Identifying and Removing Persistent Adware and Hijackers

Adware differs from traditional malware: it rarely attempts to destroy your operating system. Instead, it hooks into your browsers to inject affiliate ads, track search queries, or hijack your homepage (redirecting queries to sketchy search portals).

Many adware infections deploy enterprise management templates to prevent users from removing malicious extensions. This guide outlines how to purge these group policy locks, clean system files, and restore default browser integrity.

---

1. Disabling Extension Policy Locks

When adware displays “Managed by your organization” in Chrome or Edge settings, it has set local Registry keys containing Enterprise Policies. This locks down search engines and prevents you from uninstalling the extension manually.

To break these policy locks:

Step 1: Clean System Policies folders

Open Command Prompt as Administrator and run:

# Delete the local group policy files cached on disk
rd /s /q "%WinDir%\System32\GroupPolicyUsers"
rd /s /q "%WinDir%\System32\GroupPolicy"

# Force Windows to re-build default security policy logs
gpupdate /force

Step 2: Delete registry override keys

Adware leaves policy flags in the registry. Open regedit and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

• Action: Locate subkeys named ExtensionInstallForcelist or HomepageLocation. Right-click and Delete these subkeys. Reboot your browser; you can now click the trash bin icon on the extension page.

---

2. Restoring Hosts File Integrity

Adware and hijackers often write records to your Windows Hosts file. This forces domain names (like google.com or security download portals) to map to malicious IP addresses.

Auditing the Hosts file:

1. Open Notepad as Administrator (Right-click > Run as Administrator).
2. Go to File > Open and browse to:

   C:\Windows\System32\drivers\etc\hosts

   (Ensure you change the file type filter in the bottom right of the open dialog from “Text Documents (.txt)” to “All Files (.)”).*
3. Look at the bottom lines of the file. By default, everything should be commented out with a #.
4. If you see lines like this without a #:

   127.0.0.1  download.microsoft.com
   104.244.42.1 google.com

   Delete these redirect lines, save the file (Ctrl + S), and close Notepad.

---

3. Purging Temp Caches and Background Services

Adware programs often hide small executable files in your app data directory and set them to auto-restart via Windows Services.

Inspecting Local Folders

Delete adware files stored in hidden AppData locations:

1. Press Win + R, type %localappdata%, and press Enter. Look for folders containing random letter names (e.g., ZylogSecurity or SearchAppHelper).
2. Press Win + R, type %appdata%, and repeat the audit.

Stopping adware services

1. Press Win + R, type services.msc, and press Enter.
2. Sort the services by Startup Type and scan for entries that lack descriptions or look out of place.
3. If you find one, open Command Prompt as Administrator and delete the service signature:

   sc delete "SuspiciousServiceName"

---

4. Resetting Browser Engines

Once the local registry files and system folders are clean, run a full factory reset on your browsers to wipe local databases:

For Google Chrome:

1. Click the menu dots in the top right > Settings.
2. Click Reset settings in the left sidebar.
3. Select Restore settings to their original defaults > Reset settings.

For Microsoft Edge:

1. Open settings, click Reset settings on the left menu.
2. Click Restore settings to their default values > Reset.

This cleans browser cookies, local caches, search directories, and disables remaining extension instances, completing the disinfection process.