Removing adware that alters links in a PDF viewer

Sponsored links appearing inside a PDF viewer can indicate more than an annoying advert. Adware may modify the application’s menus, add banners around documents, redirect clicks through an advertising network, or open a browser when you select ordinary text. Some variants also change browser settings so that searches and downloads pass through questionable pages.

This behaviour is common after installing a free PDF utility, a bundled codec, a cracked program, or a browser extension advertised as a document converter. Australian users downloading software from unofficial mirrors, torrent indexes, or pop-up pages should be especially cautious, as fake “NBN invoice” and parcel-delivery PDFs are often used to make a malicious download look legitimate.

The safest response is to stop clicking the sponsored content, disconnect briefly if redirects continue, and inspect the viewer, browser, and recently installed software. The steps below apply mainly to Windows and macOS systems, with separate checks for persistent adware that survives a normal uninstall.

Sign	Likely cause	First action
Banners inside PDF pages or menus	Modified PDF application or bundled adware	Remove recently installed PDF software
Links redirect through several domains	Browser extension, proxy, or DNS change	Check extensions and network settings
A fake update prompt appears	Malicious advertising script	Close it without downloading anything
Ads return after removal	Scheduled task, login item, or second unwanted app	Run an offline or Safe Mode scan

Confirm what is being changed

Open a known-safe PDF from your local Documents folder and compare it with a file opened in another viewer. If sponsored links appear only in one application, the viewer or one of its plug-ins is the likely source. Test with Microsoft Edge, Preview on a Mac, or another trusted PDF reader downloaded from its official publisher.

Do not enter banking details, email passwords, or Australian tax information into a page reached through an injected link. Capture the suspicious domain and record when the problem began, but avoid visiting it again. If the computer shows additional symptoms such as credential theft, disabled security tools, or unfamiliar remote-access software, review these Trojan guidance resources before continuing.

Check whether the link is genuinely part of the PDF. A legitimate document can contain advertising, but adware commonly places overlays above the page, changes the cursor, or turns unrelated words into clickable promotions. This distinction helps prevent deleting a harmless document when the real problem is the application displaying it.

Remove the unwanted PDF software

On Windows, open Settings > Apps > Installed apps and sort the list by installation date. Uninstall unfamiliar PDF readers, “search helpers”, document converters, coupon tools, and programs installed around the time the adverts began. Look for publisher names that do not match the software’s official developer. Restart the device after removal.

On macOS, inspect Applications, then remove suspicious PDF utilities by moving them to the Bin. Also check System Settings > General > Login Items for an unfamiliar background process. Some adware uses a separate updater, so remove related entries rather than keeping a component that can reinstall the viewer.

If the uninstaller requests permission to install another tool or claims that removal requires a paid “cleaner”, cancel it. Use the operating system’s built-in security features and a reputable malware scanner instead. In Australia, avoid software promoted through unsolicited calls claiming to be from Telstra, the NBN, or a local computer repair business; those campaigns often combine scareware with unwanted applications.

Inspect browsers and system settings

Injected links may be caused by a browser extension rather than the PDF reader. In Chrome, Edge, Firefox, or Safari, remove extensions you did not deliberately install, especially document search, shopping, video download, and “PDF enhancement” add-ons. Reset the default search engine and homepage if they changed, then clear site permissions for suspicious domains.

Review Windows proxy settings under Network & internet > Proxy and verify that an unknown manual proxy is disabled. On macOS, inspect System Settings > Network > Wi-Fi > Details > Proxies. Also check DNS settings and remove unfamiliar addresses unless they were deliberately configured by your workplace or internet provider. A household using NBN services in Sydney, Melbourne, or Brisbane may have router settings shared across several devices, so inspect the router if redirects affect more than one computer.

Look at the hosts file only if redirections continue after the application and browser are clean. Unusual entries mapping popular search engines, security sites, or PDF publishers to strange IP addresses can indicate tampering. Save a backup before editing system files, and avoid deleting standard entries without knowing their purpose.

Scan in a controlled environment

Run a full scan with Microsoft Defender on Windows or a trusted, updated security product on macOS. A quick scan may miss adware stored in a scheduled task, archive, or user profile. Allow the scanner to quarantine detected items, then restart and repeat the scan to check whether the same detection returns.

If Windows adware prevents security tools from running, boot into Safe Mode with Networking and scan there. Safe Mode loads fewer third-party services, making it harder for a persistent advertising process to launch. Remove suspicious scheduled tasks and startup entries only when their file paths and publishers are clearly unsafe.

On a Mac, review Activity Monitor for an unknown process that repeatedly returns after being quit. Inspect LaunchAgents and Login Items carefully, as deleting a legitimate system component can cause instability. Keep copies of important documents before making changes. If the incident involves encrypted files, ransom notes, or widespread file renaming, stop cleanup experiments and consult these ransomware resources.

Restore safe PDF habits

After removal, download a PDF viewer only from its official website or a trusted app store. During installation, choose custom or advanced options when available and decline browser extensions, search changes, and promotional utilities. Keep the viewer, browser, operating system, and security definitions updated through their normal update channels.

Set a trusted application as the default PDF handler, then test several local documents before reconnecting to sensitive services. Change passwords from a separate clean device if you entered credentials after an adware redirect, and enable multi-factor authentication for email, banking, and cloud storage.

Australian organisations and consumers should report serious scams or identity concerns through Scamwatch and contact their bank promptly when payment details may have been exposed. A clean viewer should open documents without overlays, unexpected redirects, or advertising menus; any return of those signs means another startup item, extension, or bundled program still requires investigation.