How to Check for Malware That Redirects or Blocks Pages
Malware that redirects or blocks pages can change where a browser goes, stop security services from opening, or turn ordinary searches into suspicious traffic. Such infections may alter DNS settings, browser policies, proxy details, the Windows hosts file, startup items, or installed extensions. The symptoms can resemble a broken website, so the safest response is methodical testing rather than clicking through repeated warnings or installing software advertised by a pop-up.
A useful first move is to establish whether the problem follows the device, the browser profile, the home network, or a particular domain. Testing on another device and network can expose the source quickly. In Australia, that comparison may involve switching from an NBN connection over fibre, hybrid fibre coax, copper or fixed wireless to a Telstra, Optus or Vodafone mobile hotspot, while keeping in mind mobile data allowances and occasional coverage dropouts.
Recognise the symptoms early
Watch for redirects that return you to a familiar site, altered search results, a changed homepage, new notification prompts, unexplained extensions, or security pages that fail to load. A redirect loop or “site unavailable” message may also point to DNS manipulation. Keep the exact URL and error message: a 403 response means access was refused, while a 502 response indicates that a gateway or upstream server could not complete the request.
Compare the affected browser with a private or guest profile and then with a trusted browser on another device. If only one browser is affected, inspect that profile and its extensions first. If every browser on the device misbehaves, prioritise an offline malware scan and startup-item checks. If all devices on the same Wi-Fi are affected, the router, network DNS or an active filtering service is more likely. When the network is playing up, remember that a simple drop-out can resemble a compromise.
Basic outages do not always indicate infection. The concise page-loading basics covers network interruptions, filtering, cache effects and domain or hosting faults that can make a page appear blocked. Use those checks to rule out ordinary causes before making destructive changes to a working system.
Separate browser, network and device issues
Start with the least invasive test: open the same address in a private or guest profile, then in another trusted browser from its official app or store. If the problem disappears, disable recently added extensions, restore search and homepage choices, and review notification and site permissions. If it remains, close browsers before changing DNS or host-file settings.
Check what the router is doing. Record any custom DNS, proxy, port-forwarding or parental-control entries, update its firmware through the manufacturer’s legitimate interface, and change the administration password if it is weak or exposed. Never use a router configuration link sent in an unsolicited message. On managed school or work devices, leave policy-controlled settings to the IT administrator.
Connection differences can skew diagnosis in Sydney, Melbourne, Brisbane, Perth, Adelaide or regional and remote Australia. Fibre and fixed-line services may behave differently from fixed wireless or a congested mobile network. A slow NBN plan can also make a redirect chain feel like a hang. Record timestamps and compare the affected site with a known-good Australian government or news page instead of assuming every failure is malicious.
Inspect redirects, extensions and browser policies
Examine the destination before interacting with it. Expand shortened links and hover over buttons to reveal their real target, but do not click a fake security warning. A chain of 301 or 302 redirects can be legitimate, yet repeated hops through unfamiliar advertising domains often indicate unwanted software. On a managed device, use the organisation’s approved browser and security tools rather than removing administrator policies.
Open the browser’s own security and privacy controls: review the homepage and default search engine, managed policies, extensions, downloads, permissions and recently created profiles. Reject control pages that ask for a password, one-time code, remote-control access or payment. The safe gaming guidance is also useful for spotting manipulative redirects and unsolicited downloads around otherwise familiar entertainment sites.
Malicious changes often sit below the browser. Compare the device’s DNS and proxy configuration with the values supplied by the ISP, check the hosts file for unfamiliar domain entries, and look for browser command-line changes or profile directories appearing outside the normal location. Clearing cache alone cannot remove malware. A fresh profile can isolate profile corruption, but it should not be treated as a complete cleanup.
Scan for malware and compare the evidence
Run a trusted offline or full scan with the operating system’s built-in protection, such as Microsoft Defender Offline on Windows, and update the browser and operating system first from official sources. On macOS, allow Gatekeeper and XProtect checks, review configuration profiles and recently installed apps, and remove anything unfamiliar. A reputable second-opinion scanner can help, but never install a program because a redirect page demands it.
Malware can reinstall itself through startup programs, scheduled tasks, browser policies or compromised router settings. Review those areas in a clean environment and remove only entries you can confidently identify; note legitimate recovery options before resetting a profile. If scans remain clean but redirects continue, test the router with a known-good connection and check whether a network-level DNS change was made without your knowledge.
A compact comparison helps connect each symptom with its most likely source and the safest next check.
| Pattern observed | More likely explanation | Checks | Sensible response |
|---|---|---|---|
| One browser or profile is affected | Corrupted profile or extension | Guest profile, extension list and browser settings | Review extensions and reset only affected settings |
| Every browser on one device is affected | Malware or unauthorised device changes | Offline scan, startup items and scheduled tasks | Disconnect questionable programs and scan from a clean state |
| Every device on one network is affected | Router DNS, filtering or network compromise | Compare with a hotspot and inspect router settings | Restore known-good network configuration |
| One website fails everywhere | Domain, hosting or server fault | Test the address and record its error code | Contact the site owner or hosting provider |
| Only a managed device is affected | School or workplace policy | Review policies with the IT administrator | Follow the organisation’s reporting process |
Australian-specific help is available from the Australian Cyber Security Centre, the eSafety Commissioner for harmful online material, and Scamwatch for payment or impersonation scams. If an Australian bank account or myGov account is involved, contact the institution promptly from its official app or number, change credentials from a clean device, and report suspected cybercrime through ReportCyber or the relevant state police force.
Rule out hosting and network faults
Treat each pattern according to its scope rather than applying every remedy at once. A browser-only problem rarely requires router changes, while redirects on every connected device should be investigated at both the device and network levels. The recorded error message helps determine whether a refusal, expired certificate, DNS failure or upstream outage is involved.
Server-side faults need a different approach. This 502 gateway explanation shows why a bad gateway can affect an otherwise healthy browser. If the same URL fails on a clean device while other sites work, keep the evidence and contact the site owner or hosting provider rather than altering security settings.
Recover securely and prevent recurrence
Before changing anything further, export clean data where possible and collect screenshots of the URL, redirects and error codes. Remove unwanted extensions and applications, reset only the affected browser settings, reinstall the browser from its official source if required, and restore a known-good DNS configuration. If a router change is necessary, record existing settings first and avoid factory-resetting a service supplied and managed by your ISP.
Assume exposed credentials may be compromised once a device redirects traffic to an attacker. From a clean device, change important passwords, revoke active sessions, re-register authenticator apps if needed, and enable multi-factor authentication. Do not use the infected device for online banking, email password recovery or entering one-time codes. Keep a record of what was found and when it was fixed for any insurer or police report.
Take action now by repeating the comparison on a second device and network, running an offline scan, and documenting every affected address. If redirects, fake security notices or blocked pages persist, isolate the affected device, seek assistance from a trusted cyber security professional, and ask the ISP or device administrator to check DNS, filtering and policy settings before normal browsing resumes.