Hijacked Search Engine and Home Page: Adverts in the Browser, Strange Tabs and Pop-ups

You open your browser and instead of the usual Google there's an unfamiliar search engine full of adverts. The home page has changed even though you didn't touch the settings. Every so often, tabs with casinos and "sales" open by themselves, and notifications like "You've won an iPhone" or "Your computer is infected" appear in the corner of the screen. You put the settings back — and the next day it all happens again. This is the work of browser hijackers. Let's look at where they come from and how to get rid of them completely.

What a browser hijacker is

It's a program or extension that changes your browser settings without your consent: the search engine, home page and new tab page. The aim is to make money from adverts and collect data. Every search you make passes through the hijacker's server, which shows adverts, alters the results and records the history of your searches and visits.

How hijackers get onto a computer

• Bundled with free programs. Installers for media players, converters and "YouTube downloaders" often include pre-ticked boxes for "Install additionally" and "Make it the default search".
• Through extensions. "Shopping assistant", "weather forecast" and "PDF converter" extensions sometimes change the search engine immediately or some time after installation — or after the extension is sold to a new owner.
• Through site notifications. A site asks you to "Click Allow to confirm you're not a robot" — and then gets permission to show notifications in the corner of the screen, even when the browser is closed.
• Through pirated programs and cracks.

Why the settings "come back"

Simply changing the search engine in settings doesn't help if a component remains on the computer that restores the changes. That might be:

• a program in startup or a scheduled task;
• an extension that syncs through your Google or Microsoft account to all your devices;
• a browser policy — the settings show "Managed by your organisation" even though there is no organisation;
• altered browser shortcuts with an advertising site's address added after the program path.

Why it's dangerous

A browser hijacker isn't just irritating adverts. It sees your searches and the sites you visit, can swap links and serve phishing pages instead of the real sites of banks and shops. Notifications about "prizes" and "viruses" lead to scam pages that try to extract your card details or get you to call fake "support". And some hijackers act as a "front door" for more serious malware.

Signs of a hijack

• Searches go through an unfamiliar site, with results mixed up with adverts.
• The home page and new tab page have changed without your involvement.
• The browser opens advert tabs or windows by itself.
• Site notifications appear even when the browser is closed.
• The settings say "Managed by your organisation".
• Unfamiliar extensions that can't be removed.

Why "reset browser settings" isn't enough

The browser's built-in reset removes extensions and restores the search engine, but doesn't touch programs in Windows, scheduled tasks, policies or shortcuts. A day or two later the hijacker is back. And if sync is on, the malicious extension can return from another device. That's why the clean-up has to be comprehensive: browsers, the system and sync.

How to protect yourself in future

• Download programs only from official websites and choose "Custom install", unticking the extras.
• Install as few extensions as possible, and only from official stores with a good reputation.
• Never click "Allow" on notification requests from unfamiliar sites.
• Don't use pirated software.
• Work in a standard account rather than as an administrator.

If several people use the same computer, especially children, separate accounts make a big difference. A hijacker picked up by one person's careless click then stays confined to that account instead of affecting everyone, and family-safety filters can block many of the sites that push these programs in the first place.

What our technician does

1. Saves your passwords, bookmarks and important browser data.
2. Finds and removes hijacker programs, scheduled tasks and malicious extensions.
3. Removes fake "Managed by your organisation" policies and repairs shortcuts.
4. Clears notification permissions and checks sync on all your devices.
5. Checks the system for other malware and sets up browser protection.

A real example

A family from Didube complained that on their home computer "some other search" opened instead of Google, and the children kept seeing casino adverts. The parents had reset the browser several times, but a day later it was all back. Our technician found a "free video converter" that had installed a hijacker, a scheduled task that restored it every day, a "Managed by your organisation" policy in Chrome and Edge, and a dozen notification permissions for dubious sites. Everything was removed, the passwords and bookmarks were kept, sync was cleaned, and separate accounts with a family filter were set up for the children.

Call a technician

If your browser's search engine has been hijacked and adverts have appeared, we'll come to any district of Tbilisi around the clock. Learn more on our virus removal, antivirus installation and computer setup pages.