Fix a Windows search bar that redirects to malware sites

A Windows search bar that opens unfamiliar pages, fake virus warnings or sponsored results can indicate a browser hijacker, adware, a malicious extension or a deeper Trojan infection. The redirection may begin after installing a free utility, opening a dodgy email attachment, or clicking a fake update notice.

The issue is common on Windows 10 and 11 computers, including machines used for banking, work and study across Australia. A redirected search should be treated as a security warning rather than a minor browser glitch, especially if the computer also feels slow or displays unexpected pop-ups.

What you notice	Likely cause	First action
Search opens a strange engine	Browser hijacker or unwanted app	Check default search settings
Results lead to fake alerts	Adware, extension or Trojan	Disconnect and scan the device
Search works in one browser only	Malicious add-on or profile setting	Remove extensions and reset the browser
Windows Search opens unwanted pages	Protocol or system-level tampering	Check startup items, scheduled tasks and malware

Check where the redirect begins

Click the Windows search icon and observe what happens before selecting a result. If the search opens Microsoft Edge, Chrome or another browser, the browser may be handling a modified search protocol. If an unfamiliar application launches first, investigate recently installed software and startup entries.

Record the suspicious web address, but do not interact with its pop-ups or download buttons. A page claiming that your NBN connection, bank account or Windows licence is compromised is commonly designed to create panic. Close the tab, disconnect from the internet if downloads begin, and avoid entering passwords.

Remove suspicious browser extensions

Open the extensions or add-ons page in every browser installed on the computer. Remove extensions you do not recognise, particularly ones promising coupons, PDF tools, video downloads, faster searching or security protection. Some malicious add-ons hide behind familiar-looking names and logos.

If an extension cannot be removed, or it returns after restarting the browser, use the guidance on malicious browser extensions. A persistent add-on may be controlled by a Windows policy, scheduled task or unwanted programme.

Restore safe search settings

In your browser’s settings, select a trusted default search provider and remove unfamiliar search engines. Check the home page, new-tab page and startup settings as well. An unwanted browser policy can force searches through a dubious service even after the visible settings appear correct.

Resetting the browser can remove altered preferences, cookies and permissions, although saved passwords and bookmarks should be backed up first. This step will not remove a Trojan or a Windows-level hijacker, so treat it as part of the repair rather than the entire solution.

Uninstall unwanted Windows software

Open Apps and Features or Installed Apps and sort programmes by installation date. Remove software installed shortly before the redirects started, especially vague entries such as “Search Manager”, “Browser Assistant” or “Web Tools”. Avoid deleting Microsoft components or drivers unless you can verify what they are.

Check Task Manager’s Startup apps list and disable unknown entries. On a family computer in Brisbane, Perth or regional New South Wales, it is worth checking whether a child or housemate installed a free game helper or cracked utility. Unofficial installers frequently bundle advertising software and search hijackers.

Scan for deeper malware

Run a full scan with Windows Security, including the Microsoft Defender Offline scan where available. An offline scan can identify threats that hide while Windows is running. Keep security definitions current, then restart the computer and perform a second scan if suspicious behaviour continues.

Use a reputable, on-demand anti-malware scanner for a second opinion. Trojans can modify browsers, create persistence mechanisms and steal credentials, so review the Trojan removal information if scans detect a serious infection. Do not install several always-on antivirus products, as they can interfere with one another.

Test in Safe Mode

Safe Mode loads Windows with a limited set of drivers and startup services. If the search bar behaves normally there, a third-party application or background process is more likely to be responsible. From Windows Recovery options, choose Troubleshoot, Advanced options, Startup Settings and then restart into Safe Mode with networking only when necessary.

In Safe Mode, check recently added applications, startup folders, scheduled tasks and browser policies. Remove only entries you can identify confidently. Before changing the registry, create a restore point and export the relevant key; an incorrect deletion can stop Windows or installed software from working.

Protect accounts and recover safely

After removing the redirect, update Windows, browsers and common applications. Change important passwords from a known-clean device, beginning with email, banking, cloud storage and social media. Enable multifactor authentication and contact your bank immediately if payment details were entered into a suspicious page.

If files were encrypted, renamed or made inaccessible, avoid wiping the computer until evidence and recovery options have been considered. Cloud synchronisation can spread damaged or encrypted files to other devices, so follow advice on cloud-synced file recovery. Keep offline backups disconnected when they are not being used, and download software from official sources rather than “cracked” repositories or unsolicited links.