Tell-tale signs of a browser hijacker
Some symptoms point at a hijacker rather than a misconfiguration:
- Your homepage or new-tab page changed to something you did not pick (often a fake search engine like Bing-but-not-quite, 'Yahoo Search by SearchManager', or a generic 'Search Encrypt'-style page).
- Search results redirect through an unfamiliar URL before landing where you expected — or never get there at all.
- An extension you do not remember installing has appeared, often called 'Search Helper', 'Tab Manager', 'PDF Viewer Pro' etc.
- Your browser is full of pop-ups even on simple sites.
Step 1: Check your default search engine and homepage
Chrome: Settings → Search engine → Manage search engines and site search. Look at Search engines. Anything you do not recognise is suspect — especially if it is set as the default.
Edge: Settings → Privacy, search and services → Address bar and search → Manage search engines.
Firefox: Settings → Search → Default Search Engine and Search Shortcuts.
Step 2: Audit installed extensions
Open your browser's extensions/add-ons page (
chrome://extensions, edge://extensions or about:addons) and disable anything you did not install on purpose.Pay attention to extensions with very generic names, broad permissions ('Read and change all your data on all websites') or recently added installs.
Important
Hijackers often install themselves under innocent-sounding names like 'Tab Resize' or 'New Tab Pro'. If in doubt, search the extension's exact name plus 'malware'.
Step 3: Check browser shortcut targets
Right-click your browser shortcut on the desktop or taskbar → Properties. Look at the Target field.
It should end in
chrome.exe, msedge.exe or firefox.exe with no extra URL after it. If it ends in something like chrome.exe http://some-search-site.com, the shortcut has been tampered with — delete the URL and click Apply.Step 4: Check Scheduled Tasks
Press Win and type Task Scheduler. Open it, expand Task Scheduler Library and look through the listed tasks.
Hijackers often create scheduled tasks that re-launch the browser to a malicious URL or reinstall the extension. Anything with random gibberish names, no description, or that points at a browser with weird arguments is suspect.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers