The Search Hijack
You boot up your computer, open Google Chrome, and type a query into the address bar expecting Google results. Instead, you are violently redirected to Yahoo, Bing, or a completely unknown, ad-ridden search engine like “Search Marquis” or “Conduit.” You go into the settings, change your default search engine back to Google, but the very next day, it happens again. Chrome is not doing this natively; it is being forced to change its settings by a malicious extension, a piece of adware installed on your computer, or an aggressive corporate policy.
How to Remove Search-Hijacking Extensions
The vast majority of search engine hijacking is caused by rogue Chrome extensions that disguise themselves as PDF converters, recipe finders, or coupon clippers.
1. Open Google Chrome.
2. Click the three vertical dots in the top-right corner.
3. Hover over Extensions, then click Manage Extensions.
4. Look critically at every single extension in this list. If you do not recognize an extension, or if it says something like “PDF Viewer Plus” but you never use it, click the Remove button.
5. Pay special attention to extensions that have a small icon indicating “Installed by your administrator” if this is a personal computer. This is a massive red flag for malware.
How to Clean the Chrome Search Engine Database
Once the malicious extension is gone, you must manually delete the fake search engine from Chrome’s database so it cannot default back to it.
1. Click the three vertical dots and go to Settings.
2. In the left-hand sidebar, click on Search engine.
3. Click on Manage search engines and site search.
4. Under the “Search engines” list, find Google. Click the three dots next to it and select Make default.
5. Now, look for the malicious search engine in that same list (e.g., Yahoo or Search Marquis). Click the three dots next to it and select Delete.
6. Crucial Step: Look further down the page at the “Site search” list. Malware often hides secondary triggers here. Delete any suspicious URLs found in this secondary list as well.
Finally, run a reputable anti-malware scan (like Malwarebytes) on your entire computer to ensure the underlying virus that installed the extension is completely eradicated.