file is responsible, rename it after backing it up, then restart Firefox and check whether its settings are rewritten. For Safari, use its Settings and Extensions panes instead of rewriting the plist.

Preserve valid JSON syntax, including quotation marks and commas, and validate the file before reopening the browser. Do not hand-edit Secure Preferences: close the browser, use chrome://settings/reset or edge://settings/reset, and let the application regenerate protected data. Firefox can be refreshed from about:support.

Remove policies and browser persistence

A user profile cannot reliably override a managed policy. Export suspicious registry keys before changing them, remove only unauthorised entries, and ask an administrator to correct centrally managed work devices. An active policy shown in about:policies#active explains whether Firefox is affected.

Also inspect browser shortcuts, operating-system startup items, scheduled tasks, proxy settings and the Windows hosts file. A malicious executable may recreate the hijack after every reset; the polymorphic malware guide explains why changing signatures can defeat signature-based detection.

Remove unfamiliar extensions and notification permissions from the browser's extension manager, even if their configuration changes are already repaired. This prevents them from reinstalling a changed homepage or proxy.

Scan the device and confirm recovery

Run a full security scan after the manual edits, including Microsoft Defender's Offline Scan on Windows or a reputable offline scanner on macOS. If every browser and application shows the same redirect, inspect DNS and proxy settings rather than editing another profile.

Restart the browser while still offline, confirm the homepage, search provider, startup pages and extensions, then reconnect. Clean the profile data in your synced Google or Microsoft account if it still reapplies the hijack, and change any passwords entered on a compromised page.

Reduce the risk of another infection

Manual cleanup repairs the current damage, but routine habits determine whether it returns. Australian market software bundles and unfamiliar browser extensions are common sources of unwanted settings, so review what is installed rather than trusting every offered add-on.

For an NBN connection using a router from Telstra or Optus, keep router DNS automatic unless the provider instructs otherwise. Update the router firmware and use the provider's app or administration page rather than an unknown DNS changer.

• Keep the browser, operating system and extensions updated, removing add-ons you no longer use.
• Install extensions only from official stores and decline unnecessary access to browsing history.
• Use unique passwords with multi-factor authentication, especially for email and banking accounts.
• Recheck startup pages, search settings and extension permissions after browser updates or a new device setup.