Removing a Browser Hijacker That Forces a Proxy Script URL

A browser hijacker that forces a proxy script URL changes how your computer reaches the internet. Instead of connecting directly, Windows or macOS may be instructed to use a malicious automatic configuration script, often called a PAC file. This can redirect searches, display aggressive adverts, block security websites, or capture login traffic.

The visible symptoms may include a changed homepage, unfamiliar search results, repeated certificate warnings, or a proxy setting that returns after you remove it. The steps below cover investigation, malware removal, proxy restoration, and checks for persistence on personal computers used in Australia.

Recognise the Forced Proxy Setting

A proxy script URL usually appears in network settings as “Use setup script”, “Automatic proxy setup”, or “Automatic Configuration Script”. It may point to an unfamiliar domain, an IP address, or a long URL that you did not add. A genuine business or school network can use a PAC file, so do not remove a setting on a managed device without checking with the administrator.

On Windows, open Settings, select Network & internet, then Proxy. Review both automatic and manual proxy options. You can also open Internet Options, choose Connections, select LAN settings, and inspect the automatic configuration address. On macOS, go to System Settings, Network, your active connection, Details, and Proxies. Record the suspicious address before changing anything.

Disconnect and Preserve Useful Evidence

If the browser is redirecting banking, email, or government websites, disconnect from Wi-Fi or unplug the Ethernet cable while you investigate. Avoid entering passwords until the connection is trustworthy. This is especially important for Australians who regularly use online banking, myGov, Medicare-linked services, or shopping accounts from home NBN connections.

Take a screenshot or write down the proxy script address, suspicious extension names, redirected domains, and recent installation dates. If the incident involved stolen files or an extortion message, the ransomware removal guide explains why preserving evidence before deleting files can matter. Never open the script URL directly just to inspect it.

Remove the Hijacker and Related Software

Uninstall programs you do not recognise, especially recently added “search tools”, download managers, coupon utilities, media players, or security products with misleading names. In Windows, check Apps and installed programs; on macOS, inspect Applications and remove software from a reputable uninstaller when one is provided. Emptying the Bin or Recycle Bin is useful after removal, but it does not replace a security scan.

Next, review browser extensions and remove anything unfamiliar or unnecessary. Check Chrome, Edge, Firefox, and Safari separately because a hijacker may affect one browser while leaving others untouched. Run a full scan with a reputable, updated security product, then perform a second-opinion scan if symptoms remain. Guidance about related malicious software is available in the resource on common trojans, which can help distinguish a browser add-on from a broader infection.

Restore Proxy and Browser Configuration

After removing suspicious software, return to the proxy settings and disable the automatic script, manual proxy, or both, unless the setting is required by work, education, or a trusted network. Restart the computer and check the same screen again. If the script URL has returned, something is still enforcing it, such as a scheduled task, login item, policy setting, or surviving malware.

Reset the affected browser to its default settings, clear unwanted notification permissions, and check the homepage, new-tab page, search engine, and startup entries. A reset can remove custom extensions and preferences, so export bookmarks first if they are important. Do not import settings from an old browser profile until the device has been scanned.

Check Persistence and Account Safety

If the proxy reappears, inspect Windows Task Scheduler, Startup apps, services, and recently modified folders. On macOS, review Login Items, Profiles, LaunchAgents, and unfamiliar system extensions. Advanced changes should be made carefully: deleting a legitimate network profile or business policy can disrupt access. If the computer belongs to an employer or university in Sydney, Melbourne, Brisbane, or elsewhere, contact its IT team instead of forcing a personal configuration.

Once the connection is clean, change important passwords from a separate trusted device, beginning with email and financial accounts. Enable multifactor authentication and review recent sign-ins, browser sessions, and forwarding rules. If personal information may have been exposed, report suspicious activity to the relevant provider and consider Scamwatch or the Australian Cyber Security Centre reporting channels. Organisations handling affected personal information may also have obligations under Australia’s Privacy Act 1988.

Prevent Another Proxy Script Hijack

Keep Windows, macOS, browsers, extensions, and security software updated. Download applications from official vendor websites or recognised stores, and use care with freeware bundles that offer “recommended” installation settings. Telstra, Optus, and other Australian internet customers should remember that an NBN modem or router reset will not remove malware from an infected computer, although router administration passwords should still be changed if its settings may have been exposed.

Be cautious with links that claim your browser, Windows, or antivirus has found an urgent problem. Fake alerts often imitate familiar Australian services and may appear after a redirection. The advice on spotting phishing alerts is useful when checking messages that demand immediate downloads or phone calls.

Warning sign	What to check	Safe response
Proxy script returns after removal	Startup entries, scheduled tasks, profiles, extensions	Scan again and seek qualified support if it persists
Search results lead to adverts	Browser extensions, DNS, homepage and search settings	Remove unknown add-ons and reset the browser
Banking pages show certificate warnings	Proxy, date and time, security software, network	Disconnect and avoid entering credentials
Only a work or school device is affected	Managed policies and approved network settings	Contact the administrator before changing settings
Several devices show redirections	Router DNS and proxy configuration	Secure the router and inspect each device separately