Identify and Terminate Malicious Processes
First, we need to find and stop any rogue processes that might be running. These often consume system resources and can be a tell-tale sign of a hijacker.
- Open your system monitor. On most Linux distributions, you can find this by searching for 'System Monitor' in your applications menu or by pressing
Ctrl+Shift+EscorCtrl+Alt+Del. - Look for unusual processes or those consuming significant resources that you don't recognise. Pay close attention to processes with strange names or those that seem out of place.
- Right-click on any suspicious process and select 'End Process' or 'Kill'. Confirm the action if prompted. If you're unsure, search online for the process name to verify if it's legitimate.
Important
Be careful when terminating processes; ending essential system processes can cause instability or data loss. If in doubt, do not terminate.
Check Browser Extensions and Settings
Browser hijackers often install themselves as extensions or alter your browser's default settings. Let's inspect these to remove any unwanted additions.
- Open your web browser (e.g., Chrome, Firefox).
- Navigate to your browser's extension or add-on page. For Chrome, type
chrome://extensionsinto the address bar. For Firefox, typeabout:addons. - Review the list of installed extensions. Disable or remove any extensions you don't recognise, didn't intentionally install, or that seem suspicious. Look for extensions with vague descriptions or unusual permissions.
- Check your browser's homepage and search engine settings. Ensure they are set to your preferred defaults and not to an unfamiliar or unwanted search provider.
Tip
Consider enabling 'Ask where to save each file' in your browser's download settings to prevent unwanted executables from being downloaded automatically.
Examine Startup Applications and Scheduled Tasks
Some hijackers attempt to persist by launching themselves every time you start your computer or at scheduled intervals. We need to check these auto-start locations.
- Access your 'Startup Applications' or 'Startup Programs' settings. This can usually be found in your system's settings or by searching for 'Startup Applications'.
- Look for any unfamiliar entries that might be related to a browser hijacker. If you find one, deselect or remove it to prevent it from launching at startup.
- Check your scheduled tasks. In newer Linux systems, you might find these in 'Settings > Applications > Startup Applications' or by using the
crontab -ecommand in the terminal to inspect scheduled jobs. Remove any suspicious entries.
Good to know
Regularly reviewing your startup applications and scheduled tasks helps maintain system hygiene and prevents unwanted programs from running automatically.
Scan for and Remove Malware
Finally, we'll use a dedicated malware scanner to thoroughly search for and remove any remaining malicious files that the hijacker might have left behind.
- Install a reputable Linux anti-malware tool like ClamAV. You can usually install it via your distribution's package manager, for example,
sudo apt-get install clamavfor Debian/Ubuntu orsudo dnf install clamavfor Fedora. - Update the malware definitions by running the command
sudo freshclam. - Perform a full system scan using the anti-malware tool. For ClamAV, you can run
clamscan -r /home/usernameto scan your home directory orclamscan -r /to scan the entire system (this may take a long time). - Quarantine or remove any detected threats as recommended by the scanner. Always review the detected items before removal to avoid deleting legitimate files.
Important
While Linux is generally more secure, it is not immune to malware. Always keep your anti-malware software updated and run regular scans.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers