Skip to content

Latest commit

 

History

History
329 lines (291 loc) · 22.6 KB

fix-browser-problem.md

File metadata and controls

329 lines (291 loc) · 22.6 KB

Fix changes to your browser caused by malware

Now days, it is common for malware to make unwanted modifications to your browser. This guide should help remove a few of the most common types.

Warning: This is a work in progress!

Notice!

This page has been moved to https://iam-py-test.github.io/malware_removal.html

Things not to do

  • Do not use "cleaner" programs to clear browser cache/cookies. These programs may cause problems with your browser. Use your browser settings to clear cookies and cache.
  • Stay aware from scam or low quality malware removal tools, such as SpyHunter, TotalAV, ScanGuard, and PCProtect.

Remove spam notifications

Malicious websites can send you spammy notifications, such as fake warnings about malware:

Revoke the ability to send notifications for all but sites which need it and which you trust:

If that does not work or you want to be sure, clear your browser cache and site data, which should remove the code which is causing these issues.

Clear browser cache and cookies

Warning: This will sign you out of websites

Change search engine and homepage/new tab

Some malware will only change your homepage/new tab or search engine, and will not prevent you from changing it back.
Homepage/new tab:


Search engine:


If your browser says the homepage or search engine is managed by an extension, follow the instructions below to uninstall that extension. If that does not work, try resetting browser sync and removing policies (Windows only).

Uninstall a specific extension

If a specific extension is causing problems, you can uninstall it:

Can not remove an extension:

If you are unsure what extensions to uninstall, see if you have any of the extensions listed below installed, and if so, try uninstalling them. You also can try disabling your extensions one-by-one and seeing which one is causing the problem.

Known malware browser extensions

If installed, I recommend you remove these. However, this is not an exhaustive list.

  • "Browsing Overview by Securify" Changes your search engine to search[.]mysecurify[.]com, which redirects to Bing.

General advice on troubleshooting

Remove a theme

Themes should not be able to do anything bad, and thus are highly unlikely to be malware. However, should you want to remove them, here is how:

Reset browser sync

Many browsers now can sync data between devices. This feature sadly has the side effect of causing unwanted browser changes to reappear, even after being removed. Be aware that clearing your sync data probably will cause some synced data to be lost. Be sure to save any important data (i.e. passwords) securely outside your browser just in case.

How to clear sync data in Edge
  • Open edge://settings
  • Click "Profiles" in the sidebar
  • Click "Sync"
  • Scroll down and click on "Reset sync"
  • You will be prompted to confirm. Click "reset"
  • Edge will reset your sync. It may take a short time for it to setup again (no action from you is needed)
I do not use sync on Firefox, so not sure this will help at all. Deleting your account will clear all data, but probably isn't ideal.

Remove a proxy

A proxy is another computer or software which sits between you and the website you are accessing. There are many legitimate uses for proxies. However, if you do not use one, you may want to check if one has been set by malware:

Reset the HOSTs file

GNU/Linux, Windows, MacOS, and many other operating systems nowdays have a special file called the HOSTs file which lets you tell your computer where to find specific websites. This also means you can tell your computer that a website doesn't exist. Many people use this to block ads, trackers, or malware. However, malware can use this to block websites hosting security software.

After resetting your HOSTs file, reboot your device.

Change your DNS server

Fix problems updating

Fix hijacked shortcuts (Windows)

If your browser keeps opening unwanted websites, it could be that

Method 1

This method will delete and recreate the taskbar shortcut.

  • Right click on your browser's icon in your taskbar
  • Click "Unpin from taskbar":

  • Search for your browser in Windows search or open it via another method (i.e. a desktop shortcut)
  • Once it opens, right click on it's icon in the taskbar and click "Pin to taskbar":

Method 2

This method will clean any shortcuts in your desktop.

  • Right click on the desktop shortcut
  • Click "Properties"

  • Click the "Target" box and delete everything after the name of the browser and the last double-quote:

  • Delete all the selected text. Remember: Do not delete anything before the double-quote and browser name
  • Click "Apply"
  • If you get this error, click "Continue" and accept the UAC prompt if needed
    Dialog box saying 'Access denied. You will need to provide administrator permission to change these settings. Click Continue to complete this operation.' There are two buttons: Continue, and Cancel

Method 3

  • Open the start menu
  • Find your browser
  • Right click on it:

  • Hover over "More" and click "Open file location":

  • Right click on the shortcut (Windows should already select the proper shortcut)

  • Click "Properties"

  • Click the "Target" box and delete everything after the name of the browser and the last double-quote:

  • Delete all the selected text. Remember: Do not delete anything before the double-quote and browser name
  • Click "Apply"
  • If you get this error, click "Continue" and accept the UAC prompt if needed
    Dialog box saying 'Access denied. You will need to provide administrator permission to change these settings. Click Continue to complete this operation.' There are two buttons: Continue, and Cancel

Remove malware from your system

No one malware removal tool can clean a system.

Fix browsers not opening

Remove browser policies (Windows)

Before doing this, close all browsers. Open regedit and delete these keys:

  • Edge (current user):
    • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge
    • HKEY_CURRENT_USER\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge
  • Edge (system) - you will need to run regedit as admin:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
    • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge
  • Chrome (current user):
    • HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome
  • Chrome (system) - you will need to run regedit as admin:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
  • Chrome policy removal tool: https://www.stefanvd.net/project/chrome-policy-remover/ (there is also one for MacOS, but I cannot speak to its safety or effectiveness)
  • Internet Explorer: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer
  • Firefox: HKLM\SOFTWARE\Policies\Mozilla\Firefox

After doing this, restart your browser

Reset your browser

How to reset Edge
  • Go to edge://settings
  • Click "Reset settings" in the sidebar
  • Click "Restore settings to their default values"
  • You will be prompted to confirm. Click "reset"
  • Edge will be reset. All extensions will be disabled, but not uninstalled

Reinstall your browser

Uninstall

Repair Microsoft Edge on Windows

  • Type appwiz.cpl into the Windows search
  • Click on "appwiz.cpl":

  • Scroll down until you see Microsoft Edge:

  • Click on it, then click "Change":

  • Click "repair" and wait

Reinstall

Problems installing

Dealing with aggressive malware

Before continuing, try all the prior steps. This is the "nuclear" option. It will remove most/all data, so be sure you have anything (passwords, bookmarks) backed up. I do not have good guides for all browsers.

Browser security advice

Once you have fixed your issue, it is recommended to take this advice: