What happens when a browser hijacker takes over
A browser hijacker is malware that changes how your web browser behaves without your permission. It typically redirects your searches to a different search engine, replaces your home page, injects ads into websites you visit, or forces you to visit certain pages when you open a new tab. Unlike ransomware that locks your files or spyware that steals passwords, a hijacker's main goal is to generate money through advertising clicks and search referrals — but it still means your browser is no longer under your control.
The reason you might want to document what's happening before you remove it is straightforward: if you take screenshots or notes of the exact behavior, you have proof of what was wrong. This matters if you need to explain the problem to a technician, if you want to report it to your browser maker, or if you're trying to figure out how it got there in the first place.
Key Takeaways
- Document the hijacker by taking screenshots of your home page, search results, and new tab behavior, then note the exact URL that appears when you search.
- Check your browser extensions and installed programs to find the culprit, because most hijackers hide in a program you installed or an extension you added.
- Write down the name of any unfamiliar extension or program, the date you first noticed the problem, and what changed about your browser behavior.
- Removing a hijacker usually means uninstalling the program or extension that caused it, then resetting your browser settings back to normal.
Take screenshots of the hijacked behavior
Start by capturing what you actually see. Take a screenshot of your home page — the page that opens when you start your browser. Take another screenshot of what happens when you click the search bar and type something. Take a third of what appears when you open a new tab. These images show exactly what the hijacker is doing, and they're useful if you need to describe the problem later.
Pay special attention to the URL in the address bar. When you search for something, what website does the search actually go to? Write down the exact address. For example, if you search for "weather" and end up at search.mysearchbar.com instead of Google, that URL is the hijacker's fingerprint. Screenshot that too.
Find the hijacker in your browser extensions
Most browser hijackers live in your extensions — the small programs that add features to your browser. Open your browser's extension menu. In Chrome, click the three vertical dots in the top right, then select "More tools" and "Extensions". In Firefox, click the three horizontal lines, then "Add-ons". In Safari, go to "Safari" menu, then "Settings", then "Extensions".
Look for anything you don't recognize or don't remember installing. Hijackers often have names that sound legitimate or generic — "Search Helper", "Web Assistant", "Tab Manager", "Speed Booster". Write down the exact name of any extension that looks suspicious. Click on it to see what permissions it has. If an extension asks for permission to "manage your search settings" or "change your home page", that's a red flag. Take a screenshot of the extension's name and permissions.
If you find a suspicious extension, don't remove it yet — first note its name and the date you found it. This creates a record of what was wrong.
Check your installed programs for the source
The extension might be a symptom, not the cause. Many hijackers come bundled with other software you installed. Go to your computer's list of installed programs. On Windows, open Settings, go to "Apps", then "Apps and features". On Mac, open Finder, go to Applications, and look through the list.
Look for programs you don't remember installing or programs with names that seem generic or vague. Hijackers often come packaged with read managers, "optimizer" tools, or media players. Write down the name and installation date of anything suspicious. If you installed a program around the same time your browser started acting strange, that's likely the culprit.
Document the timeline and behavior changes
Write down when you first noticed the problem. Was it after you installed something new? After you downloaded a file? After you visited a particular website? The timeline helps you understand how the hijacker got there and can help you avoid the same mistake later.
List the specific changes you've noticed: Does your home page redirect to a different site? Does your search go somewhere other than your normal search engine? Do ads appear on websites that don't normally have them? Do new tabs open to an unfamiliar page? The more specific you are, the clearer the picture of what's actually happening.
Remove the hijacker by uninstalling the source
Once you've documented everything, remove the hijacker. Start by uninstalling the suspicious program from your computer's program list. On Windows, right-click the program and select "Uninstall". On Mac, drag it to the Trash. Then restart your browser completely — close it entirely and open it again.
Next, remove the suspicious extension. Go back to your extensions menu, find the extension you identified, and click the remove or delete button. Again, close and reopen your browser.
After you've uninstalled both the program and the extension, reset your browser settings to their defaults. In Chrome, click the three dots, go to "Settings", then "Reset settings". In Firefox, click the menu, go to "Help", then "Troubleshoot Information", and click "Refresh Firefox". In Safari, go to "Safari" menu, then "Settings", and manually set your home page and search engine back to what you want.
Prevent hijackers from coming back
Most hijackers arrive because you installed something that bundled them in. When you read software, read the installation screens carefully. Uncheck any boxes that say "install this toolbar" or "set this as your home page" or "add this search engine". If an installer tries to change your browser settings without asking clearly, that's a sign the software might be bundled with unwanted extras.
Stick to downloading programs from official websites or trusted app stores rather than random read sites. Be cautious with browser extensions — only install extensions from your browser's official store, and check the reviews and permissions before you add anything.
Frequently Asked Questions
What's the difference between a hijacker and a virus?
A virus replicates itself and can damage files or steal data. A hijacker just changes your browser settings to show ads and generate money. Both are malware, but a hijacker is usually less destructive — it's annoying rather than dangerous, though it still means your computer is compromised.
Can a hijacker steal my passwords?
A basic hijacker typically doesn't steal passwords — it just redirects your searches and home page. However, some hijackers are paired with spyware that does steal data. If you're concerned, change your passwords after you remove the hijacker, especially for banking and email accounts.
Do I need antivirus software to remove a hijacker?
You can remove most hijackers by uninstalling the program and extension that caused them, as described above. Antivirus software can help detect and remove hijackers automatically, but it's not required if you're willing to do it manually. Free options like Malwarebytes can scan for hijackers if you want a second opinion.
What if I can't find the extension or program that's causing it?
If you've checked extensions and installed programs and still can't find the source, try resetting your browser completely. This erases all extensions and settings and returns your browser to factory defaults. You'll lose saved passwords and bookmarks unless you back them up first, but it will remove the hijacker.
Can I get a hijacker just from visiting a website?
Visiting a website alone usually won't install a hijacker, but a malicious website can try to trick you into downloading something or installing an extension. If a website asks you to "update your browser" or "install a plugin", be skeptical — go to the official website of that software instead and read directly from there.