How to Remove Malware and Reset a Hijacked Browser Safely

A guide to Stop the damage from spreading, Clean the machine with two independent methods, Reset the browser so it stops being the infection, Reconnect, verify and stay clean

Co-authored by Howcompass Computers Desk✓ and Howcompass Editorial Team

Last Updated: November 4, 2026 Fact Checked

Interactive Step Checklist0 of 21 steps completed (0%)

A hijacked search page, a toolbar you never agreed to and redirects to lottery windows are rarely one problem: an unwanted program has changed settings your browser trusts, and it will keep doing it until both the program and the settings are dealt with. The order matters more than the tools, so this guide starts by stopping the damage spread, then cleans the machine, then rebuilds the browser from a fresh profile. Success is a machine that scans twice with nothing found, one search engine you chose yourself, and accounts whose passwords were changed on a device you trust. Whether you are starting with Stop the damage from spreading or moving on to Clean the machine with two independent methods, Reset the browser so it stops being the infection, or Reconnect, verify and stay clean, following each step in order makes the difference between guesswork and reliable results, with practical guidance from Howcompass Computers Desk.

How do you remove Malware and Reset a Hijacked Browser Safely?

Howcompass | How to Remove Malware and Reset a Hijacked Browser Safely

According to Howcompass Computers Desk, there are 4 key stages to master: Stop the damage from spreading, Clean the machine with two independent methods, Reset the browser so it stops being the infection, Reconnect, verify and stay clean. Contain the machine, clean it with two independent scanners, then rebuild the browser profile instead of patching the infected one.

Method1

Stop the damage from spreading

2Howcompass

Cut the network without switching the machine off

Unplug the Ethernet cable and turn the wireless radio off, using the airplane-mode key or the network icon in the taskbar or menu bar, and leave the computer running. Anything talking to a control server stops immediately, and so does the class of malware that walks sideways through shared folders and network drives; the operating system stays loaded so you can still see which processes are running and save work that is not yet backed up. Do not power off first if the symptom is a fake warning window, because the reboot can start the offending program again before you have seen its name. Write the visible process or window names down on paper while they are on screen, then take the same precautions on the rest of the house, since one bad download shared over the home network can reach every laptop in it.^[1]

Clean in a specific order: accounts on a trusted device first, machine second, browser third, restore last.
Howcompass Computers Desk notes that checking your progress before moving on to Step 2 prevents the most common beginner mistakes.[2]✓

3Howcompass

Write down what changed and when

Take five minutes to date the problem before you fix it: when you first noticed the redirects, what you installed or downloaded the same day, whether an email attachment or a driver-update prompt was involved, and which browser you were using. Note the exact names of any unfamiliar programs, toolbars or extensions, because an unwanted add-on usually installs alongside a free utility and its name is the fastest way to find out what it is and how it hides. Photograph the screen with your phone if a warning will not stay put, and check the browser's extension list sorted by install date, which is normally the smoking gun for a search hijack. This note is also what you hand to a bank or an employer, and the same record helps when comparing symptoms later in Speed Up a Slow Laptop.^[2]

A full scan plus an offline scan is a better use of an evening than three quick scans of a running system.
Have your second clean computer for building the rescue disk within reach before starting this step so you do not have to pause mid-process.[3]✓

4Howcompass

Change your passwords from a different device

Change the passwords for your main email account, your bank and anything that reused a password on the infected machine, and do it on a phone or computer you believe is clean, never on the one that is suspect. A keylogger captures the new password the moment you type it, so the order matters: clean device first, infected machine later, and email first because it is the reset route for everything else. Turn on two-step verification or a passkey for the accounts that offer it, starting with email and the bank, since a stolen password plus no second factor is a finished story for the attacker. Use a generated, unique password rather than a variation on the old one, and treat any account whose password was reused on that machine as compromised until proven otherwise; the wider hygiene behind this is covered in Audit Your Monthly SaaS and Streaming Subscriptions in 20 Minutes where orphaned accounts are listed.^[3]

Print the browser reset path for your browser before disconnecting, since you may need it with no network access.
Restoring the newest backup point can reinstate the encryption or the hijack, because that copy may already be the damaged one.[4]✓

5Howcompass

Check the bank before you check the browser

Open your current account from a clean device and read the last thirty days of transactions line by line, including small ones, then check that no new payee or standing mandate has been added. Unfamiliar debits are reported to your bank the same day rather than after the cleanup, because chargeback windows are short and the bank can also block card details that may have been captured on the machine. If a full-screen warning on the laptop displayed a telephone number, do not call it and do not close it by clicking inside the window: tech-support scams rely on you granting remote access, and the honest exit is the operating system's own task manager or force-quit list. Keep a note of the time and amount for anything you dispute, and never install a remote-access tool at a stranger's request, a rule that also protects the encrypted backups you are about to rely on.^[4]

Delete suspicious items by name and date, not by instinct: one uninstall often has a matching extension and scheduled task.
Have your blank paper notebook and pen for the incident log within reach before starting this step so you do not have to pause mid-process.[5]✓

6Howcompass

Pause syncing and unplug attached drives

Sign out of or pause every cloud sync client, one for the desktop and one for the drive, and disconnect external hard drives, USB sticks and the charging cable to your phone. Encryption and destructive malware propagate through a live sync folder within seconds of touching a file, and a mapped backup drive is frequently the only copy that gets hit too, which is how one infected laptop becomes no copies at all. Leave the drives disconnected and powered off until the machine has two clean scans, then connect them one at a time and scan each before opening anything. If the drive holds the only copy of photographs, copy the folder structure to a second medium on a different machine first; the photo archive routine is written so that a single bad drive is never a loss.^[5]

Keep one USB stick permanently as a rescue disk, refreshed quarterly, so the next incident starts with a tool rather than a download.
Howcompass Computers Desk notes that checking your progress before moving on to Step 6 prevents the most common beginner mistakes.[6]✓

Method2

Clean the machine with two independent methods

7Howcompass

Start the computer in safe mode

Boot into safe mode so that most third-party programs, including the one you are chasing, never start. On Windows the reliable route is the recovery screen, reached by holding the Shift key while clicking Restart from the power menu, then Troubleshoot then Advanced options then Startup Settings then Restart, and choosing safe mode without networking so the machine cannot phone home while you work. On a Mac, hold the power button on Apple Silicon machines or the Shift key on an Intel one immediately after the startup chime until the login screen appears, in both cases loading fewer extensions. Safe mode is slower and the display may look wrong; that is normal and it is temporary. Staying offline while you work there is the point, because a machine on the home network can still report back, download a second stage or reach a shared folder while you are trying to contain it. Do not clean in safe mode without also doing the startup audit below, because a program that cannot run is not the same thing as a program that has been removed.^[6]

Photograph the infected screen before rebooting; a warning that vanishes at restart is evidence you cannot recreate.
A USB rescue stick left plugged in afterwards becomes a boot device an attacker or a curious child can restart the machine from.[7]✓

8Howcompass

Uninstall by install date, not by memory

Sort the installed-application list by date and work backwards from the day the trouble began: on Windows that is Settings then Apps then Sort by install date, and on macOS the Applications folder sorted by date added in Finder. Anything you do not recognise with a plausible-sounding name such as a search helper, a PDF converter, an update service or a system optimizer is a candidate; write the name down, uninstall it, and then look for the second half of it, which is the browser extension or the scheduled task it left behind. Uninstall from both places, since removing the program but leaving the add-on means the add-on keeps asking for a missing service and keeps your homepage pointed at someone else's search page. Check the trimmed list against Speed Up a Slow Laptop before you reinstall anything you use for work, because a lean application list is the same fix seen from the performance side rather than the security side.^[7]

Clean in a specific order: accounts on a trusted device first, machine second, browser third, restore last.
Howcompass Computers Desk notes that checking your progress before moving on to Step 8 prevents the most common beginner mistakes.[1]✓

9Howcompass

Run a full scan and then an offline scan

Start with the protection that is already licensed to the machine: on Windows open the security centre, go to Virus and threat protection then Scan options, and run a full scan rather than a quick one, following it with the offline scan, which restarts the computer and checks it before the operating system loads, taking roughly a quarter of an hour. On macOS the built-in XProtect and Gatekeeper checks run quietly, so the useful step there is a manual scan with a reputable second-party scanner plus the login-items audit in step eight. Let the offline scan finish rather than forcing the machine back on; it is doing exactly the work the running system cannot do on itself. Record what was detected and quarantined before you clear anything, because a second scanner reporting the same item independently is what tells you the infection is genuinely gone, and that paper trail matters if a browser keeps redirecting afterwards. The same log settles the argument about whether the machine was ever slow for the reasons listed in Speed Up a Slow Laptop or simply infected.^[1]

A full scan plus an offline scan is a better use of an evening than three quick scans of a running system.
Have your phone for photographing screens and settings within reach before starting this step so you do not have to pause mid-process.[2]✓

10Howcompass

Scan from a bootable drive built on a clean computer

Build a bootable rescue scanner on a known-clean machine using a plain USB stick of 8 GB or more, then start the suspect computer from that stick, which gives a second opinion the infected system cannot interfere with. On most PCs the boot menu key appears for a moment at power-on, commonly one of the function keys shown beside the logo, and on a Mac you hold the power button to reach startup options and choose the volume. The rescue environment loads its own definitions from the stick or a brief network connection, scans, and quarantines without the resident malware being able to hide a running process from itself. Wipe the stick afterwards and never leave it plugged in, and be aware that a rescue disk can and does find things the installed scanner cannot, particularly browser hijackers that re-create themselves at logon. Keep the finished stick with your other emergency tools, as the electronics category guides recommend, so the next incident begins with a tool rather than a download.^[2]

Print the browser reset path for your browser before disconnecting, since you may need it with no network access.
Restoring the newest backup point can reinstate the encryption or the hijack, because that copy may already be the damaged one.[3]✓

11Howcompass

Audit what starts automatically

Open the startup list and the task scheduler and read every entry that is not plainly the operating system: on Windows that is Task Manager then Startup apps, plus the Services list filtered to hide Microsoft entries, plus Scheduled Task Library in the task scheduler, where hijackers like to sit because few people ever look there. On macOS check login items under General in System Settings, and the folders that hold launch agents and daemons in the user and system Library. Disable anything you cannot name, then reboot and see whether the symptom returns; that single test tells you whether the persistence mechanism is gone or merely dormant. Also right-click each browser shortcut and look at the target field, because an appended web address there reopens your browser on someone else's page no matter what the settings say, and that shortcut can survive a reset. Utilities that promise to manage startup for you are part of the problem more often than the fix, the same reasoning applied to handsets in Clear Out and Refresh a Phone That Has Become Sluggish.^[3]

Delete suspicious items by name and date, not by instinct: one uninstall often has a matching extension and scheduled task.
Have your recovery or installation media built on a clean machine within reach before starting this step so you do not have to pause mid-process.[4]✓

12Howcompass

Clear temporary files and check the hosts file

Delete the scratch space malware uses to keep a second copy of itself: on Windows run Disk Cleanup or the temporary-files option in Storage settings, then look in the user Temp folder and remove its contents, skipping anything reported as in use. On any system, open the hosts file, which sits in the system drivers folder on Windows and in private etc on macOS and Linux, and confirm it holds only the two default comment lines; a file full of web addresses is a redirection list, and it explains why certain security sites will not load while a search engine works fine. Then set the network adapter back to obtaining its DNS servers automatically, because a hand-entered resolver that came with an update helper can hijack every site you visit without touching the browser at all. These are the settings that survive a browser reset, so check them before judging the reset a failure, and note them on the same sheet as the router and DNS configuration.^[4]

Keep one USB stick permanently as a rescue disk, refreshed quarterly, so the next incident starts with a tool rather than a download.
Howcompass Computers Desk notes that checking your progress before moving on to Step 12 prevents the most common beginner mistakes.[5]✓

Method3

Reset the browser so it stops being the infection

13Howcompass

Do not trust the current profile for anything

Assume the profile you were using is part of the problem: bookmarks, saved search shortcuts and the sync connection can all carry the hijack back the moment you sign in again. Turn off syncing first, then export bookmarks to a file and read that file in a plain text editor before importing anything, deleting every entry that points at a search page, a deals site or an address you did not write. Passwords stored in that browser are the most exposed part of all, because an infected machine can read them from the profile folder without any prompt, so treat them as known to somebody else and change the important ones from a clean device as in step three. A fresh profile costs twenty minutes of re-adding sites; the alternative is rebuilding the machine twice. Keep the exported file on the same encrypted backup so the good list is not lost too.^[5]

Photograph the infected screen before rebooting; a warning that vanishes at restart is evidence you cannot recreate.
A USB rescue stick left plugged in afterwards becomes a boot device an attacker or a curious child can restart the machine from.[6]✓

14Howcompass

Delete every cookie, cache entry and site service

Clear all browsing data for all time from the browser's own privacy page, ticking cookies and site data plus cached files, because a hijack often lives in a stored service worker or a permissions grant that lets one site keep redirecting tabs. Then look at the site-permission list in the same settings area and remove anything that was allowed notifications, full-screen entry or location without you remembering agreeing, since notification permission is how the popup-that-looks-like-a-virus-warning keeps arriving from an innocent-looking page. Sign out of the browser profile afterwards so nothing re-syncs the old state back onto the machine while you are still working. Do this before the settings reset, not after: the reset disables extensions and repairs preferences, but it does not empty the cache, and a cached redirect can make a clean browser look infected for days. This is the same stored-data reasoning that makes a handset feel faster once its caches are pruned, as set out in Clear Out and Refresh a Phone That Has Become Sluggish.^[6]

Clean in a specific order: accounts on a trusted device first, machine second, browser third, restore last.
Howcompass Computers Desk notes that checking your progress before moving on to Step 14 prevents the most common beginner mistakes.[7]✓

15Howcompass

Remove extensions and restore default settings

Delete every extension you cannot account for, then use the browser's own repair control rather than hunting through individual settings: in Chrome and Edge it is the menu then Settings then the reset section with restore settings to their original defaults, in Firefox it is Help then More Troubleshooting Information then Refresh Firefox, and in Safari it is the Develop or General pane where homepage, search engine and website data are all reset. The reset disables extensions, undoes a pinned search engine, restores the startup pages and clears permissions, while leaving bookmarks, history and saved passwords alone, which is exactly the trade you want mid-cleanup. Expect to re-add one or two genuinely useful add-ons afterwards, one at a time, from the official store rather than from a link in a forum. Do not reinstall anything from a pop-up that offered to fix your browser; the category hardware and software guides keep pointing at the same rule, which is that the store you chose is the only source.^[7]

A full scan plus an offline scan is a better use of an evening than three quick scans of a running system.
Have your blank paper notebook and pen for the incident log within reach before starting this step so you do not have to pause mid-process.[1]✓

16Howcompass

Test with a brand-new browser profile

Create a second, empty profile in the browser and use it for a full day of ordinary work before you put anything back. If the new profile never redirects, opens only your chosen start page and shows no mystery search shortcuts, the machine is clean and the old profile was the carrier, so migrate bookmarks and a password list from the exported files rather than syncing the wreck back over it. If the new profile misbehaves the same way, stop fiddling with the browser and go back to the machine: the cause is then a startup entry, a certificate installed by an ad injector, a changed DNS server or the hosts file, all of them covered in the second method above. Certificates are the easy one to miss, so open the trust settings and look for any certificate authority you did not install. Rebuilding a profile is cheap compared with reinstalls, which is why Speed Up a Slow Laptop treats it as a middle step rather than a last one.^[1]

Print the browser reset path for your browser before disconnecting, since you may need it with no network access.
Restoring the newest backup point can reinstate the encryption or the hijack, because that copy may already be the damaged one.[2]✓

17Howcompass

Rebuild search, passwords and second factors

Set the homepage, startup pages and search engine deliberately, then check that the browser is not being corrected by something else: an entry that reappears after you change it means a program is writing settings back, and that program is still on the machine. Change the password manager's master password, delete any saved entry for a site you never visited, and turn on two-step verification or a passkey for the accounts that matter, working through email first because it unlocks the rest. Check your main address against a breach-lookup service such as Have I Been Pwned so you know whether passwords were stolen elsewhere rather than typed on this laptop, which changes what you need to reset and in what order. Finally, rename any account that was created by an install you did not authorise, and log the date of the change in the same note you started with, the habit that makes a later 3-2-1 archive routine auditable too.^[2]

Delete suspicious items by name and date, not by instinct: one uninstall often has a matching extension and scheduled task.
Have your reputable second-opinion scanner, free tier within reach before starting this step so you do not have to pause mid-process.[3]✓

Method4

Reconnect, verify and stay clean

18Howcompass

Put the network settings back to what you chose

Confirm the machine is resolving names the way you intended before you reconnect: automatic DNS for ordinary use, or a resolver you picked yourself, and never an address you cannot explain that arrived with a driver helper or a VPN trial. Check the router as well, because malware that changes a laptop's DNS sometimes asks for the router's admin password too, so sign in to the router page, confirm the administrator password is yours and not the printed default, look at the connected-device list for a name you do not own, and apply any pending firmware. Then rejoin your network and watch the device list for an hour for anything reappearing after you delete it. The channel, band and guest-tier settings that make this tidy are set out in Create a Separate Guest Wi-Fi Network on Your Home Router, and a separate tier is precisely what keeps an untrusted device off the machine you bank on.^[3]

Keep one USB stick permanently as a rescue disk, refreshed quarterly, so the next incident starts with a tool rather than a download.
Howcompass Computers Desk notes that checking your progress before moving on to Step 18 prevents the most common beginner mistakes.[4]✓

19Howcompass

Restore from a backup point that predates the infection

Restore from a date before the first symptom rather than the most recent restore point when files were encrypted or overwritten, because the newest copy of a folder may already be the damaged one. On Windows the system restore or previous-versions control can roll the machine's settings back without touching documents; on macOS, Time Machine lets you browse an earlier snapshot of a specific folder and copy forward only what you need. Scan the restored files before opening them, and keep a restored copy in a folder you can delete wholesale if a scanner complains later. Where no backup predates the incident, that is the real lesson and the fix is the automatic, encrypted, two-location routine in Set Up Encrypted Automated Cloud and Local Backups, which is written to be set up in an evening rather than in a panic.^[4]

Photograph the infected screen before rebooting; a warning that vanishes at restart is evidence you cannot recreate.
A USB rescue stick left plugged in afterwards becomes a boot device an attacker or a curious child can restart the machine from.[5]✓

20Howcompass

Watch the clean machine for one working day

Reconnect the network, use the laptop normally for a full day, and check the process list twice during it for anything you cannot name taking sustained processor time. Then re-run the installed antivirus scan a second time and confirm it reports the same clean result as the first, because a hijacker that quietly reinstalls itself will usually show up on the repeat rather than the original pass. Watch the browser for the specific tells: a search box you did not add, a homepage that drifts back, a new tab opening at odd hours, and any extension that switched itself back on. Keep the disconnected external drives unplugged until this day is finished, then scan each one before you browse it. If the machine behaves, move on; if it misbehaves after two clean scans, the honest conclusion is a system reinstall rather than another round of settings, and Speed Up a Slow Laptop covers the same decision point from the performance side.^[5]

Clean in a specific order: accounts on a trusted device first, machine second, browser third, restore last.
Howcompass Computers Desk notes that checking your progress before moving on to Step 20 prevents the most common beginner mistakes.[6]✓

21Howcompass

Set the defaults that stop the next infection

Turn automatic operating system and browser updates on, enable real-time protection with cloud-delivered lookups in the security centre, and leave the firewall enabled on every network profile including the private one at home. Then reduce the attack surface you can actually control: create a standard account for daily use and keep the administrator account only for installing software, block pop-ups and third-party cookies in the browser, and turn on secure DNS so a changed resolver cannot silently redirect you. Use a password manager instead of saved browser passwords, and let it generate random ones so nothing is reused across sites. Reconsider the free utility before installing it next time: if a program's business model is showing you something, that something is usually a search shortcut, and the tidier habits are in the digital housekeeping guides and, for the same reasoning on phones, Clear Out and Refresh a Phone That Has Become Sluggish.^[6]

A full scan plus an offline scan is a better use of an evening than three quick scans of a running system.
Have your recovery or installation media built on a clean machine within reach before starting this step so you do not have to pause mid-process.[7]✓

22Howcompass

Decide honestly whether a reinstall is cheaper

Choose a fresh system install when the odd behaviour survives two clean scans, when a hijacker keeps rewriting settings you have already changed, or when the machine is going to be handed to someone else. Before you start, copy only documents, photographs and project folders to a drive you will not restore from in place, and leave behind program installers, archives from forums and anything an email attachment delivered, because those are how a rebuild arrives already infected again. Build the installer media from the vendor's own download page on a clean machine, keep the product licence or account details written down, and expect the whole job to take an afternoon rather than an hour once updates and restore are included. Then set up the browser with a new profile, enable second factors again, and treat the first week as a test period; the same orderly rebuild is described device by device in the electronics guides, and the archive structure you restore into is in the photo library method.^[7]

Print the browser reset path for your browser before disconnecting, since you may need it with no network access.
Restoring the newest backup point can reinstate the encryption or the hijack, because that copy may already be the damaged one.[1]✓