A browser that suddenly opens unfamiliar pages, changes its search engine, or displays repeated security-themed pop-ups can be frustrating. These symptoms do not automatically mean your computer has a virus. The cause could be an unwanted browser extension, a website allowed to send notifications, changed browser settings, adware, or simply a deceptive webpage you happened to visit.
Fake “virus alert” pages are particularly confusing because they may be designed to resemble security software or operating-system messages. A normal website does not have unrestricted access to scan your entire computer for malware merely because you visited it. Treat unexpected warnings that demand a phone call, payment, download, or remote access with caution.
This guide explains how to remove a browser hijacker or other unwanted browser behavior using normal defensive tools in Chrome, Microsoft Edge, Safari, Windows, macOS, Android, and iPhone/iPad. Start with the least disruptive steps and move to resets or malware scans only when necessary.
Quick Takeaways
- Do not call a phone number, install software, send payment, or grant remote access because an unexpected browser page says your device is infected.
- Repeated alerts may come from website notification permission rather than malware installed on the device.
- Remove malicious extensions—or simply unfamiliar and unnecessary extensions—from your browser after checking what they are.
- Review the browser’s search engine, startup pages, homepage, site permissions, and notification settings.
- Chrome and Edge provide reset options that can restore many settings without deleting your personal files.
- On Windows, use Windows Security/Microsoft Defender for a defensive malware scan if you suspect adware or other unwanted software.
- Keep the browser and operating system updated after cleanup.
- If you entered a password, payment information, or other sensitive data into a suspicious site, account and financial safeguards may be more important than browser cleanup alone.
What Is a Browser Hijacker?
“Browser hijacker” is a broad term for unwanted software or browser changes that alter the way a browser behaves.
Signs may include an unfamiliar search engine, an unwanted homepage, repeated redirects, new tabs that open without an obvious reason, or an extension you did not intend to keep.
Not every unusual browser behavior is a hijacker. For example, a site you previously authorized may be sending legitimate browser notifications that have since become unwanted. A browser update may change part of its interface. An organization may also intentionally control some browser settings on a work or school device.
It helps to identify the likely cause before resetting or uninstalling anything.
| Symptom | Possible cause | Good first step |
|---|---|---|
| Alerts appear even when you are on other sites | Website notification permission | Review notification permissions |
| Search engine changed | Extension or changed browser setting | Check extensions and search settings |
| Browser opens unwanted pages at startup | Startup-page setting or extension | Review startup settings |
| One particular site shows a fake security warning | Deceptive webpage or ad | Close the page; do not follow its instructions |
| Unfamiliar toolbar or extension appears | Unwanted extension/software | Review and remove unnecessary extensions |
| Redirects happen on many unrelated sites | Extension, software, settings, or other issue | Review extensions, update, then scan if needed |
| Alerts appear outside the browser | OS notifications or installed application | Check system notifications and installed apps |
| Settings say they are managed | Work/school management or software policy | Identify the manager before changing anything |
This distinction matters because deleting all cookies, for example, will not remove a browser extension. Running an antivirus scan will not necessarily revoke a website’s notification permission.
First: Do Not Interact With a Fake “Virus Alert”
A typical scam pop-up warning uses urgency. It may claim that multiple viruses were found, that your data is at immediate risk, or that you must call “support” right away.
The goal may be to persuade you to install unwanted software, disclose account details, purchase unnecessary services, or allow remote access.
Do not assume the claim is genuine merely because the page:
- Uses the name or logo of a familiar technology company
- Plays an alarm sound
- Displays a countdown
- Shows an IP address
- Knows your approximate location
- Uses full-screen mode
- Includes technical-looking error codes
Websites can know some ordinary technical information about visitors, such as an IP address and browser type. That does not demonstrate that the site has scanned the computer.
Safely close the page
Try to close the browser tab or window normally.
If the page keeps opening dialogs or prevents ordinary navigation, avoid clicking buttons inside the webpage. Instead, close the browser using the operating system’s normal controls. If necessary, use Windows Task Manager or macOS’s Force Quit interface to close the browser application.
Reopen the browser without restoring the suspicious tab if the browser gives you that choice.
Do not revisit the page simply to determine whether the warning appears again.
Step 1: Check Browser Notification Permissions
Website notifications are one of the most common explanations for security-themed alerts that continue after someone has left a website.
A site can usually send browser notifications only after permission has been granted. This can happen accidentally when a page says something misleading such as “Click Allow to continue.”
If notification spam is the problem, removing the site’s permission may stop it without a complete browser reset.
Stop notification spam in Chrome
On desktop Chrome:
- Open Chrome Settings.
- Select Privacy and security.
- Open Site settings.
- Find Notifications.
- Review sites that are allowed to send notifications.
- Remove or block permissions for sites you do not recognize, trust, or want.
Google can reorganize menu paths, so search Chrome Settings for “notifications” if necessary.
Do not block a site simply because its name is unfamiliar if you use a work or specialized application that depends on it. When uncertain, investigate the domain independently first.
Stop notification spam in Microsoft Edge
In Edge:
- Open Settings.
- Search for “notifications.”
- Open the applicable site-permission settings.
- Review the Allow list.
- Remove or block unwanted sites.
You can also decide whether you want future websites to ask for notification permission.
Stop unwanted Safari notifications
On a Mac:
- Open Safari.
- Open Safari > Settings.
- Select Websites.
- Select Notifications.
- Review sites that have notification access.
- Deny or remove permissions you no longer want.
macOS itself also controls notifications. Open System Settings and search for Notifications if you need to control Safari’s system-level alerts.
Chrome on Android
On Android, notification behavior can involve both Chrome’s website permissions and Android’s app-notification settings.
In Chrome, search Settings for Site settings and Notifications. You can also open Android Settings, find Chrome under Apps, and review its notification controls.
Menu paths differ among Android manufacturers.
Safari on iPhone and iPad
On iPhone and iPad, website and web-app behavior is more tightly connected to Apple’s system controls. Search Settings for Safari, Notifications, and the relevant app or website feature.
If an alert is actually a calendar event rather than a browser notification, review the Calendar app and your subscribed calendars instead of installing a supposed malware-removal tool.
Step 2: Remove Malicious or Unwanted Extensions
Extensions add functions to browsers. Legitimate extensions can manage passwords, improve accessibility, block unwanted content, or integrate with workplace services.
Extensions can also receive substantial browser permissions. An unwanted extension may change search behavior, alter pages, or create redirects.
The goal is not to assume every unfamiliar extension is malicious. Review what is installed and remove items you do not need or cannot verify.
Remove extensions from Chrome
- Open Chrome.
- Open the three-dot menu.
- Select Extensions, then Manage Extensions, or open the extensions management page through Chrome’s menus.
- Review each installed extension.
- Remove extensions you no longer use or that you determine are unwanted.
- Restart Chrome.
Pay particular attention to extensions installed around the time the unwanted behavior started.
If you recognize an extension but do not understand why it needs broad access to websites, check the developer’s official documentation.
Remove extensions from Edge
- Open Edge.
- Open the three-dot menu.
- Select Extensions.
- Select Manage extensions.
- Review the installed list.
- Remove unwanted or unnecessary extensions.
- Restart Edge.
Remove Safari extensions
On a Mac:
- Open Safari.
- Select Safari > Settings.
- Open Extensions.
- Review installed extensions.
- Uninstall or disable ones you no longer need.
Some Safari extensions are associated with installed Mac applications. If Safari directs you to remove the underlying application, use the application’s normal uninstall process.
Avoid installing a new “extension cleaner” just to remove another extension.
Step 3: Check the Default Search Engine
A changed search engine is a common browser-hijacker symptom, although changes can also happen because of ordinary browser configuration or software installation.
Chrome
Search Chrome Settings for “Search engine.” Confirm that the default search provider is one you intentionally selected.
Review the available search engines and site-search entries where appropriate.
Edge
Search Edge Settings for “address bar and search” or “search engine.” Confirm the selected provider.
Safari
On a Mac, open Safari > Settings and locate Search. Check that the selected search engine matches your preference.
If the setting changes back after you correct it, an extension, installed application, synchronization setting, or management policy may be controlling it. Continue with the next steps rather than repeatedly changing the same option.
Step 4: Check Startup Pages, Homepages, and New Tabs
Unwanted pages can be configured to open automatically when your browser starts.
In Chrome, search Settings for “On startup.” Remove unwanted pages and select the startup behavior you prefer.
In Edge, search Settings for startup, home, and new-tab settings. Review any pages configured to open automatically.
In Safari, review General settings for your homepage and behavior for new windows and tabs.
A custom homepage is not inherently unsafe. The goal is to remove entries that you did not intend to configure.
Step 5: Clear Problematic Site Data and Cookies
Cookies and other website storage can maintain sessions and preferences. Clearing data for a troublesome site can sometimes fix persistent redirects or unwanted website behavior.
It is usually better to start with the affected site rather than delete every cookie.
Chrome and Edge
Open Privacy settings and search for site data or browsing data. The browsers provide options to remove data associated with individual sites or clear broader categories of browsing information.
Safari
On Mac, Safari’s Privacy settings include controls for managing stored website data.
On iPhone and iPad, search Settings for Safari’s history and website-data controls.
What clearing cookies does not do
Clearing cookies is not a malware scan.
It generally will not remove an installed browser extension, uninstall unwanted software, patch your browser, or change a compromised account password.
It may also sign you out of websites. Make sure you know how to regain access to important accounts before deleting broad categories of data.
Step 6: Update the Browser and Operating System
Security updates can correct browser or operating-system vulnerabilities and update security protections.
Chrome
Open:
Chrome menu > Help > About Google Chrome
Allow updates to install and restart Chrome when needed.
Edge
Open:
Edge menu > Help and feedback > About Microsoft Edge
Install available updates and restart.
Safari and macOS
Safari updates are closely tied to Apple’s operating-system update mechanisms on supported platforms.
On Mac:
System Settings > General > Software Update
On iPhone and iPad:
Settings > General > Software Update
Windows
Open:
Settings > Windows Update
Install applicable security and quality updates and restart if required.
Keeping an unsupported operating system indefinitely is not a good substitute for security maintenance. Check Microsoft, Apple, Google, or your device manufacturer for current support information.
Step 7: Run a Security Scan If You Suspect Unwanted Software
If redirects continue after you remove unwanted extensions and permissions, or you notice suspicious software outside the browser, a defensive malware scan is reasonable.
Windows adware cleanup with Windows Security
Windows includes Microsoft Defender Antivirus through Windows Security.
On Windows 11:
- Search Start for “Windows Security.”
- Open Virus & threat protection.
- Check that protection is active and security intelligence is current.
- Select Scan options if available.
- Begin with a Quick scan.
- Follow Windows Security’s recommendations if it identifies an item requiring attention.
If you continue to suspect a problem, a Full scan can examine more files and typically takes longer.
Microsoft also provides Defender Offline for certain situations. It restarts the PC and performs a scan outside the usual Windows environment. Save your work and follow Microsoft’s displayed instructions, including any relevant device-encryption recovery considerations.
Do not download a random “antivirus” from the same pop-up that claimed your computer was infected.
macOS
macOS contains built-in security technologies including XProtect and Gatekeeper. Keep macOS updated so built-in protections receive applicable updates.
If you use third-party antivirus, obtain it from a reputable security vendor’s official source.
If unexplained behavior persists across multiple browsers or applications, Apple Support or a reputable technical-support provider can help determine whether the problem involves unwanted software, configuration, or another cause.
Step 8: Uninstall Unwanted Applications
A browser problem sometimes originates from software installed on the operating system rather than the browser itself.
Do not remove applications at random. Focus on programs you do not recognize, intentionally install, or need.
Windows
Open Windows Settings and search for Installed apps or Apps.
Review recently installed programs. If you identify software you do not want, use Windows’ normal uninstall option.
Be careful with hardware utilities, drivers, workplace software, and components installed by your device manufacturer. An unfamiliar name is not evidence that software is malicious.
macOS
Review the Applications folder and System Settings where relevant. Uninstall applications according to the developer’s official instructions.
Avoid manually deleting random files from macOS system folders based on generic online lists.
Step 9: Reset Chrome or Edge Settings If Necessary
If ordinary cleanup does not solve the problem, resetting browser settings can be useful.
A reset is more disruptive than removing one notification permission or extension, so it is better as a later step.
Reset Chrome settings
On desktop Chrome:
- Open Settings.
- Search for “Reset settings.”
- Choose the option to restore settings to their original defaults.
- Read Chrome’s explanation of what will change.
- Confirm only if you want to proceed.
- Restart and review the browser afterward.
Google states that resetting Chrome can restore items such as startup pages, new-tab behavior, search engine settings, and pinned tabs, and can disable extensions. The exact effects may evolve, so read the current confirmation screen.
A settings reset is not the same as erasing every personal file on your computer.
Reset Microsoft Edge
Edge also provides a Reset settings section.
- Open Edge Settings.
- Search for “Reset settings.”
- Select the restore-to-defaults option.
- Review the displayed explanation carefully.
- Confirm if appropriate.
- Restart Edge and check the result.
A browser reset does not necessarily remove unwanted software installed elsewhere on the computer. If settings become altered again, investigate installed applications and device management.
What about Safari?
Safari does not necessarily provide the same one-button reset workflow as Chrome or Edge.
Instead, review extensions, website data, homepage/search settings, notifications, and other website permissions individually. Apple’s current Safari documentation provides the appropriate controls for your macOS release.
Step 10: Check Whether the Browser Is Managed
Chrome and Edge can be managed using policies. This is normal on many business and school computers.
If your browser reports that it is “managed by your organization,” do not assume that message proves malware is present.
On an employer- or school-owned machine, management is likely intentional. Contact the organization’s IT department before modifying or removing anything.
On a personally owned computer that should not be managed, unexpected persistent browser policies deserve investigation. Check whether security software, parental controls, or another application you knowingly installed provides browser management.
If you cannot identify the source, contact the browser vendor’s official support resources or a reputable technician rather than deleting obscure system files or policies yourself.
If the Fake Alert Asked You to Call a Phone Number
FTC guidance warns about tech-support scams in which someone claims there is an urgent computer problem and asks for payment, personal information, or remote access.
If you see an unexpected pop-up telling you to call technical support, do not use the number displayed in the pop-up.
If you need Microsoft, Apple, Google, or another company’s support, independently navigate to that company’s official support site.
Legitimate companies have their own support processes. A browser page’s claim that you must immediately call the number it supplies should not be your method of verifying that claim.
If You Already Installed Remote-Access Software
Remote-access applications have legitimate uses. Businesses and support providers use them every day. The concern is an unexpected person persuading you to install one and then gaining control of your computer.
If you granted remote access to someone you do not trust:
- End the remote session and close the application.
- Disconnect the device from the network temporarily if you believe the person still has active access.
- Uninstall remote-access software you do not need using the operating system’s normal uninstall process.
- From a device you trust, review important account activity and change passwords that may have been exposed.
- Enable available multifactor authentication.
- Run the operating system’s appropriate security scan and install updates.
- If financial information was involved, contact the financial institution through an independently verified channel.
Do not rely on the same caller to “clean up” the situation.
If you are unsure what was changed during a remote session, professional assistance may be appropriate.
If You Entered a Password Into a Suspicious Page
Browser cleanup does not change a password you may have disclosed.
From a device you trust, navigate directly to the legitimate service and change the affected password. If you reused that password on other accounts, replace those reused passwords as well, using unique credentials.
Review the service’s account activity and signed-in devices where available. Enable multifactor authentication or supported passwordless options such as passkeys when appropriate.
Two-factor authentication reduces account-takeover risk but is not perfect. Do not approve an unexpected authentication request or give an unsolicited caller a one-time verification code.
If the affected account is your email account, prioritize it. Email can often be used to reset credentials for many other services.
If You Entered Payment or Banking Information
If you provided card or banking information to a suspicious website or caller, contact the relevant bank or card issuer through the number printed on your card, statement, or its independently verified official website.
Explain what happened and follow the institution’s fraud procedures.
Avoid numbers supplied by the suspicious webpage or caller.
If you suspect identity theft in the United States, the Federal Trade Commission’s IdentityTheft.gov provides official recovery guidance and personalized steps. This article provides general cybersecurity information, not legal or financial advice.
A Safe Cleanup Order
If you are unsure where to begin, use this sequence. It starts with narrow browser changes before moving to broader cleanup:
- Close the suspicious page without calling, downloading, paying, or granting access.
- Update the browser and operating system.
- Review browser notification permissions and remove unwanted sites.
- Review and remove unnecessary or unwanted extensions.
- Check the homepage, startup pages, new-tab settings, and default search engine.
- Clear data for troublesome sites if appropriate.
- Review installed applications if behavior continues outside the browser.
- Run the operating system’s built-in or another reputable security scan when appropriate.
- Reset Chrome or Edge settings if simpler steps do not fix persistent changes.
- Secure affected accounts separately if you disclosed credentials or financial information.
After each major step, reopen the browser and see whether the problem is resolved. That approach can help identify the actual cause without unnecessarily changing everything.
Special Notes for Android
On Android, repeated browser alerts often involve website notifications or application notifications.
Keep Android and Chrome or your preferred browser updated. Review the browser’s Site settings for notifications and pop-ups, then check Android’s Apps and Notifications settings.
If unexpected behavior continues outside the browser, review recently installed apps. Google Play Protect can help check applications on supported Android devices; access it through the Google Play Store’s normal security controls.
Avoid installing an unfamiliar “phone cleaner” because an advertisement says your device has a virus.
If the problem involves a specific Android manufacturer, use the manufacturer’s official support documentation because menu paths and security features vary by device.
Special Notes for iPhone and iPad
An alarming webpage on an iPhone does not, by itself, establish that iOS is infected.
Close the suspicious browser tab. Keep iOS or iPadOS current under Settings > General > Software Update.
If Safari behaves unexpectedly, review Safari website data and browser settings. Check device notifications and remove unwanted website or web-app permissions where applicable.
Unexpected calendar entries can have a different cause than browser pop-ups. If repeated spam appears specifically in Calendar, review your accounts and subscribed calendars using Apple’s current support instructions. Do not interact with links contained in suspicious calendar entries.
Also review any VPN or device-management settings that you knowingly use. An employer or school may legitimately manage a device. If an unfamiliar management configuration appears on a personally owned device and you cannot explain it, contact Apple Support for guidance rather than randomly deleting system configuration.
Special Notes for Mac
Safari, Chrome, and Edge can all run on macOS, so browser cleanup principles remain similar: remove unwanted extensions, review notifications and site permissions, check search and startup settings, and update the browser.
Also keep macOS updated. Apple’s security architecture includes Gatekeeper, XProtect, and other built-in protections.
If Safari or another browser repeatedly changes after you correct it, check installed applications and relevant Privacy & Security permissions. Do not disable Gatekeeper or other Mac protections because a webpage says doing so is required for cleanup.
Common Mistakes to Avoid
Do not call the support number displayed in an unexpected virus pop-up. Independently locate official support information instead.
Avoid granting remote access to an unsolicited caller or someone who contacted you unexpectedly about a supposed computer problem.
Do not install the “cleaner,” browser update, security extension, or antivirus advertised by the suspicious page.
Avoid disabling Safe Browsing, Microsoft Defender SmartScreen, Microsoft Defender Antivirus, Gatekeeper, or other security controls to make an unknown download run.
Do not assume every pop-up means your computer has malware. Notification permissions, ordinary advertisements, or a single deceptive webpage may explain the behavior.
Avoid deleting unfamiliar Windows or macOS system files. An unfamiliar filename is not evidence of malware, and removing important system components can damage the operating system.
Do not change a password by clicking a link in the same suspicious alert. Navigate to the real service independently.
Finally, do not assume that clearing cookies fixes everything. It can remove website data but does not replace extension cleanup, application review, security scans, or account recovery.
FAQ
How can I tell whether a virus alert is fake?
Be cautious when an unexpected webpage claims to have scanned your computer and demands immediate action, a phone call, payment, remote access, or a download.
A standard webpage does not have unrestricted access to scan all files on your device. If you genuinely want to check for malware, use your operating system’s security tools or security software you independently obtained from a reputable source.
Why do virus warnings appear even when my browser is closed?
They may be notifications previously authorized through the browser but delivered using the operating system’s notification system. Another application could also be generating them.
Review browser site-notification permissions and your operating system’s notification settings. Do not assume the alerts establish that malware is installed.
How do I remove a browser hijacker from Chrome?
Start by updating Chrome, removing unwanted notification permissions and extensions, and checking the search engine and startup settings. Clear problematic site data if necessary.
If changes continue, scan the operating system for unwanted software and consider Chrome’s built-in Reset settings option.
Will resetting Chrome delete my bookmarks and passwords?
Google’s reset feature is designed to reset certain Chrome settings rather than act as a complete deletion of all personal browser data. However, the exact effects of reset and sync behavior can change.
Read the confirmation screen before proceeding, make sure important information is synchronized or backed up appropriately, and consult Google’s current documentation if you have important locally stored data.
Can deleting cookies remove a browser hijacker?
Usually not if the problem is an extension or installed software.
Deleting cookies may resolve behavior caused by stored site data and can sign you out of websites, but extensions, notification permissions, applications, and browser settings are separate.
Are repeated browser redirects proof of malware?
No. Redirects can be caused by normal websites, advertising systems, notification interactions, changed settings, extensions, or unwanted software.
If redirects happen repeatedly across unrelated trusted sites, further investigation is sensible.
Is Microsoft Defender useful for Windows adware cleanup?
Microsoft Defender Antivirus and Windows Security provide built-in Windows malware protection and can detect many unwanted or malicious programs. Keep protection and security intelligence current and use Windows Security’s scan options when appropriate.
No antivirus program can guarantee detection of every unwanted application.
Should I uninstall every extension?
Usually not. Legitimate extensions can provide useful functions.
Remove extensions you no longer need or have determined are unwanted. Keeping fewer extensions can also reduce unnecessary permissions and make troubleshooting easier.
Should I pay someone who says they removed a virus remotely?
Be cautious with unsolicited technical-support offers. The FTC recommends avoiding unexpected callers or pop-ups claiming your computer urgently needs repair.
If you want professional help, independently choose a reputable service provider rather than relying on a person or number presented by the suspicious alert.
Can an iPhone or Android phone get fake virus pop-ups?
Yes. A deceptive webpage can be displayed by a mobile browser regardless of whether malware is installed.
Android and iPhone/iPad also have notification and website-permission systems that can produce recurring alerts. Close suspicious pages, review permissions, and update the device rather than assuming an alert’s claims are accurate.
When to Get Extra Help
Consider professional help if unwanted browser behavior persists after updates, permission cleanup, extension removal, a reputable security scan, and browser reset. Use the device manufacturer, browser vendor, employer or school IT department, or another reputable support provider whose contact information you find independently.
If you suspect someone accessed an important online account, use that provider’s official security and account-recovery process. For work accounts, notify your organization’s IT or security team promptly.
If you disclosed card or banking information or see a transaction you do not recognize, contact the financial institution through a trusted channel such as the phone number printed on your card. Follow its fraud procedures.
For suspected identity theft in the United States, use the FTC’s IdentityTheft.gov. Its guidance can help create a recovery plan. This is general information and not legal or financial advice.
If a situation involves threats to personal safety, extortion, or potentially criminal conduct, consider contacting the appropriate local authorities. Preserve relevant legitimate records rather than continuing to communicate with a suspicious caller.
Conclusion: A Browser Hijacker Cleanup Checklist
Removing unwanted browser behavior is often simpler when you identify its source instead of assuming every warning means an infection.
Start by closing suspicious pages and refusing requests for payments, downloads, or remote access. Then stop notification spam, remove malicious or unnecessary extensions, review search and startup settings, update the browser, and clear problematic site data.
If the behavior persists, review installed software, run an appropriate security scan, and consider resetting Chrome or Edge settings. If you entered passwords or financial details, secure those accounts separately—the browser cleanup does not undo information that has already been submitted.
Above all, verify security claims through tools and support channels you reach independently. An alarming webpage should never be your only source for deciding what is wrong with your device.