Clean a browser hijacker that redirects to malicious downloads

The steps for how to clean a browser hijacker that redirects you to malicious download pages focus on removing the permission, extension, or setting causing the unwanted behaviour. The browser may still work normally, which makes the problem easy to mistake for a faulty search engine or excessive advertising.

Common signs include a changed homepage, unfamiliar default search engine, extra toolbars, constant new tabs, search results that send you elsewhere, and website notifications you never requested. Redirects triggered only after clicking a result often point to a browser extension; redirects on every visited site can indicate deeper malware or altered network settings.

Before changing anything, note which browser and account are affected, save useful bookmarks, and record which downloads appeared. If pages are opening without consent or files are downloading automatically, disconnect from the internet and use a trusted device until the cleanup is complete. Do not call phone numbers, send payments, or enter banking details shown on the redirect pages.

Recognise what has been changed

Start with the affected browser rather than searching for a cleaning utility. Review its homepage, default search engine, startup behaviour, installed extensions, site permissions, notification list, and download history. A sudden change shortly after installing software, responding to an advert, or accepting a browser prompt is a useful clue.

Check whether the redirect occurs in a private or guest window, in another browser, and on a device that is not synchronising the profile. Also type a website address directly instead of using the homepage search box. If the address resolves to an unrelated domain, the cause may sit in operating-system DNS settings rather than browser preferences.

Remove harmful browser extensions

Open the browser’s extension manager and remove anything you did not knowingly install, especially tools that claim to optimise, secure, or speed up the browser. Review recently added extensions for access to “change your search engine”, “read and change all your data on all websites”, or broad notification permissions. For a detailed walkthrough, see the malicious extension guidance.

Remove suspicious extensions before resetting the browser. Extensions can restore a hijacked homepage after a reset, so this order matters. Refuse prompts from pages asking you to disable browser security, allow pop-ups, or add a “security” extension. On a work or school-managed device, check for an organisation policy and ask the administrator before removing enforced settings.

Reset the browser to trusted defaults

Use the reset command supplied by the browser. In Chrome, open the three-dot menu, choose More tools, then Remove malware. In Edge, open Settings, select Privacy, search and services, and choose Reset settings to their default values. In Firefox, open Settings, select Privacy and Security, choose More settings, then Refresh Firefox.

On a Mac, remove questionable items from Safari’s extension list and check Safari Settings, Advanced, and Security for unusual homepage or search choices. Sign out of the browser profile before a reset so synced data does not immediately restore unwanted settings. Some resets remove saved passwords and site data, so verify that your password manager or account recovery details are available first.

Clear redirects and unwanted downloads

Move any installer, archive, script, or disk image that arrived through the hijacker into a separate quarantine folder, and do not open it. Clear the browser cache and cookies to remove stale redirect state; this signs you out of many sites. Clear site data for suspicious domains individually rather than accepting a pop-up from one of those sites.

Recheck the homepage, default search provider, startup tabs, and permission list after clearing data. Restrict notifications to sites you trust and remove unknown entries from the browser’s “site settings” or “permissions” panel. If a suspicious shortcut remains in the search bar, delete it and set the approved provider again.

Check for malware outside the browser

Run a full operating-system scan rather than relying on the browser check. On Windows, update Microsoft Defender and use its Offline Scan when possible; on macOS, update the system and run the built-in security checks or a reputable scanner obtained directly from its publisher. If redirects occur outside the browser, inspect network and DNS settings because a browser reset cannot remove a compromised system configuration.

If the scan identifies adware, unwanted applications, or persistence mechanisms, follow the publisher’s removal steps and scan again from a clean reboot. The adware removal category explains common unwanted-program symptoms. Be cautious with pop-up “free scan” advertisements, especially sites offering a cleanup tool only after you download an executable from an unknown source.

Secure accounts after the redirect

Many fake download pages imitate Australian Border Force, Australia Post, or courier services and send an SMS about a parcel, customs charge, or “redelivery fee”. These messages can lead to convincing payment pages, so verify any supposed customs request through the retailer or carrier named in the order. Never pay a fee through a link supplied in an unexpected text.

If you entered a password, change it from a clean browser and enable multi-factor authentication, starting with email, banking, and cloud-storage accounts. For Australian services, contact ANZ, CBA, Westpac, Optus, or Telstra using the number printed on the card, official app, or website rather than one displayed in the redirect. Revoke unknown browser logins and synced devices after changing credentials.

Verify cleanup and reduce recurrence

Use automatic operating-system and browser updates, download software only from official sites or established stores, and avoid cracked software, fake installers, and search adverts promising security tools. On café or airport Wi-Fi in Sydney, Melbourne, or Brisbane, avoid signing into important accounts unless the network is trusted or a personal hotspot is available. Extensions should come from the browser’s official marketplace.

ACSC, eSafety, and Scamwatch provide current Australian guidance on malware and impersonation scams. After cleanup, test a direct address, a search result, and several trusted sites, then check again after restarting the device. A stable homepage, restored search defaults, no unexpected notifications, and no new files in the downloads folder are practical signs that the cleanup held.