Pop-ups and browser changes
Changes inside a browser are the most visible computer problem and one of the least dangerous, in the sense that the cause is usually a single add-on and the fix is usually free. These six questions cover where the changes come from and how to reverse them.
My browser homepage changed by itself. Is that serious?
It is annoying rather than serious in most cases. A changed homepage or search engine is normally the work of a browser extension or of an installer that bundled one, and removing it restores the setting.
What usually sits behind it
Search traffic is worth money, so there is a long-standing business in redirecting it. The usual route is an extension that asks for permission to read and change the sites you visit, which is a reasonable permission for a genuine tool and a profitable one for an advertising add-on. The second route is a bundled installer: a free program whose installation process offers a search change as a pre-ticked option on a screen most people click past.
Changing the setting back without removing the cause produces the characteristic symptom of this category, which is a setting that reverts after each restart.
What to try first, at no cost
- Open the browser's extension list and read it in full. Remove anything you do not recognise or no longer use.
- Pay particular attention to extensions that list permission to read and change data on all sites.
- Set the homepage and the default search engine back to what you want.
- Restart the browser and check whether the setting held.
- If it reverted, look at the list of installed programs on the computer for something added recently, and remove it there.
When to ask for official help
Each browser maker publishes its own instructions for managing extensions and resetting settings, and those pages are the authoritative source for the exact steps in the version you are running.
Where a paid product may or may not help
Security products classify this kind of software as potentially unwanted, and some will detect and remove it where the built-in protection treats it as a user choice. That is a genuine difference, although the extension list is free to read first.
Why am I suddenly seeing pop-ups on every site?
Because something is inserting them. Advertisements that appear on sites which never carried them, including sites you know well, come from the browser rather than from the sites themselves.
What usually sits behind it
The clue is the inconsistency. A site that shows heavy advertising to everyone is doing its own thing; a site that shows advertising only on your machine is being modified on your machine. Extensions can insert content into any page they have permission to read, and that is the common mechanism.
A second possibility is that the advertisements are arriving as desktop notifications rather than as page content, which is a separate setting and is covered in the next question.
| Where it appears | Likely source | Where to look |
|---|---|---|
| Inside pages, on many different sites | Browser extension inserting content | Extension list |
| In the corner of the screen, even with the browser closed | Website notification permission, or an installed program | Notification settings, then installed programs |
| New windows opening on their own | Pop-up blocking disabled, or an extension | Site permissions, then extension list |
| Only on one site | That site's own advertising | Nothing to fix on your machine |
What to try first, at no cost
- Disable all extensions at once and see whether the advertising stops.
- Re-enable them one at a time to identify which one is responsible.
- Check that the browser's pop-up blocking is switched on.
- Try a different browser briefly. If it is clean, the problem is confined to the first browser.
- Check the installed program list for anything that arrived alongside a recent free download.
When to ask for official help
If the advertising includes offers that appear to be fraudulent, Scamwatch at scamwatch.gov.au collects reports of what is circulating in Australia.
Where a paid product may or may not help
Where the cause is an extension you can see and remove, no purchase is needed. Where something reinstalls itself after removal, a current security product is a reasonable next step.
Where are these desktop notifications coming from?
From a website that was granted permission to send them, usually by a prompt that was dismissed with the wrong button. The permission is revocable in the browser's settings and the notifications stop immediately.
What usually sits behind it
Browsers let sites send notifications so that messaging and calendar services can be useful. The same mechanism is used by advertising operations, which show a prompt designed to be confused with something else, often a check that you are not a robot or a claim that a video needs permission to play. One accidental approval produces notifications that continue indefinitely, and they look like system messages because they are drawn by the operating system.
This is the single most common reason people believe a computer is infected when it is not.
What to try first, at no cost
- Open the browser's settings and find the notifications section under site permissions.
- Read the list of sites allowed to send notifications. The culprit is usually obvious.
- Remove permission from everything you did not deliberately approve.
- Set the browser to ask before allowing, or to block requests entirely.
- Check the operating system's own notification settings as well, in case a program rather than a site is the source.
What to watch out for
Notifications of this type often imitate security warnings, because alarm produces clicks. A message that appears in the corner of your screen and claims to have found a problem with your computer is not the result of a scan. Nothing scans your machine from a web page.
When to ask for official help
Browser makers document the notification settings for their current versions, and those pages are the right reference for the exact menu names.
Where a paid product may or may not help
This is a settings problem, not a malware problem, and the fix is free. Some security products block known advertising domains, which reduces how often the prompts appear in the first place.
A page said my computer had a problem and gave a phone number. What is that?
It is an advertisement designed to be mistaken for a system message, and the telephone number is the whole point of it. Close the page. No website can examine your computer.
What usually sits behind it
Pages of this kind are built to imitate the look of an operating system, sometimes with sound and sometimes in full screen so that the browser's own controls are hidden. They are reached through advertising networks or mistyped addresses. The number connects to the telephone approach described on the page about unsolicited support calls: remote access, invented evidence, payment.
The reason the imitation works is that it borrows the appearance of something trustworthy. Knowing in advance that a web page has no ability to inspect your machine removes most of its force.
What to try first, at no cost
- Close the tab. If the page resists, close the whole browser through the task manager or by force-quitting it.
- When reopening the browser, decline any offer to restore the previous session.
- Do not call the number, and do not use any chat or callback option on the page.
- Clear the browser cache if the page keeps reappearing, and check the extension list.
- Report it to Scamwatch at scamwatch.gov.au.
When to ask for official help
If you called the number, granted remote access or paid anything, treat it as the incident described under unsolicited support calls, contact your bank, and report through ReportCyber at cyber.gov.au.
Where a paid product may or may not help
Web filtering in a security product can block pages of this type that have already been identified, which reduces how often they are encountered. It is a reduction in exposure, not a guarantee, and the decisive protection is knowing what the page is.
I did not install this toolbar. How did it get there?
It almost certainly arrived with something else you did install. Bundling is a long-standing practice in which a free download includes additional software, offered on a screen in the installer that is easy to click past.
What usually sits behind it
The economics are straightforward: the author of a free program is paid for each additional installation, so the offer is placed where it is most likely to be accepted. Pre-ticked boxes, "recommended" settings and an express installation option that includes everything are the standard devices. Nothing is hidden, exactly, but nothing is prominent either.
Download sites that wrap programs in their own installer are the other common source, which is why going to the software author's own site is worth the extra minute.
What to try first, at no cost
- Remove the toolbar from the browser's extension list.
- Look in the computer's installed program list for a matching entry and uninstall it there too.
- Reset the search engine and homepage afterwards, as these are often changed at the same time.
- In future, choose custom or advanced installation, which is where the optional extras are shown and can be declined.
- Download from the software author's own site rather than from a download portal.
When to ask for official help
If a bundled program cannot be removed through the normal uninstall process, that moves it out of the nuisance category and is worth proper assistance.
Where a paid product may or may not help
Detection of potentially unwanted programs is one of the clearer differences between products, and it is a legitimate reason to consider a commercial one for a computer used by several people. Norton AntiVirus Plus is an antivirus product for Windows and macOS desktops; what it includes is set out on the vendor's own site.
Visit the Norton AntiVirus Plus websitePaid affiliate link. A commission is paid to Mildfactor if you buy after following it; the price is the same for you.
Will resetting the browser lose my bookmarks and passwords?
Generally no. A reset in the major browsers returns settings to their defaults and disables extensions, while leaving bookmarks, history and saved passwords in place. The exact behaviour is documented by each browser maker, and it is worth reading before you proceed.
What usually sits behind the worry
The word "reset" sounds more destructive than it is, and people avoid the one step that would have solved the problem. What a reset actually does is remove the accumulated changes: the search engine, the startup pages, the pinned tabs, the extensions and the site permissions. That list is exactly the list of things that go wrong in this category.
If you are signed into the browser with an account that synchronises settings, the picture is slightly different, because a reset on one device may be undone by synchronisation from another. Signing out first makes the result predictable.
What to try first, at no cost
- Export or confirm your bookmarks before resetting, as a precaution.
- Check where your saved passwords live. If they are in a password manager, nothing in the browser affects them.
- Sign out of browser synchronisation before resetting if you use more than one device.
- Read the browser maker's own description of what its reset removes.
- Re-enable only the extensions you genuinely use afterwards.
When to ask for official help
If the same changes return after a reset, the cause is outside the browser, which usually means a program on the computer or a scheduled task reinstating it. That is the point to seek help rather than repeat the reset.
Where a paid product may or may not help
A reset costs nothing and solves most of this category. A paid product is relevant for the stubborn remainder, where something is reinstating changes and needs to be found and removed.
Short answers to three further questions
On an up-to-date browser and operating system this is uncommon, because installation requires a download and then a permission prompt. It is one of the main reasons that installing updates promptly is the most valuable free habit.
They are extensions like any other, with permission to read and change every page you visit. Established ones with a long history are a different proposition from a new one with few users, and the permission list is worth reading before installing either.
Rarely on its own. Clearing cookies signs you out of sites and removes advertising identifiers, but an extension inserting content and a site holding notification permission both survive it. Those two settings are the ones to change.