PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your browser keeps redirecting to strange pages after you downloaded a file

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Stop using the affected browser for anything sensitive, close the strange pages, and use a different clean device for passwords, banking, shopping, or work accounts. Then update your security software and run a full scan of the device before trusting it again.

Do not do these things

  • Don’t log into email, banking, shopping, work, or password-manager accounts on the affected browser.
  • Don’t install “cleaner”, “security”, “driver”, or “update” tools advertised by pop-ups or redirected pages.
  • Don’t call phone numbers shown in pop-ups claiming your computer is infected or blocked.
  • Don’t click “Allow notifications” on unexpected pages.
  • Don’t pay anyone who appears through a pop-up, redirect, warning page, or unsolicited call.
  • Don’t keep trying random fixes if the redirects continue after a scan and browser reset.

What to do now

  1. Stop the sensitive activity.
    Close the affected browser. If strange pages keep opening or you cannot control the browser, turn off Wi-Fi or unplug the ethernet cable for now.

  2. Use a different device for urgent accounts.
    Use your phone on mobile data, or another device you trust, for banking, email, work messages, password-manager access, and card-provider contact.

  3. Write down the likely trigger.
    Note the file name you downloaded, the website or message it came from, the browser affected, and any new toolbar, extension, homepage, search engine, or notification prompt you noticed.

  4. Update and run a full security scan.
    Reconnect only if needed to update your operating system and security software. Run a full scan, not just a quick scan. On Windows, if the problem keeps returning, run Microsoft Defender Offline scan.

  5. Remove suspicious browser extensions and notifications.
    In the affected browser, remove extensions or add-ons you do not recognise, especially anything added around the time the redirects began. Also remove notification permissions for sites you do not recognise.

  6. Check recent apps or programs.
    Look at recently installed apps or programs on the device. Uninstall anything you did not mean to install, especially download managers, toolbars, fake updates, coupon tools, or unknown security tools.

  7. Reset or refresh the browser.
    Use the browser’s own reset or refresh option to undo changed homepage, search, start-page, pop-up, and redirect settings.

  8. Change key passwords from a clean device.
    Start with your main email account, banking, Apple, Google or Microsoft account, work account, and password manager. Turn on two-factor authentication where available.

  9. Act if money, accounts, or personal details may be exposed.
    Contact your bank or card provider using the number on your card or the official app. If you are in England, Wales, or Northern Ireland and you have been affected by fraud or cyber crime, report it to Report Fraud. If you are in Scotland, contact Police Scotland on 101.

  10. Report the suspicious website if you captured the address.
    If you saw a specific scam or redirect URL, report it to the National Cyber Security Centre. Do not revisit the page just to find it.

  11. Get trusted technical help if it does not settle.
    If redirects continue after scanning, removing extensions, uninstalling recent suspicious apps, and resetting the browser, stop troubleshooting in circles. Use your employer’s IT team if it is a work device, or a reputable repair service if it is your own device.

What can wait

  • You do not need to identify the exact malware name right now.
  • You do not need to wipe the whole device immediately unless the problem continues after basic removal steps or trusted support advises it.
  • You do not need to decide every account password at once; start with email, banking, work, and password-manager access.
  • You can report a scam website after the device is stable, unless money, account access, or urgent risk is involved.

Important reassurance

Browser redirects after a download are unsettling, but they are a common sign of unwanted software, a bad extension, or changed browser settings. Slowing down, avoiding sensitive logins, scanning the device, removing recent unwanted items, and resetting the browser usually gives you a safer first pass than following pop-up instructions.

Scope note

These are first steps only, to stabilise the device and reduce immediate harm. Later decisions may need specialist IT support, your employer’s security team, your bank, or an official fraud-reporting route.

Important note

This is general information, not professional, legal, financial, technical, or cybersecurity advice. Use official contact routes, and get qualified technical help if you suspect ongoing compromise, financial loss, identity theft, or work-device exposure.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us