Helping people with computers... one answer at a time.

I'd start with Malwarebytes. But then, I'd be very careful moving forward to pay attention to what's being downloaded and what is being installed on your machine.

I run XP 3 with Firefox 16 installed. There appears to be constant efforts to change my browser without any authority from me. So far,, Ask, and Babylon are all the main culprits, but there are others. I often see a balloon on my screen, which says something like an attempt to change your browser has been stopped. I know how to change browsers by going into Tools, Options, etc. I should not have to do this to keep my default browser, Google, in place. I have run malware programs with no result.

In this excerpt from Answercast #68, I look at a mysterious pop-up that is trying to change a browser window.

Malware changing browsers

Well, regardless of what malware programs you're running (and you haven't told me so I can't really comment on specific programs), but you've got malware of some sort - or you have malware that is continually trying to get itself installed on your machine.

Now, there are a couple of things that come to mind. One is definitely run multiple anti-malware tools. They don't have to be installed or run real-time, but I would perform additional scans and I would actually start you with Malwarebytes anti-malware. It will probably detect and clean up a few things that some of the other anti-malware tools, perhaps the ones you're running aren't catching and aren't cleaning up.

Download installs

With that out of the way, what I would caution you: the culprits that you mention here (Snap and Ask and Babylon), these are all common, what I call "drive-by download installs."

When you download software from a download site or a file-sharing site or whatever, very often either the download or the installation process for that software will ask you, "Would you also like to install this toolbar or this feature or this whatever?"

If you're not paying attention or if you accept the default settings for whatever it is you're installing, they will often simply install that kind of stuff without asking. And without asking... well, it sounds like it would end up doing exactly what it's doing here. It's going to try and change your browser or it's going to try and change your browser's home page.

From your wording here, it's a little unclear if they're trying to change your browser from Chrome or Firefox to IE or if they're trying to change the home page for your browser from Google to whatever else. The latter is the most common.

Many of these drive-by downloads actually end up trying to change your home page to a page that benefits them rather than you.

Pay attention when installing

So, definitely pay careful attention when you're downloading things, when you're installing things. Always choose the Custom or Advanced option when you're installing.

  • Make sure to take very careful note of all of the options that you're offered.

  • Make sure that anything that sounds like you're installing something that you didn't ask for gets turned off.

My guess is that is the single biggest culprit in scenarios that sound like what you're having. I'd start with Malwarebytes, but then I'd be very careful moving forward to pay attention to what's being downloaded and what' being installed on your machine.

Article C6007 - November 8, 2012 « »

Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

1 Comment

November 9, 2012 11:10 PM

I allowed someone representing themselves as "fix it" people pc; after they said they would remove all the "junk" they showed me I had in my computer; anyway I lost the use of my Windows XP ; I replaced it with Ubuntu; which has been fine for surfing the web and emai; can I restore my cd/dvd player? I lost that too along with the movie player.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.