Removing a browser hijacker and restoring proxy settings

Removing a browser hijacker that locks your browser's proxy settings and changes them can make a computer feel untrustworthy. Signs include redirected searches, injected ads, unfamiliar extensions, failed page loads, or warnings that traffic uses another service. Such a takeover can route web traffic through an attacker-controlled server.

Disconnect the affected computer from the internet before investigating. Australian NBN setups often use a modem or router supplied by Telstra, Optus or iiNet; note the model and status lights, but do not factory-reset it yet. Existing browser and system settings can show whether the problem is local rather than an ISP outage.

Most browser hijackers operate in layers. An extension may alter searches while unwanted software edits Windows proxy values, policies, startup items or shortcuts. The router is less often infected than the PC, so recalibrating Wi-Fi in a Melbourne flat or Sydney office will not remove a malicious local setting.

From a different, clean device, change email and banking passwords, revoke unknown sessions and enable multi-factor authentication. A police-style lock screen is a separate malware incident, not a routine proxy repair.

A quick comparison helps narrow the cause:

Symptom	Likely source	Best first response
One browser redirects or an extension cannot be removed	Browser extension or altered shortcut	Disable extensions and inspect the shortcut target
Every browser follows an unfamiliar proxy	Malware, system policy or an automatic script	Disconnect the PC and compare policies with a clean device
Windows proxy controls are greyed out	Group Policy or security software	Record values, back up affected keys and remove unauthorised rules
The problem returns after cleanup	Startup tasks, services or browser persistence	Run an offline scan and review scheduled startup activity

Spot the proxy takeover

Open the browser's policy and extension pages. In Chrome or Edge, use chrome://policy or edge://policy, then the extensions page; Firefox provides about:policies and its Add-ons Manager. Look for unexpected proxy rules or an extension requesting access to all websites, search engines and downloads.

Check Windows Network & internet > Proxy and compare its manual, automatic and automatic-configuration settings with those on a trusted computer. An unfamiliar PAC address, port or proxy hostname is a red flag. If only one browser is affected, suspect its extension or shortcut first; if Windows and every browser are affected, prioritise malware and policy cleanup.

Separate the browser from the network

Test the affected device on a trusted network without making that arrangement permanent. Some Australian mobile plans have data caps, making a hotspot practical for loading one small page but unsuitable for large downloads. A hotspot can show that the router is innocent, although shared Wi-Fi, captive portals and DNS filtering can complicate the result.

Do not reset the router simply because pages redirect. Record the router address, DNS servers and the device's proxy values, then check whether another device on the same NBN line behaves normally. If it does, the evidence points toward the infected computer. If the network itself changes results, update the modem firmware, change its administrator password and disable remote administration.

Clean the device before resetting settings

On Windows, update the operating system and browser, then run Microsoft Defender or another reputable offline scan. Disconnect external drives while cleaning and do not reinstall suspicious programs from a backup. On macOS, keep the system updated, remove unfamiliar login items and review network profiles under System Settings > General. On a Windows machine also mining cryptocurrency without permission, follow the mining malware cleanup guide before changing proxy values.

A scan may find the payload but not its persistence. Review installed apps, browser extensions, scheduled tasks, services and startup folders in Safe Mode or a clean user profile. Remove only items you can identify as unwanted. If cleanup makes Windows hang, pause and use system freeze troubleshooting rather than repeatedly forcing resets.

Reset proxy values and browser policies

Start with the normal reset path. In Windows 11, open Settings > Network & internet > Proxy, disable suspicious manual and scripted entries, save and restart each browser. On macOS, check System Settings > Network > Proxies and clear unrecognised web, secure-web or automatic-proxy entries. Retain legitimate organisation-managed settings, but remove entries imposed by a hijacker.

If Windows controls are disabled, inspect HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings for ProxyEnable, ProxyServer, ProxyOverride and AutoConfigURL. Also examine Chrome and Edge policy branches under HKEY_LOCAL_MACHINE\SOFTWARE\Policies and HKEY_CURRENT_USER\SOFTWARE\Policies. Export affected keys before editing, record each value and remove only unauthorised proxy or extension-management rules.

Browser shortcuts can also carry proxy instructions. Open Properties > Shortcut and examine the Target field for --proxy-server or --proxy-bypass-list arguments. Remove them unless an IT administrator installed them deliberately. After correcting policies, shortcuts and extensions, close every browser window, terminate lingering background processes from Task Manager and reopen the browser.

Handle stubborn locks and restore a clean profile

When proxy controls remain locked, create a fresh local browser profile as a temporary diagnostic. If it behaves correctly, extensions, profile policies or cached shortcuts are probably involved; this does not prove the operating system is clean. Avoid sensitive banking in the original profile until its extensions, policies and startup items have been repaired.

For a police-themed lock screen with files held for ransom, use the police-lock ransomware cleanup procedure rather than attempting a browser reset. That incident requires careful evidence preservation and account recovery. If no data is held, isolate the machine and continue malware and policy cleanup with qualified technical support.

Prevent another proxy hijacking

Make prevention part of normal household and small-business IT. Australian users can consult Australian Cyber Security Centre guidance and Scamwatch warnings when a download or message looks suspicious. Under the Australian Privacy Act, eligible data breaches involving account or identity information may also need to be reported to the Office of the Australian Information Commissioner and the affected organisation.

• Keep the operating system, browser and router firmware current, with automatic security updates enabled.
• Install extensions only from official stores, grant the least permissions possible and remove unused ones.
• Review extension permissions and Windows proxy settings after major downloads or device repairs.
• Change important passwords from a clean device and use multi-factor authentication.
• Use a unique password manager and a stored passphrase for the router administrator account.
• Scan archives, installers and USB drives before opening them, and avoid cracked software and fake security alerts.
• Back up important documents to encrypted storage or a reputable cloud account, then test that they restore correctly.

After cleanup, watch for renewed redirects, altered DNS values and browser warnings. A fresh profile, corrected policy and clean scan should leave traffic following the connection you selected. If it still acts dodgy by Tuesday arvo, repeat the comparison on a trusted network and preserve the current settings for a technician rather than applying random fixes.