Pop-ups, new toolbars and settings that changed on their own
Browsers are where most people's security questions actually arise, because the browser is where most of the day happens. The changes people notice — a different search engine, a toolbar nobody added, alerts arriving at odd hours, a page that fills the screen and will not close — have a short list of explanations between them, and almost all of them are fixable in the browser's own settings in under ten minutes. Nothing on this page needs a download.
The word used for most of this is adware, or more precisely a potentially unwanted program: software that is not quite malicious but changes things you did not ask it to change, usually to route your searches somewhere that pays for them. It typically arrives alongside something you installed deliberately, which is why people are certain they never installed it.
My homepage and search engine changed by themselves. Why?
Something installed on the computer or added to the browser changed them. The usual source is an extra that was bundled with a free download and accepted in the installer. Removing the extension and resetting the search setting fixes it, and both are free.
How it usually happens
Free software is frequently distributed through installers that offer additional components, pre-ticked, on a screen most people pass through quickly. Accepting those offers installs an extension or a small application whose purpose is to route searches through a particular engine. The same effect comes from extensions added directly in the browser's store under names like coupon finders, video downloaders or PDF converters.
A changed homepage is the visible symptom. The less visible one is that your searches, and sometimes your browsing, are passing through something you did not choose.
What to do, in order, at no cost
- Open the browser's extensions page and read the whole list. Remove anything you do not remember adding or cannot explain the purpose of.
- Go to the browser's search settings, set your preferred engine as the default, and remove the unwanted one from the list of available engines.
- Set the homepage and the start-up pages back to what you want.
- Check the computer's installed programs list for anything added around the date the change appeared, and uninstall it.
- Check the browser shortcut on your desktop or taskbar: a web address appended after the program name in its properties will override the homepage every time. Remove anything after the closing quotation mark.
- Restart the browser and confirm the settings held. If they revert, something is still installed, and the reset question below is the next step.
What to watch out for next time
Choose the custom or advanced option in installers rather than the recommended one, and read each screen before continuing. That single habit prevents most of these changes. Download software from the developer's own site or an official store rather than from a download portal that wraps it in its own installer.
Where a paid product comes into it
Security products detect many of these bundled extras and offer to remove them, which saves some of the manual work above. They do not prevent you accepting an offer in an installer. The free steps work, and are worth doing first.
Why do alerts keep appearing even when my browser is closed?
A website was granted permission to send notifications at some point, and it is using it. Withdrawing the permission in the browser's site settings stops it immediately. Nothing is installed on the computer and nothing needs scanning.
Where the permission came from
Browsers let sites ask to send notifications, the same mechanism a messaging service uses legitimately. Some sites ask on arrival, often with wording suggesting the prompt must be accepted to continue, to prove you are not a robot, or to play a video. Accepting once is enough. The notifications then appear through the operating system, which is why they continue to arrive when no browser window is visible — a background process is still running.
The content is often alarming on purpose, because alarm produces clicks. Treat the notification itself as advertising, not as information about your computer.
What to do, at no cost
- In Chrome or Edge, open Settings, then Privacy and security, then Site settings, then Notifications. Review the list of sites allowed to send them and remove the ones you did not intend.
- In Firefox, open Settings, then Privacy & Security, and use the Settings button beside Notifications.
- In Safari, open Settings, then Websites, then Notifications, and set unwanted sites to Deny.
- While you are there, set the browser to block new notification requests by default so you are not asked again.
- Never click the notification itself to make it stop. Use the browser's settings instead.
Where a paid product comes into it
Nowhere. This is a browser permission, not software on the machine, and no subscription removes it for you.
A full-screen page says my computer has a problem and gives a phone number. What is it?
It is a web page designed to look like a system message. It cannot see anything about your computer. Close the browser — force-quit it if the page resists — and do not call the number.
Why these pages are convincing
A web page can fill the screen, play a sound, imitate the visual style of an operating system dialog, and prevent the normal close button from responding by repeatedly opening new prompts. None of that requires any access to your machine, and none of it reflects anything the page has detected. The phone number is the point: the page exists to get you to call someone who will ask for remote access to the computer and then for payment.
Operating system and browser vendors do not display phone numbers in error messages, and no legitimate security warning asks you to telephone anyone.
What to do, at no cost
- Do not call the number, and do not use any chat window on the page.
- Close the browser entirely. On Windows, use Task Manager to end the browser process; on macOS, use Force Quit from the Apple menu.
- Reopen the browser and decline any offer to restore the previous session, which would reload the same page.
- Clear the browser cache if the page reappears, and check the notifications list described above.
- If you did call and gave someone access to your screen, follow the steps on the suspicious links page, starting with disconnecting from the network.
Reporting it
These approaches can be reported to Scamwatch, which collects information about scams operating in Australia. If money was paid or remote access was granted, a report to ReportCyber through the Australian Cyber Security Centre is the appropriate route.
How do I tell which browser extensions are safe to keep?
Keep the ones you actively use and can name the purpose of. Look at what each extension is permitted to do, and be sceptical of any that can read and change data on every site without a clear reason to.
What to look at
| Question | What the answer tells you |
|---|---|
| Do you use it, and when did you last use it? | Unused extensions carry their permissions for no benefit. Remove them. |
| Did you install it deliberately? | Extensions you cannot account for are the ones most likely to have arrived bundled. |
| What permissions does it hold? | Reading and changing data on all sites is a broad permission. A tool that only needs to work on one site should not hold it. |
| Has it changed hands? | Established extensions are sometimes sold, and the new owner's purposes may differ. A sudden change in behaviour is the signal. |
| Does it duplicate something the browser now does? | Browsers have absorbed many functions extensions once provided. Fewer extensions is simpler and faster. |
What to do, at no cost
Work down your extensions list once and disable rather than remove anything you are unsure of. Use the browser for a week. Anything you did not miss can be removed permanently. Disabling is reversible, which makes this a low-risk way to find out what you actually rely on.
Where a paid product comes into it
Some security subscriptions include a browser extension of their own, usually offering warnings about known imitation sites. That is a legitimate use of the mechanism, but it is worth being aware that it too holds broad permissions, and worth deciding deliberately whether you want it rather than accepting it because it came with the subscription.
Visit the Norton AntiVirus Plus website for the vendor's description of the components included with the subscription.
Paid affiliate link. ORYNA s.r.o. earns a commission on sales made through it. Your price does not change.How do I put my browser back the way it was?
Every major browser has a reset option that returns settings, search engines, start-up pages and extensions to their defaults while keeping your bookmarks and saved passwords. It is the right move when individual changes will not stay fixed.
What a reset does and does not touch
A reset clears the settings that unwanted software changes: homepage, search engine, new tab page, pinned tabs, extensions and site permissions. It generally keeps bookmarks, history and saved passwords, though the exact behaviour differs slightly between browsers, so it is worth confirming in your browser's own help pages before you proceed.
What a reset does not do is remove a program installed on the computer. If the same changes return after a reset and a restart, the source is an application rather than the browser, and the installed programs list is where to look.
What to do, in order
- Sign in to the browser's sync account first if you use one, or export your bookmarks to a file, so nothing depends on the reset behaving as expected.
- Find the reset option: Chrome and Edge place it under Settings, in a Reset settings section; Firefox offers a refresh option on its troubleshooting information page; Safari requires clearing website data and removing extensions individually.
- Reset, then restart the computer rather than only the browser.
- Re-add only the extensions you genuinely use, one at a time.
- If the unwanted change returns, uninstall recently added applications and run a full scan with your security software.
The computer is shared with children and keeps collecting new software. What can I do?
Use a separate standard account for each person rather than one shared administrator account. On a standard account, installing software requires an administrator password, which removes most of the problem without any monitoring or argument.
Why separate accounts help
Most unwanted software on a family computer arrives through installers accepted while looking for a game, a mod, a wallpaper or a free tool. A standard account cannot complete those installations without an administrator approving them, which turns an invisible problem into a conversation. Separate accounts also keep browser extensions, downloads and saved passwords apart, so one person's mistake does not become everyone's.
What to do, at no cost
- Create a standard account for each person who uses the machine and keep the administrator account for yourself.
- Use the family settings built into Windows or macOS to set age-appropriate limits rather than installing a separate product for it.
- Agree where software comes from — official stores and developers' own sites — rather than trying to block everything.
- Keep the administrator password to yourself, including from older children who will otherwise use it routinely.
Games and age ratings
Computer games sold or distributed in Australia are classified under the national classification scheme, and the Australian Classification Board publishes the ratings and the consumer advice that goes with them. Checking a classification before a game is installed is a reasonable part of the same conversation, particularly for games that offer purchasable randomised items, which carry their own consumer advice and are not suitable for every player.
For bullying, unwanted contact or harmful content encountered online, the eSafety Commissioner is Australia's regulator and operates complaint schemes for those situations.