How to Remove a Browser Hijacker That Rewrites Your DNS

A browser hijacker that quietly rewrites your DNS resolver feels harmless at first. One moment pages load normally; the next, a familiar address bar leads somewhere completely different, or a search query bounces through an unknown intermediary. These infections target the address book of the internet rather than the files on your drive, which is why many Australians only realise something is wrong after their bank login screen has already been swapped for a near-perfect imitation. Because the damage happens at the resolver level, ordinary browser cleanup rarely fixes it.

The good news is that a DNS-redirecting hijacker leaves obvious footprints once you know where to look. With the right sequence of checks, support from local resources such as the ACSC, and a clean slate for your network adapter, you can wrestle control back from the rogue resolver. This guide walks through the full process, from spotting the red flags to preventing the same hijack from returning on your next restart.

How the Hijacker Takes Over Your Network Settings

A DNS hijacker does not always need administrator privileges to be annoying, but the nastier variants do ask for them. Once you install a free toolbar, click through a fake captcha, or run a poisoned installer pulled from a dodgy mirror, the payload reaches into your adapter settings, the hosts file, or sometimes the router's web admin page, and swaps the resolver addresses. From that point on, every domain lookup on the affected device is answered by a server controlled by the attacker.

In Australian homes, where most connections rely on a Telstra, Optus, or TPG-supplied modem sitting between the NBN box and the rest of the household, the router itself is often a soft target. Older firmware, default admin credentials, and remote-management features left switched on are classic entry points. Once the resolver has been changed at the gateway, every phone, smart TV, and laptop on the same network inherits the hijack without ever running the original malware.

Recognising the Symptoms

Searches that used to land on google.com.au return odd-looking clones, or you suddenly see more advertising than usual on pages that do not normally carry ads. Web addresses that should resolve in a heartbeat instead time out. Loading a known-secure page such as your bank's portal triggers a certificate warning because the traffic is being intercepted by a proxy that cannot replicate the real TLS chain.

Performance can also drop as traffic gets routed far from where you actually are, sometimes via servers on the other side of the planet, doubling latency for users in Sydney or Brisbane who are used to snappy local content delivery. If your NBN link feels sluggish despite a green light on the modem, and you have ruled out an outage on the provider's status page, a swapped resolver is one of the first things worth checking.

Reclaiming Your DNS on Windows

Start by disconnecting from Wi-Fi to stop the rogue resolver from re-pushing settings while you work. Open Settings, jump to Network and Internet, pick the active adapter, and view its properties. Where it lists IPv4 and IPv6 server entries, replace anything suspicious with manual addresses from a trusted provider. The table below compares four resolvers commonly recommended by Australian security professionals.

Provider	Primary address	Secondary address	Notable trait
Cloudflare	1.1.1.1	1.0.0.1	Strong privacy, fast lookups in Sydney and Melbourne
Quad9	9.9.9.9	149.112.112.112	Blocks known malicious domains at the resolver
Google Public DNS	8.8.8.8	8.8.4.4	Broad reliability, modest filtering
OpenDNS Home	208.67.222.222	208.67.220.220	Optional family-safe filtering profiles

After saving, flush the resolver cache by running ipconfig /flushdns in an elevated command prompt, then reboot to confirm the changes stick. Run a full scan with a reputable anti-malware tool, clear every remaining browser extension, and reset each browser's startup pages. If your router's admin password has never been changed, log in and replace it now, then disable remote management unless you genuinely use the feature.

Cleaning the Same Threat Off macOS

macOS gets fewer headline infections than Windows, but DNS hijackers do not care about operating system loyalty. They happily rewrite the same resolver entries on a MacBook used in a Perth café or a home office in Adelaide. Open System Settings, head to Network, select the active interface, and set Configure IPv4 to Manual. Enter the addresses from the table above, click Apply, and confirm the entries survive a reboot.

A boot into Safe Mode helps isolate whether a background process is still pushing the old resolver back every minute. Once you are back at a clean login, run a dedicated scanner to flush any lingering configuration profiles. Users who want a step-by-step walkthrough of the full macOS recovery flow can follow the Mac removal resource for a deeper checklist.

Locking DNS Down to Prevent a Recurrence

Treating the infection is only half the job. Lock the DNS settings on the router itself, and where your modem supports it, enable DNS-over-HTTPS or DNS-over-TLS to a trusted provider so your queries stay encrypted end to end. Keep router firmware updated, especially on the combined NBN and Wi-Fi units shipped by most ISPs, and write the admin password somewhere other than the bottom of the device. For an extra layer of safety around the files that matter most, take a look at this synced-file ransomware guide so you understand what an attacker could reach next time a DNS swap slips through.

A useful habit is to verify your resolver once a month. A quick visit to a DNS leak test site, or running nslookup from the terminal, tells you in seconds whether your queries are still going where you expect them to. Combine that with off-device backups stored in a different physical location, and the next hijacker will have far less to work with.