Browser hijacking: How to help avoid it and undo damage

Regain control over your online experience

Published: November 15, 2005

"Browser hijacking" is a common type of online attack in which hackers take control of your computer's Internet browser and change how and what it displays when you're surfing the Web. If you keep your computer updated with the latest security software and updates, and practice safe Internet browsing, you're already doing a lot to keep the hijackers away. But if your browser has already been "hijacked," there are several ways you can free it from the hackers and restore its settings.

How do I know if my browser has been hijacked?

Indicators include the following unusual behaviors:

•	Home page or other settings have been changed on your computer, including the addition of links that point to Web sites that you'd normally avoid.
•	Inability to navigate to certain Web pages such as antispyware and other security software sites.
•	Appearance of cascading pop-up windows. A seemingly endless barrage of ads pop up on your screen.
•	New toolbars or Favorites have been installed, providing icons and links to Web pages that you don't want.
•	Sluggish computer operation. Malicious software can slow down your computer.

Top of page

Preventing browser hijacks

You can help keep your browser running normally with a few basic precautions:

Be very careful what you download and install onto your computer

A warning like the one in the following graphic will appear whenever you are about to download new software onto your computer. Consider this warning seriously. Disreputable online games and media services can attach spyware and other malicious software to the "free" software they require to use their services. Unless you are certain that a program or piece of software is completely trustworthy, do not download or install it on your computer. Further, if you see a pop-up window that asks for your permission to install software, click No unless you are absolutely sure you want this new software on your computer.

Download and install defensive software

•	Install automatic updates. If you use Windows 2000 or Windows XP, you can have security updates installed automatically on your computer. If you want to do this manually, visit Microsoft Update and install any service packs and updates for Windows, including Windows SP2.
•	Be sure you're using the latest version of your Internet browser. If you use Internet Explorer, be sure you have the latest version of the software, and download and install any additional security updates.
•	Use up-to-date antivirus and antispyware software. Set them to run automatically. Many browser hijacking attempts come attached to viruses or spyware.
•	Keep an anti-hijack toolkit handy. An anti-hijack toolkit should consist of programs such as Microsoft Windows AntiSpyware (Beta) (English only) and Spybot, that can help you recover control of your browser and system if your browser is hijacked. Additionally, reputable antivirus programs can detect and help remove some hijacking programs, which can be considered Trojan horse viruses.

Adjust your browser security settings

1.	On the Tools menu, click Internet Options, and then click the Security.
2.	Click the Internet icon, click the Custom Level button, and then, in the Reset to box, select Medium.
3.	Click the Reset button.
4.	Click OK.

Top of page

Restoring a hijacked browser

The following six tips can help restore your browser's settings:

1 - Stop cascading pop-up windows

If a seemingly endless number of pop-up windows appear on your screen, you'll probably want to stop the deluge first. To do this in Microsoft Windows XP or Windows 2000 while using Internet Explorer:

1.	Press CTRL+ALT+DEL, click Task Manager, and then click the Processes tab.
2.	Click IEXPLORE.EXE, and then click the End Process button.

This closes all instances of Internet Explorer. Then you can re-open the program to continue browsing as usual. To help prevent future attacks, you should also have a pop-up blocker turned on. To turn on the pop-up blocker in Internet Explorer:

1.	On the Tools menu, click Internet Options, and then click the Privacy tab.
2.	In the Pop-up Blocker box, select the Block pop-ups check box. Click OK.

If you still experience the other effects of a hijacked Web browser, try the following:

2 - Install preventive software such as the kinds mentioned in the preceding Preventing browser hijacks section. Many browser hijacking programs can be identified and removed by downloading, installing, and running these programs.

3 - Run the malicious software removal tool. This can catch some, but not all, kinds of hijacking software.

4 - Manually restore your settings. If you're using Internet Explorer and your home page has been changed, you can often reset it yourself.

1.	On the Tools menu, click Internet Options, and then click the General tab.
2.	In the Home Page box, type the desired Web address into the Address bar, or click the Use Default button to restore the manufacturer's original setting.
3.	Click OK.

5 - Removing unwanted programs with the Add/Remove feature

If you're ready to try some advanced removal methods, the Microsoft Help and Support article Unexplained computer behavior may be caused by deceptive software provides additional steps you can take, including how to use the Add/Remove feature, the built-in program remover, and the program finder in Windows Explorer.

6 - Empty the Recycle Bin when you've finished these steps, especially if you've removed an unwanted program. Then restart your computer.

Top of page

Browser hijacking: How to help avoid it and undo damage

Regain control over your online experience

On This Page

How do I know if my browser has been hijacked?

Preventing browser hijacks

Restoring a hijacked browser

Related Links