How do I stop pop-up ads and browser hijacks?

A browser hijack is adware that installed alongside something else, usually a free download. It changes your search engine and homepage and injects ads. It is not a virus in the destructive sense, but it is unwanted software and it removes cleanly once you know where to look.

What you'll need

• Your browser
• Administrator access (optional)

Step by step

1. Open your browser's extension list and read every entry.Chrome: three dots, Extensions. Firefox: Add-ons. Safari: Settings, Extensions. Remove anything you do not specifically remember installing.
2. Reset the homepage and default search engine.Hijacks change both. Set them back manually in browser settings — removing the extension does not always restore them.
3. Check what programs are installed on the computer.Some adware installs as a program, not only an extension. Sort by install date and look at what appeared around when the problem started.
4. Check browser notification permissions.A common trick: a site asks to send notifications, you click Allow, and it pushes ads to your desktop. Revoke everything you do not recognise in the notifications settings.
5. Check for unwanted proxy settings.Some adware routes traffic through a proxy. In network settings, the proxy should be off or automatic unless your workplace requires otherwise.
6. Run a reputable on-demand scanner.Windows Defender's offline scan, or a well-known dedicated tool. Do not install anything advertised in a pop-up — that is how this started.
7. Reset the browser to defaults if it persists.All major browsers have a reset option that clears extensions, search settings and site permissions while keeping bookmarks.
8. Install a reputable ad blocker afterwards.It reduces exposure to the malicious ad networks that distribute this in the first place.

Tips

• Free downloads bundled with 'recommended offers' are the main route in. Always choose the custom install option and untick the extras.
• A pop-up claiming your computer is infected and offering to fix it is itself the attack. Never click it — close the tab or the browser.
• If ads appear when the browser is closed, the cause is an installed program or a notification permission, not the browser itself.

Common mistakes

• Installing the software the pop-up recommends — The pop-up is the malware. Its 'fix' installs more of it.
• Only removing the extension — The homepage, search engine and notification permissions it changed stay changed. Reset each explicitly.
• Clicking Allow on notification prompts — It grants a site permission to push ads to your desktop indefinitely, outside the browser.

Questions people ask