Roland Waddilove shows how your PC becomes infected with unwanted extras and how to clean up your web browsers
If you've owned a PC for any significant amount of time, then at some point, you've probably had to deal with potentially unwanted programs (PUPs), browser hijackers and adware on your computer. They're easy to install but often difficult to remove. They're stubborn and can even appear to remain on the system even after they've been uninstalled. How do PUPs get on your computer? What do they do to it? How do you get rid of them? What tools can help you?
I'll be answering all these questions, and by the end of the article you'll have a clean, ad-free and fully functioning browser again. Browser hijackers, PUPs and adware affect web browsers in different ways, but here I'll be covering the main three: Internet Explorer, Chrome and Firefox. If you have all three browsers on your PC when PUPs, toolbars and adware are installed, they can affect all three at once, tripling the amount of work required to clean up the computer. It's not hard, though, and you just have to go about it in a methodical manner.
A common type of PUP is one that is installed into the web browser, which can add a toolbar to Internet Explorer and Firefox, add an extension to Chrome, redirect searches to a different search engine in all browsers, change the browser's start page or new tab page, and display unwanted adverts. They can even replace the adverts that normally appear on a web page with their own alternative ones.
Catch A PUP
People confuse PUPs with malware like viruses, and they think that somehow the computer has become infected, possibly by visiting a malicious or hacked website, opening an email or attachment, or downloading a file. They complain that their security software did not block the virus and they're amazed at the ineffectiveness of the antivirus program they use. "I have the latest security software, but I still got infected," they say, and "I have scanned the computer with X, Y and Z, and they come up with nothing. How do I get rid of this virus?"
Many PUPs and toolbars are not viruses, which is why anti-virus software does not block them. They may be irritating and they're often unwanted, but that doesn't mean they're a classed as a virus. What one person calls a PUP, another might call a useful utility, although I have yet to meet someone that actually liked one, apart from the developer that made it.
If PUPs and browser hijackers are not viruses, how do they get on your computer? A common method is through free software. They are frequently bundled with freeware, shareware or free trial software, and when you install the software, you install the PUP, hijacker or adware too.
The problem is that many people sleepwalk through the installation of software. Well, installations are boring, after all. Their mind wanders and after seeing several dull popup windows that they have to click through, they stop reading what is on the screen and just click the Next button as soon as it appears so as to get through the installation as quickly as possible.
On one of those installation windows may be an option to install the PUP, and it is automatically selected for your convenience. You click away without reading the text, and the PUP is accidentally installed without you noticing. The K-Lite Codec Pack is an example of how PUPs, browser hijackers and adware get on to your computer.
The K-Lite Codec Pack is a useful collection of video codecs that enable you to play almost any type of video format in Windows. It's very common, and lots of people install it. Like a lot of free software, though, it contains a PUP that hijacks the browser. In this particular case it can easily be avoided, and eagle-eyed PC users will spot it, but you do need to pay attention when installing the software.
During installation of the K-Lite Codec Pack, there must be a dozen windows to click through, or at least it seems like that many - I didn't count. Towards the end, when your mind is numbed and you have given up reading what they say, is one that offers to install the PUP.
Bundled with K-Lite Codec Pack is MyStart, which is a potentially unwanted program. It is a relatively harmless one, but it still gives people problems, and it's a good example of what they do.
The boxes to install the toolbar, set the home page and change the search provider are already ticked for your convenience, and all you have to do is click Next. If you've stopped reading the seemingly endless installation screens, you will miss this and MyStart will be installed. Stop! What you should do read every screen and when you get to this one, clear the ticks at the top and tick the box at the bottom. This offer of free software and the changes it makes to the browsers on the PC should be declined.
See how these things can be avoided if you're careful? Many PUPs rely on you not paying attention during installation, but others, more devious ones, make the options hard to see. For example, they may be displayed in a small font on a text-heavy screen of legal terms and conditions, which no one ever bothers to read. In the worst cases, some PUPs may not even tell you they're being installed or enable you to opt out.
PUPs like MyStart change every web browser that is installed, including Internet Explorer, Firefox and Chrome. Take a look at the browsers afterwards in the screenshots. They're actually quite attractive, but the changes could come as a complete surprise if you weren't paying attention during the installation of the K-Lite Codec Pack.
Web browsers are becoming better at preventing this hijacking of the home page and the addition of toolbars, extensions and addons. Chrome for example, displays a message in the top right corner of the browser. It tells you that MyStart has been added, and you're prompted to enable it or remove it before continuing to use the browser. When you search the web by typing the search term directly into Chrome's address box and the search engine is not Google, a pop-up message appears asking if this is the search page you were expecting. It offers to restore the original setting.
Firefox and Internet Explorer do similar things to a certain degree, but the warnings don't seem to work because people either don't notice, don’t understand what they're agreeing to or think they can easily remove the PUP.
Clean Up The Computer
If you want to remove these unwanted changes and extras in your web browsers, the place to start is Programs and Features in the Control Panel (Add or Remove Programs if you're still using XP). Look for the unwanted software. There's an obvious entry for the MyStart toolbar that I installed, but it can be quite difficult to spot when there's a lot of software installed on the computer and the name is less obvious. Just examine each item and ask yourself what it is and whether you need it. Check the name and the publisher columns. An uninstaller utility like lObit Uninstaller (iobit.com) or Wise Program Uninstaller (wisecleaner.com) helps to remove all traces of the software.
If only it was as straightforward as uninstalling the software. For some reason, these unwanted extras never have any problems installing themselves, and the installer works perfectly. The uninstaller does not. Try opening your browsers after uninstalling the PUP, and you'll find that little, if anything, has changed.
Clean Up Internet Explorer
Is possible to uninstall these unwanted extras completely? It seems not, and you now have to clean up each web browser manually. Let's look at Internet Explorer first. Start the browser (the desktop version if you're a Windows 8 user), go to the gear menu and select Internet Options. On the General tab in the home page section, delete everything in the box and enter the URL of the website you want to start with.
Click the Tabs button and in the section 'When a new tab is opened' click the button and select an option, such as 'The new tab page' or 'Your first home page'. You should not need them, but on the Advanced tab is 'Restore advanced settings' and 'Reset'. It won't do any harm to click both buttons.
Close Internet Options, go to IE's gear menu and select 'Manage add-ons'. Select 'Toolbars and Extensions’ on the left and 'All add-ons' below, then look through the list of items displayed for anything that should not be there. PUPs, toolbars and add-ons have so many names it would not be possible to list them, so just check each item and Google them if you're not sure. Ignore add-ons from well-known companies like Microsoft, Adobe, your security software and so on. If you find something, select it in the list and click the 'Disable' button in the bottom-right corner.
Select 'Search Providers' on the left and on the right, select the search engine you would like to use and click the 'Set as Default' button. You can then select the ones you don't want and click the 'Remove' button. You can trim it right down to just Bing or Google if you want. PUPs always add their own website and set it as the default search engine, which is why the wrong search engine is used.
Clean Up Chrome
PUPs are installed into every browser, so after cleaning Internet Explorer you then have to clean Chrome too. Sometimes an extension is installed, so enter ’chrome://extensions' into the address box and examine each one closely. If there are any that should not be there or that you do not want, click the trash icon to delete it. MyStart added an extension to Chrome and was easily found and deleted.
There’s more, though, and like Internet Explorer, the search engine can be changed. Go to the menu button and select Settings. Click ’Manage search engines' in the Search section. Whenever Chrome comes across a search box on a web page, it adds the site as a search engine. The list of search engines is therefore long, but the only one of importance is the one set as the default. Find the Google entry, mouse over it and set it as the default. Mouse over any other search engines you don't want and click the icon to delete them.
Return to Settings and in the 'On startup’ section where it says 'Open a specific page or set of pages', click 'Set pages'. Enter your favourite start page, such as www.google.co.uk, mouse over any other start pages and click the cross to delete them.
Clean Up Firefox
It's the same story with Firefox; you need to remove add-ons and extensions, reset the home page and delete unwanted search engines. Click the menu button and select Add-ons. The PUP has most likely installed a plug-in or extension, so select each of these on the left and examine the list of items displayed for anything that should not be there. The names of PUPs are too numerous to list, but they're often obvious.
To the right of the address box is the search box, and on the right of the magnifying glass is a little arrow. Click it and select 'Manage search engines' or 'Change search settings’ (the wording is different in each Firefox version). A list of search engines is displayed, from which you can select and remove ones that you don't want. Look for the PUP's search engine and delete it. In recent versions of Firefox, there's an option to set the default search engine. Use it to select your favourite. Finally, go to the General tab in Settings and enter the URL of your preferred start page in the Home Page box.
Useful Tools
One of the most useful tools for cleaning up a computer and removing PUPs, adware and toolbars is Malwarebytes Anti-Malware (malwarebytes.org). The free version is all you need, and it can be kept installed on your computer alongside your regular security software.
The main reason why it's so useful is that it recognises many programs that other security software misses. Technically many PUPs and similar items are not malware, and anti-virus software ignores it, but Anti-Malware recognises that most people don't like these things and offers to remove them. You might, however, still need to manually clean the browsers by resetting the home page, search engines and removing add-ons and extensions.
Symantec, best known for its Norton range of security products, offers the free Power Eraser utility (bit.ly/IHbxF0H), which is a browser hijacker removal tool. It doesn't need installing and will simply run from from its .exe file. Go to the Advanced Options and click 'Scan Now' next to 'Unwanted Application Scan'. Unwanted items found by the scan can be uninstalled. This tool can also be used to perform a rootkit scan too. PUPs are not rootkits, but if you have one type of malware, you might have another, so it's worth checking.
AdwCleaner (bit.ly/1xGfwzJ) is another free tool to keep on your computer. This is yet another application that will scan for and remove unwanted software like PUPs, toolbars and hijackers. Like Norton Power Eraser, it doesn't need installing, so you just run it from the Downloads folder and scan the computer.
Avast Browser Clean (bit.ly/19F8VQP) is another useful browser clean-up utility. You don't need to have Avast Antivirus installed, as it's a stand-alone tool.