Removing a rootkit that intercepts and redirects traffic

A rootkit that intercepts network traffic and redirects it to malicious sites can alter DNS lookups, proxy settings or certificate checks, making fraudulent pages look genuine. Warning signs include redirects across several browsers, changed search results, unfamiliar certificate warnings and unexpected data-sharing prompts. Learn more about How To Recover Files After The Maze Ransomware Attack Using Free Tools A736c4.

First establish whether the problem follows the computer, browser or whole network. An extension usually affects one browser; a router or DNS service can affect every device on the connection. Learn more about Ransomware.

Observation	Likely cause	Best next check
Only one browser redirects	Extension, hijacker or cached policy	Inspect extensions and browser policies
Every browser redirects, but other devices do not	Local rootkit or operating-system compromise	Isolate the device and boot trusted media
All devices on one connection redirect	Router, DNS or provider-side tampering	Change router credentials and test a clean device
HTTPS warnings appear	Interception software or invalid certificate	Stop entering credentials and inspect trust settings

Recognise the pattern before making changes

A redirect appearing only after a search click may be search poisoning rather than an implant. Compare clean and affected devices, note where the address bar changes and avoid entering passwords when certificate warnings or proxy prompts appear. Learn more about For Mac.

If the redirect led to a ransom demand or encrypted files, treat it as a combined compromise. [Maze file recovery methods] explains how to use known-good copies and free recovery tools while preserving evidence.

Capture screenshots, affected URLs, dates and device names before reinstalling. Do not copy suspicious installers or configuration files to another machine to test them, as that can transfer the persistence mechanism.

Isolate the affected device immediately

Disconnect Ethernet and switch off Wi-Fi, leaving the device powered off if persistence is active. Do not use it to download tools, access banking or sign into email. From a separate trusted device, change passwords, revoke sessions and enable multi-factor authentication.

Australian banks can restrict accounts, replace cards and investigate fraudulent transfers when credentials or one-time codes are exposed. Contact the institution through its official app or the number on your card, never a link from the redirect, and reject requests for verification codes.

If business data, customer records or credentials may have been accessed, preserve logs and emails. The Australian Signals Directorate’s Australian Cyber Security Centre accepts reports through ReportCyber, which can guide small businesses without a dedicated response team.

Scan and clean from trusted media

Create rescue media on a different, uncompromised computer. Windows users can run Microsoft Defender Offline Scan, while a reputable live Linux environment can inspect storage without loading the suspect operating system. Never create rescue media on the infected machine.

Offline scanning finds many boot-starting components, but a kernel-level rootkit may evade ordinary tools. If redirection continues, distrust the installation instead of repeatedly deleting detected files. Business laptops should go to an IT provider with isolation and imaging capability.

On a Mac, a suspected kernel compromise calls for Apple-supported recovery and may require erasing and reinstalling macOS. The [Mac security tips] help distinguish ordinary browser redirects and unwanted extensions from deeper system tampering.

Reinstall when the operating system cannot be trusted

A clean installation is often the most reliable way to remove a rootkit that hooks the kernel or network stack. Copy documents and photos from known-good sources, but leave downloaded executables, scripts, browser profiles, plug-ins and unverified archives behind.

Install from official media or the vendor’s recovery facility, apply updates and restore only validated data. Reset browser settings, add required extensions one at a time and keep Secure Boot or platform protection enabled.

If files were encrypted or a ransom note appeared, the [ransomware response articles] distinguish containment, recovery and legal considerations. Never trust a decryptor advertised on a redirected page; malware operators impersonate support services to install further payloads.

Audit the router, DNS and browser controls

Test the connection from a clean laptop on the same network. If redirection follows it, suspect the router, DNS service or another compromised device. Australian homes and small offices commonly use NBN-connected equipment supplied by Telstra, Optus or another provider.

Access the router only from a trusted device. Change its administrator password, update firmware, disable remote administration and restore automatic DNS. Factory-reset it if its configuration is unknown, then reapply documented settings. Changing DNS can stop a rogue resolver but cannot clean an infected computer.

Inspect the affected system’s hosts file, proxy, certificate stores, browser policies and extensions. Remove unauthorised entries and compare resolver results with a clean device. Avoid DNS cleaner apps from unknown developers, which can install fresh spyware.

Restore accounts and reduce future exposure

Once clean, change passwords from another trusted device, starting with email, banking and password managers. Enable phishing-resistant multi-factor authentication, revoke remembered devices and watch for sign-in alerts. Stored passwords may remain exposed, so reissue credentials used before the infection.

Organisations should assess whether unauthorised access affected personal information and whether notification is required under the Privacy Act 1988 and Australian Privacy Principles. A likely risk of serious harm may require notifying affected people and the Office of the Australian Information Commissioner. The ACSC and ReportCyber offer reporting and technical guidance.

Keep updates and Secure Boot enabled, use standard accounts for routine work and treat public Wi-Fi at Melbourne or Sydney cafés, airports and hotels as untrusted for banking. A VPN helps only on a clean endpoint and cannot defeat a rootkit already running. Clean devices, correct router settings and normal DNS resolution confirm that the redirect has been contained.