Adware and browser hijackers are among the most common forms of unwanted software on Windows PCs. They are not always classified as malware by antivirus products, yet they degrade performance, redirect your browsing, inject ads into web pages, and can open the door to more serious infections. Here is how to identify, remove, and prevent them.

How Adware and Browser Hijackers Get Installed

Bundled installers are the primary vector. When you download free software — a PDF converter, video player, download manager, or utility — the installer may include opt-out checkboxes for additional software. Clicking “Next” repeatedly installs the bundle. Common bundlers include OpenCandy, InstallCore, and Amonetize.

Fake Flash Player or codec updates are a classic delivery method. A malicious website displays a popup claiming your Flash Player is out of date. The downloaded file installs adware alongside (or instead of) any legitimate software.

Malvertising serves malicious ads on legitimate websites. Clicking the ad, or sometimes simply loading the page, triggers a drive-by download that places adware without user interaction.

Browser extension stores occasionally contain hijacking extensions that slip through review. Extensions with broad permissions (read and change all your data on all websites) can inject ads and redirect searches.

What They Do

Adware injects advertising into web pages you visit, opens sponsored tabs, displays pop-up windows, or generates revenue by running background processes that click on ads.

Browser hijackers modify your browser settings without clear consent:

Change your default search engine to a low-quality search that earns the hijacker revenue per query
Replace your homepage and new tab page
Install browser extensions that cannot be removed through normal means
Redirect specific searches (e.g., typing “amazon” takes you to an affiliate-tracked URL)

Common families:

Conduit / Search Protect — installs a “community toolbar,” locks homepage and search settings, resists removal
Ask Toolbar — bundled with many Java and Adobe installers historically, hijacks search to ask.com
Babylon Toolbar — multilingual toolbar that redirected searches; difficult to remove due to multiple components
MyWay / MySearch — Mindspark family of hijackers installed via freeware bundles
Superfish / VisualDiscovery — notorious for being pre-installed on Lenovo laptops in 2014–2015, injected HTTPS ads via a rogue CA certificate

Recognizing Infection

You likely have adware or a browser hijacker if:

Your search engine changed without your consent
Your homepage redirects to an unfamiliar page
Pop-up ads appear even on sites you trust
Browser is noticeably slower
You see new toolbars or extensions you didn’t install
Searches on Google redirect through an intermediate URL before landing

Step-by-Step Removal

Step 1: Uninstall Suspicious Programs

Open Control Panel → Programs → Uninstall a program. Sort by install date. Look for anything installed recently that you don’t recognize:

Toolbars with names like “Search Protect,” “Babylon,” “conduit”
“MySearch,” “MyWay,” “Ask Toolbar,” “Mindspark Interactive”
Anything with vague names like “PriceSmart,” “ShopperPro,” “BrowserSafeguard”

Uninstall these entries. Some may resist standard uninstall — proceed to the next steps regardless.

Step 2: Run AdwCleaner

AdwCleaner (by Malwarebytes, free) is purpose-built for adware and PUPs (Potentially Unwanted Programs). It catches items that standard antivirus misses.

Download from malwarebytes.com/adwcleaner (avoid third-party mirrors)
Run as administrator
Click Scan Now
Review the findings — AdwCleaner will show registry keys, folders, browser extensions, and services
Click Quarantine to remove all findings
Restart when prompted

AdwCleaner creates a restore point before cleaning, so you can undo if something legitimate is removed.

Step 3: Run Malwarebytes Free

After AdwCleaner, run a Malwarebytes scan to catch any remaining malware components:

Download from malwarebytes.com (free version is sufficient)
Run a full scan
Quarantine all detections
Restart

Step 4: Reset Browser Settings

Even after removing the adware, browser settings may remain modified. Reset them manually:

Chrome: Settings → Reset and clean up → Restore settings to their original defaults

Firefox: Help → More troubleshooting information → Refresh Firefox

Edge: Settings → Reset settings → Restore settings to their default values

After resetting:

Check installed extensions and remove any you don’t recognize
Verify your default search engine under Settings → Search engine
Check your startup pages

Step 5: Check Scheduled Tasks and Services

Some adware installs scheduled tasks to reinstall itself after removal.

Open Task Scheduler (taskschd.msc) and review Task Scheduler Library. Delete any tasks with suspicious names or that reference unfamiliar executables in AppData or Temp folders.

Also check Services (services.msc) for unfamiliar running services with vague names.

Step 6: Check Browser Shortcuts

Some hijackers modify your browser shortcut to append a URL:

Right-click your Chrome/Firefox/Edge shortcut → Properties → check the Target field. It should end with chrome.exe" or firefox.exe" — nothing after the closing quote. If there’s a URL appended (e.g., chrome.exe" http://malicioussite.com), delete the extra text.

Preventing Reinfection

Use Unchecky (unchecky.com) — automatically unchecks bundled offers in installers
Download from official sources only — avoid download aggregators like Softonic, CNET Download, FileHippo
Read every installer screen — look for pre-checked boxes and custom install options
Use a content blocker (uBlock Origin) — blocks malvertising that drives drive-by downloads
Keep Windows Defender enabled — it now detects many PUPs when “PUA protection” is enabled: Windows Security → Virus & threat protection settings → Reputation-based protection → Potentially unwanted app blocking → On

Adware rarely causes catastrophic damage on its own, but it degrades your experience, wastes resources, and represents a failure of your security posture. Removing it thoroughly and tightening your software hygiene prevents the cycle from repeating.