How to remove a browser hijacker forcing fake antivirus

A browser hijacker can redirect searches, alter homepage settings, spawn tabs, and lock you into a full-screen warning demanding a “security” purchase. These attacks often arrive through fake updates, bundled installers, malicious ads, or compromised extensions, and a warning may install unwanted software without a reliable consent screen.

Removing a browser hijacker that forces you to install a fake antivirus program requires more than closing the tab. The unwanted program may add an extension, change the search engine, create a scheduled task, or alter the browser shortcut. Treat those changes as one incident rather than assuming the pop-up is the whole problem.

Australian users should expect local brands as camouflage. Warnings may claim to come from Telstra, Australia Post, the Australian Taxation Office, or a major bank. No genuine provider needs you to install a mystery antivirus from a web page. Keep a clean device for changing important passwords, and never call a number displayed in a browser warning.

Understand what has changed

Start by opening the browser’s extension manager and installed applications list. Look for unfamiliar extensions, helper tools, odd security products, or anything installed when the redirects began. On Windows, check Task Manager’s Startup tab; on a Mac, look under Login Items and Background Items. A hijacker may persist outside the browser.

Then open a private or incognito window and compare the symptoms. If redirects and fake warnings remain, suspect a system component or enforced browser policy rather than ordinary browser data. Record which browsers are affected and whether searches still work. The pattern helps distinguish a hijacked profile from a compromised website and prevents deleting legitimate settings.

Separate scareware from other threats

“Fake antivirus” is the bait; “browser hijacker” is one way it gains control. Scareware uses invented infection counts, countdowns, or claims that files will be deleted. A hijacker changes browser behaviour and repeatedly reopens the page. Trojans or spyware can steal credentials or run commands, so the fake scanner may deliver a deeper compromise.

Warning signs beyond redirection include disabled security tools, administrator prompts, unknown startup processes, missing files, or ransom notes. If unfamiliar locations access your accounts, disconnect the device and change passwords from another device. Do not pay a displayed fee, grant screen sharing, or download a decryptor from the same site. For ransomware, Pc Malware Expert’s step-by-step Cerber removal guide explains why clean backups matter.

Spot the warning signs

Common signs include full-screen pages that block closing, “system repair” notifications, repeated search redirects, and security products that resist normal uninstallation. Check the address bar: a padlock means the connection is encrypted, not that the page is legitimate.

The comparison below separates the common categories and their appropriate first responses.

Threat type	Typical behaviour	Main risk	Appropriate first response
Fake antivirus	Invented scan results and repeated purchase demands	Payment fraud or further unwanted installation	Close it and use trusted security tools
Browser hijacker	Changed homepage, search redirects, new tabs, extra extensions	Loss of control and exposure to malicious downloads	Remove extensions and reset browser settings
Trojan or spyware	Hidden activity, stolen data, altered accounts or files	Credential theft, financial loss or deeper system compromise	Disconnect and scan from a clean device

Remove the hijacker without paying

First, close every browser window and end remaining browser processes through Task Manager on Windows or Force Quit on macOS. Disconnect the internet if the page keeps reinstalling software or you suspect password theft. Do not follow its “scan now” button. From a clean device, use Microsoft Defender’s offline scan on Windows or a trusted Mac product obtained directly from its vendor.

Next, uninstall the fake security program from Apps, Installed Apps, or Applications. Revoke its permissions and startup entries, then remove unknown extensions from every browser profile. If the browser will not open, use a temporary profile on the clean device to change important passwords. Enable multi-factor authentication for email, banking, and cloud storage before returning.

A full cleanup also checks shortcuts, scheduled tasks, and browser policies. Malware can place a web address in a Chrome, Edge, or Safari shortcut, or reapply changes through an administrator policy. Compare these entries with the standard shortcut and reset anything containing an unfamiliar URL. Quarantine unknown files with trusted security software rather than deleting them by guesswork.

Reset the browser and check extensions

After removing malicious components, reset the homepage, default search engine, startup pages, and new-tab URL. Review site notifications, camera, microphone, and location permissions, then clear suspicious site data. Check each browser profile because a compromised profile can spread through sync; do not sync until extensions are reviewed. On Safari, also remove unknown profiles and content blockers.

Confirm browser updates are automatic and no unknown extension can read and change data on all sites. Update the operating system too. If redirects continue, use another device to inspect the affected browser’s policies and shortcuts. Persistent changes can indicate deeper compromise, making professional analysis more useful than repeated random removals.

Build habits that stop a repeat

Australian households often combine shared Windows laptops with Macs or tablets, making it easy for one fake installer to spread. Security offers may be bundled with broadband or a retail computer, so distinguish a legitimate preinstalled utility from a later pop-up. If a warning starts carrying on about “critical damage,” screenshot it and check through the provider’s official app.

Checks for the next few days

• Watch for redirects, new tabs, and altered homepage settings.
• Review account activity and revoke unfamiliar sessions.
• Confirm that no security tool or extension has reappeared.

The site’s practical security tips offer simple ways to strengthen those habits. People in Sydney, Melbourne, Brisbane, and regional communities should rely on official Australian Government, Telstra, bank, or postal-service websites rather than contact details supplied by a suspicious page.

Longer-term safeguards

• Use automatic operating-system and browser updates.
• Install extensions only from verified stores and review permissions.
• Keep one known-clean device for account recovery.
• Report scams to ACCC Scamwatch on 1300 008 148.