Removing Adware and Toolbars That Hijack Your Browser

Adware and unwanted browser toolbars have become a daily nuisance for anyone browsing the web on a Windows machine. They creep in through free downloads, shady extensions, and deceptive installers, then quietly redirect searches, splash pop-ups across the screen, and slow everything down. For many Australians working from home or studying via NBN connections, a sluggish browser can quickly become an expensive productivity drain.

Tackling these infections is rarely a single-click affair, but a methodical approach restores a clean browsing experience and locks the door against repeat offenders. The following guide walks through how to recognise a hijacked browser, where the junk actually comes from, and the safest way to scrub it off a Windows PC without losing bookmarks or saved passwords.

What browser hijackers and adware actually do

Browser hijackers are a strain of unwanted software designed to alter a browser's settings without a user's clear consent. They commonly change the default search engine to something unfamiliar, pin extra toolbars to the top of the window, and force traffic through affiliate links. The end goal is revenue for the developer, often paid per click or per install.

Adware operates in a similar space, but its main job is to display advertising. Pop-up loops, in-text ad highlights, and banners injected into normally clean websites all fall under this category. Both forms of unwanted software frequently travel together in the same installer package, so a single careless download can plant several offenders at once.

In Australia, the ACCC's Scamwatch service regularly receives reports about deceptive software bundled with supposedly free utilities. Some packages even mimic system alerts, claiming the computer is infected and urging the user to "fix" it with yet another piece of bundled software. These tactics fall foul of Australian consumer law, which makes ongoing education just as important as any technical cleanup.

Warning signs that your browser has been compromised

A hijacked browser usually shows clear behavioural changes long before the user bothers to look at any list of installed programs. The homepage may suddenly point to an unfamiliar search portal, and typing a URL into the address bar might reroute through a third-party domain. New tabs open by themselves, often pointing to sketchy shopping pages or fake prize draws.

Searches return results that look vaguely right but include sponsored links at the top and a strangely rewritten URL structure. Performance drops sharply as well — pages take noticeably longer to render, fans spin up during what should be light browsing, and CPU usage in Task Manager stays elevated even when no tabs are open.

For Australians using slower NBN plans at the edge of the coverage map, any tool that quietly burns bandwidth can feel like a real budget problem. If data usage on a typical month spikes without explanation, it is worth checking whether background processes are phoning home. Telstra, Optus, and TPG all provide detailed usage dashboards that make unusual patterns easy to spot.

How adware and toolbars end up on a clean PC

The classic infection path runs through software bundling. Free utilities such as PDF readers, video converters, and system "optimisers" frequently arrive with a pre-checked box that installs extra toolbars or sets a new default search engine. Users who click through an installer too quickly, especially when tired after a long arvo at work, often agree to far more than they intended.

Another common entry point is the pre-installed software that ships on budget laptops from retailers like JB Hi-Fi and Harvey Norman. These trial versions of antivirus tools, "PC cleaners," and shopping assistants are not outright malware, but they consume resources and clutter the browser with extensions from day one.

Browser extensions themselves are a quiet culprit. A colourful weather toolbar, a supposed speed booster, or a coupon finder can request permissions that go well beyond what the name suggests. Once granted, these extensions read every page visited, rewrite links, and inject ads directly into search results. Public Wi-Fi at Westfield centres, suburban cafes, and library hotspots compounds the risk, since a compromised network can serve malicious pop-ups that trigger automatic downloads.

Step-by-step removal process

Start by closing every browser window and opening the Control Panel, then head to Programs and Features (or, on Windows 11, Settings → Apps → Installed apps). Sort by install date and look for anything unfamiliar installed in the past few weeks. Uninstall the suspicious entries first, but skip anything you cannot confidently identify to avoid breaking drivers or security software.

Next, launch each installed browser — Chrome, Edge, Firefox — and reset the homepage, default search engine, and startup behaviour to the values actually wanted. Remove every extension that was not installed personally, paying particular attention to tools with names such as "SearchAssist," "ShopSmart," or "SpeedBoost." Restart the computer before continuing.

Once the obvious surface is clean, run a full scan with a reputable on-demand scanner. Tools such as Malwarebytes AdwCleaner, ESET Online Scanner, and the Microsoft Malicious Software Removal Tool are freely available for Australian users and target the registry entries and scheduled tasks that manual cleanup misses. A final reboot, followed by another quick scan, confirms that nothing has re-spawned.

If problems persist after these steps, the hijacker may have planted itself in a restore point or scheduled task. Booting into Safe Mode with Networking prevents most startup items from loading and gives the scanner a much cleaner environment in which to operate.

Trusted tools and resources for Australian users

Several well-regarded utilities serve Australian households very well. Malwarebytes, Bitdefender, and Trend Micro all maintain local sales and support operations, which makes renewing a subscription or downloading a fresh installer straightforward. The Australian Cyber Security Centre (ACSC) publishes free guidance on its cyber.gov.au portal, including step-by-step removal playbooks for common hijackers.

For readers who prefer independent testing, CHOICE magazine runs regular reviews of security software and flags any products that behave like adware themselves. The combination of one real-time antivirus, one on-demand scanner, and an ad-blocker such as uBlock Origin covers most everyday threats without slowing a typical NBN connection.

When the cleanup feels overwhelming, a professional remote-support service can take over for a flat fee and often resolves complex infections within the hour. Movian Security, for example, provides remote troubleshooting for Windows machines across the country, including full browser restoration and post-cleanup hardening.

Building habits that keep the browser clean

A clean removal is only worth the effort if the same hijacker does not return a week later. Treat every installer as suspicious, especially free downloads reached through search results rather than from the developer's official site. Always choose the custom or advanced install option and uncheck anything that promises a "better search experience" or asks to set a new homepage.

Keep browsers updated and let the operating system apply its own security patches on the usual schedule. Enable Click-to-Play for plugins, disable third-party cookies where practical, and review the extension list once a month, the same way a smoke alarm battery gets checked when the clocks change across New South Wales, Victoria, or South Australia.

Finally, back up important files to an external drive that stays disconnected from the PC. If a particularly nasty hijacker ever breaks the operating system entirely, a clean reinstall plus a fresh copy of personal documents is far faster than untangling a poisoned system byte by byte.