If your browser suddenly throws ads at you, opens tabs you didn't ask for, or your searches look slightly off, there is a good chance a bad site talked its way into your browser settings. We see this almost daily. Two settings get changed most often:
- The allowed pop-ups list. A site gets added here and is then free to open ad windows whenever it wants.
- The default search engine. A fake "Google" entry gets added and set as default. It looks like Google in the list, but it sends your searches through an ad server first.
You can usually clear both yourself in about ten minutes. Here is how, browser by browser, and then the quick-fix reset at the end. Short version: clean the settings by hand first, then reset the browser if you still want to. Resetting first often doesn't stick, and the reason is explained below.
Step 1: Remove bad sites from the allowed pop-ups list
Google Chrome
- Click the three dots (top right), then Settings.
- Go to Privacy and security, then Site settings.
- Scroll to Pop-ups and redirects.
- Look at the list under "Allowed to send pop-ups and use redirects." Anything you don't recognize, click the three dots next to it and choose Remove.
- While you're in Site settings, also open Notifications and remove anything unfamiliar from the "Allowed to send notifications" list. Fake "click Allow to continue" prompts put sites here, and the result looks like pop-ups too.
Microsoft Edge
- Click the three dots (top right), then Settings.
- Go to Cookies and site permissions, then Pop-ups and redirects.
- Under Allow, click the three dots next to anything you don't recognize and choose Remove.
- Go back one screen and open Notifications. Remove anything unfamiliar from the Allow list there as well.
Mozilla Firefox
- Click the three lines (top right), then Settings.
- Go to Privacy & Security and scroll to Permissions.
- Next to "Block pop-up windows," click Exceptions. Remove anything you don't recognize, then Save Changes.
- Next to Notifications, click Settings and remove anything unfamiliar there too.
Brave
- Same layout as Chrome: Settings, then Privacy and security, then Site and Shields settings, then Pop-ups and redirects. Remove unfamiliar sites from the Allow list, and check Notifications too.
Safari (Mac)
- Safari menu, then Settings, then Websites, then Pop-up Windows. Set any unfamiliar site to Block, or select it and click Remove.
- Check the Notifications section on the same screen as well.
A good rule: if you didn't deliberately tell a site it could show pop-ups, it doesn't belong on the list. Removing a legitimate site by mistake does no harm. The site will simply ask again next time it needs to.
Step 2: Check your default search engine
This is the sneaky one. Open the search engine list and you may see Google listed twice. Both say Google. Both may even have the Google logo. Only one of them is real.
Google Chrome
- Settings, then Search engine, then Manage search engines and site search.
- Look at the Search engines section at the top. Note which one is marked Default.
- For each Google entry, click the three dots next to it and choose Edit. Look at the field labeled "URL with %s in place of query."
- The real Google entry's URL starts with
{google:baseURL}search?q=%s or https://www.google.com/search?q=%s. Nothing else.
- A fake entry will show something different in that field: a name like securesearch, safesearch, or search-something, or a web address followed by a long string of random letters and numbers. If google.com is not the site at the front of that URL, it is not Google.
- Also look for other search engines you didn't add. Google, Bing, and Yahoo are normally there by default. Anything else deserves a look.
Microsoft Edge
- Settings, then Privacy, search, and services. Scroll to the bottom and open Address bar and search, then Manage search engines.
- Same check as Chrome. Click the three dots, then Edit, and read the URL field. Real Google shows
{google:baseURL}search?q=%s. Real Bing shows https://www.bing.com/search?q=%s.
Mozilla Firefox
- Settings, then Search.
- The Default Search Engine dropdown shows what is in use. Below it, the Search Shortcuts list shows every engine installed.
- Firefox's built-in Google can't be edited or renamed, so if you see a second Google that has a Remove button, that second one is the fake. Remove it.
Brave
- Settings, then Search engine, then Manage search engines. Same check as Chrome.
Safari (Mac)
- Safari menu, then Settings, then Search. Make sure the Search engine dropdown says Google (or whichever you prefer). Safari doesn't allow added engines, so if this is wrong, the problem is usually an extension. Check Safari, then Settings, then Extensions.
Once you have identified the real one
- Set the real entry as Default first (three dots, then Make default).
- Then delete the fake one (three dots, then Delete or Remove).
- Do it in that order. If you delete the default entry first, the browser may pick a replacement you don't want.
- If the Delete option is greyed out or missing, or you see "Managed by your organization" at the top of settings on a home computer, the junk has installed a policy and the steps below won't fully clear it. Give us a call.
Step 3: Look for extensions and programs that put it there
The settings above are what cause the pop-ups you are seeing right now. Removing them stops the bleeding. Something usually put them there, though, and it may put them back.
- Open your extensions page (Chrome:
chrome://extensions, Edge: edge://extensions, Firefox: about:addons). Remove anything you don't recognize or don't remember installing. "PDF converter," "coupon finder," "video downloader," and "search protect" style names are frequent offenders.
- In Windows, open Settings, then Apps, then Installed apps. Sort by install date and look at anything added in the last few weeks that you didn't install on purpose. Uninstall it.
- If you're not sure what something is, leave it and ask. Removing a wrong program is a bigger headache than one more day of pop-ups.
The quick fix: reset the browser (but do Steps 1 and 2 first)
Every browser has a reset that puts search, home page, startup pages, and permissions back to factory defaults and turns off extensions. It does not delete bookmarks or saved passwords.
- Chrome and Brave: Settings, then Reset settings, then Restore settings to their original defaults.
- Edge: Settings, then Reset settings, then Restore settings to their default values.
- Firefox: click the three lines, then Help, then More troubleshooting information, then Refresh Firefox.
Here is the catch, and it is why we recommend clearing the bad entries by hand before resetting. If you are signed in to the browser with sync turned on, your settings live in your Google or Microsoft account as well as on the computer. Reset the browser and the junk settings sync right back down the next time it connects, sometimes within minutes. People reset three or four times and think the reset is broken. It isn't. It is doing its job and then being overwritten.
Remove the bad pop-up sites and the fake search engine first. That change syncs up to your account and replaces the bad copy. Then reset if you still want a clean slate.
If the junk keeps returning even after that, check your other computers and your phone. Any device signed in to the same browser account with the same bad settings will keep re-syncing them.
When to call us
- You can't change or delete the search engine (greyed out or "managed by your organization").
- The pop-ups come back within a day of cleaning.
- You see a pop-up claiming your computer is infected and giving you a phone number. That number is not Microsoft, Apple, or us. Close the browser (Ctrl+Shift+Esc, then End task on the browser if it won't close) and call us at the number you already have.
Browser hijacks like this are the most common thing we clean up on home and small-office computers, and they are usually a sign that something else slipped past the antivirus. If you'd rather have it looked at properly, or you want it caught before it starts next time, that is what our managed IT service and our cybersecurity protection are for.
