Foylos.dxyz is a browser hijacker that forces unwanted changes to your web browser's default search engine, homepage, and new tab page, redirecting searches through suspicious intermediary domains. This potentially unwanted program (PUP) typically arrives bundled with free software downloads and immediately takes control of Chrome, Firefox, Edge, or other browsers upon installation. While not a virus in the traditional sense, Foylos.dxyz creates security risks by exposing users to unreliable search results, intrusive advertising, and potential tracking of browsing habits.
Unlike destructive malware that encrypts files or steals credentials directly, browser hijackers like Foylos.dxyz operate in a gray area—technically not illegal but decidedly unwanted. The hijacker persists through browser extensions, modified shortcuts, and system-level policies that make it difficult for average users to remove manually. Many people discover they're infected when their Google searches suddenly route through unfamiliar domains or when their browser homepage keeps reverting to a search page they never set.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Browser Hijacker / PUP (Potentially Unwanted Program) |
| Aliases | Foylos redirect, dxyz search hijacker, Foylos browser modifier |
| Platforms Affected | Windows 7 through 11 (all editions); affects Chrome, Firefox, Edge, Opera, Brave |
| Discovery Period | Active variants observed 2021–present |
| Distribution Method | Software bundling, fake installer updates, freeware packages, misleading download buttons |
| Persistence Mechanisms | Browser extensions, scheduled tasks, modified browser shortcuts with command-line parameters, Group Policy Objects (on some systems) |
| Primary Capabilities | Search redirection, homepage modification, new tab hijacking, ad injection, browsing data collection |
| Typical Artifacts | Browser extension with randomized name, modified browser shortcut targets, registry keys under HKCU\Software\Policies, scheduled tasks for reinstallation |
| Network Behavior | Redirects through multiple intermediary domains before reaching actual search results; contacts ad-serving domains; may report telemetry data |
| Data at Risk | Browsing history, search queries, clicked links, possibly form inputs depending on variant capabilities |
| Removal Difficulty | Moderate—requires browser cleanup, extension removal, shortcut repair, and registry/task cleanup; reinstalls itself if not fully removed |
| Payload Delivery Risk | Medium—primarily serves as advertising platform but may redirect to sites hosting additional PUPs or scareware |
How It Spreads
Foylos.dxyz spreads almost exclusively through deceptive software bundling practices. Users rarely seek out or knowingly install this hijacker—instead, it piggybacks on legitimate-looking free software installers that they download from file-sharing sites, unofficial software repositories, or through misleading advertisements. The installation wizard for the desired program includes the hijacker as an "optional" component, often pre-checked by default and described with vague language like "enhance your browsing experience" or "recommended search tools."
The distribution strategy relies on user inattention during installation. Most people click through setup wizards using "Express" or "Recommended" options without reading the fine print or reviewing the list of additional components. Advanced or Custom installation modes typically reveal the bundled hijacker, but the installer may use confusing layouts, small fonts, or misleading checkboxes to obscure the opt-out option. Some variants arrive through fake browser update notifications that appear while visiting questionable websites—the prompt claims your Flash Player or video codec needs updating, but the downloaded file actually installs the hijacker.
Common distribution vectors include:
- Freeware installers from download portals (video converters, PDF tools, codec packs, system utilities)
- Fake software update prompts on streaming or file-sharing websites
- Misleading download buttons on legitimate-looking software pages (the real download link is small; the hijacker installer is the large green button)
- Email attachments disguised as documents that actually launch installer scripts (less common for this family)
- Torrent files and cracked software packages that include hijackers alongside the desired application
- Malvertising campaigns where compromised ad networks serve up fake system warning pages prompting downloads
What It Does On Your Machine
Once installed, Foylos.dxyz immediately takes control of your web browser configuration. The most obvious symptom is that your searches no longer go directly to Google, Bing, or your chosen search engine—instead, they route through one or more redirect domains associated with the Foylos infrastructure. These intermediary pages briefly flash before forwarding you to a search results page that looks similar to legitimate results but contains injected advertisements and sponsored links ranked above organic results. Your homepage changes to an unfamiliar search portal, and every new tab opens to the same hijacked page rather than your preferred blank page or speed dial.
The hijacker achieves this control through multiple persistence layers. It typically installs a browser extension with administrative privileges, often masquerading under a generic name like "Helper," "Utility Extension," or a randomized string. This extension modifies browser APIs to intercept and redirect navigation requests. Simultaneously, Foylos.dxyz creates or modifies scheduled tasks that periodically check whether the hijacker components are still active—if you manually remove the extension, the scheduled task reinstalls it within hours or on next reboot. Browser shortcuts on your desktop and taskbar get modified with command-line parameters that force the browser to load the hijacked homepage on startup, even if you've changed your settings through the browser interface.
Behind the scenes, the hijacker generates revenue through search advertising arbitrage. Every search you conduct gets routed through affiliate systems that credit the hijacker operators for delivering traffic. The search results pages display advertisements that generate pay-per-click revenue, and some variants inject additional banner ads or pop-unders into websites you visit. While the primary purpose is advertising fraud rather than direct data theft, the hijacker likely collects your search terms, browsing history, and clicked links to build advertising profiles. This data may be sold to marketing companies or used to target you with more effective advertising campaigns.
Some users report system slowdowns when Foylos.dxyz is active, particularly during browsing sessions. The constant redirection process adds latency to every search, and the background processes monitoring and reinstalling hijacker components consume system resources. Browser performance degrades as the extension intercepts and processes requests. The bigger concern is security: by forcing your traffic through untrusted intermediary domains, the hijacker potentially exposes you to more dangerous threats. Compromised redirect servers could serve malware, or the search results might include links to phishing sites ranked higher than they deserve.
Manual Removal — Step by Step
Disconnect from Network and Document Current State
Before starting removal, disconnect your computer from the internet (unplug ethernet or disable Wi-Fi). This prevents the hijacker from downloading additional components during cleanup. Take screenshots of your current browser homepage and search settings so you'll know what to restore later. Open Task Manager (Ctrl+Shift+Esc) and screenshot the Processes tab—look for unfamiliar processes with random names or high network activity.
Uninstall Suspicious Programs via Control Panel
Open Control Panel → Programs → Uninstall a program. Sort by "Installed On" date to see recent additions. Look for programs you don't recognize that were installed around the time the hijacking started. Common disguise names include generic terms like "Browser Helper," "Search Manager," "Update Service," or completely random names. Uninstall anything suspicious, but note that Foylos.dxyz often doesn't appear here—it hides entirely within the browser.
Remove Hijacker Extensions from All Browsers
Open each browser you use and navigate to the extensions page: Chrome (chrome://extensions), Firefox (about:addons), Edge (edge://extensions). Enable "Developer mode" in Chrome/Edge to see hidden extensions. Remove any extensions you didn't intentionally install, especially those with vague names or no description. Pay attention to extensions that lack the "Remove" button—these have been installed via enterprise policy and require registry cleanup (covered in step 6).
Reset Browser Settings to Defaults
In Chrome: Settings → Reset settings → Restore settings to their original defaults. In Firefox: Help → More troubleshooting information → Refresh Firefox. In Edge: Settings → Reset settings → Restore settings to their default values. This removes hijacked homepages, search engines, and startup pages. Important: this also removes saved passwords and form data unless you have browser sync enabled, so ensure you have password backups before proceeding.
Fix Modified Browser Shortcuts
Right-click your browser shortcuts (desktop, taskbar, Start menu) and select Properties. Check the "Target" field—it should contain only the path to the browser executable, nothing after the closing quote mark. If you see additional parameters like --homepage or website URLs, delete everything after the .exe". Click Apply. Repeat for every browser shortcut on your system. The hijacker adds these parameters to force-load its homepage even after you've reset browser settings.
Clean Registry Policies
Press Win+R, type "regedit" and hit Enter. Navigate to HKEY_CURRENT_USER\Software\Policies\Google\Chrome (or \Mozilla\Firefox, \Microsoft\Edge). Look for keys named HomepageLocation, HomepageIsNewTabPage, DefaultSearchProviderEnabled, or similar. Delete the entire Chrome/Firefox/Edge folder under Policies if you're not in a corporate environment that requires browser policies. Also check HKEY_LOCAL_MACHINE\Software\Policies for the same browser folders. These registry policies override your browser settings and are how the hijacker forces its homepage even after resets.
Remove Persistence Scheduled Tasks
Open Task Scheduler (search for it in Start menu). Click "Task Scheduler Library" and review all tasks. Look for tasks with suspicious names like "BrowserUpdate," "SystemHelper," or random character strings that run frequently (every hour, at logon, etc.). Check the "Actions" tab for each suspicious task—if it references folders in %APPDATA%, %LOCALAPPDATA%, or %TEMP%, or if it launches PowerShell or script files, it's likely malicious. Right-click and delete these tasks. Foylos.dxyz uses scheduled tasks to reinstall itself, so this step is critical.
Delete Hijacker File Folders
Open File Explorer and enable viewing hidden files (View → Show → Hidden items). Navigate to %LOCALAPPDATA% and %APPDATA% (type these into the address bar). Look for folders created around the infection date with generic names like "BrowserHelper," "UpdateService," or random GUIDs (long strings of letters and numbers). Delete any suspicious folders. Also check your browser's user data folders for leftover extension remnants: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\ contains subfolders for each extension (compare against your current extension list).
Run Reputable Anti-Malware Scanner
Reconnect to the internet and download Malwarebytes Free (from malwarebytes.com directly). Run a full Threat Scan—this typically takes 30-60 minutes. Malwarebytes excels at detecting browser hijackers and PUPs that traditional antivirus misses. Quarantine and remove everything it finds. Follow up with a scan from your primary antivirus if you have one. Consider also running AdwCleaner (also from Malwarebytes) which specializes in browser hijacker cleanup and can remove leftover registry entries you might have missed.
Verify Removal and Change Passwords
Reboot your computer and open your browser. Verify that your homepage is what you set it to and that searches go directly to your chosen search engine without redirects. Check that new tabs open correctly. Set your preferred homepage and search engine if needed. Since the hijacker potentially logged your browsing activity, change passwords for important accounts (email, banking, shopping sites) as a precaution. Monitor your browser over the next few days—if the hijacker returns, you missed a persistence mechanism and should consider professional removal.
Prevention
- Always use Custom/Advanced installation mode when installing free software. Read every screen carefully and uncheck any pre-selected optional components, toolbars, or browser modifications. If an installer doesn't offer a custom mode or makes it difficult to decline extras, cancel the installation and find the software elsewhere.
- Download software only from official publisher websites or reputable sources like Microsoft Store. Avoid third-party download portals (Softonic, Download.com, CNET Downloads) which frequently bundle PUPs with legitimate software. When searching Google for software, look for the actual developer's site rather than clicking the first download link.
- Keep a reputable ad blocker installed (uBlock Origin is excellent and free). Ad blockers prevent malvertising campaigns and block many of the fake download buttons and misleading update prompts that distribute hijackers. They also improve browsing speed and reduce tracking.
- Ignore browser update prompts that appear on websites. Legitimate browser updates happen automatically or through the browser's internal update mechanism (Help → About). If a website claims you need to update Flash, Chrome, or a video codec, close the tab. Flash is no longer used or supported anywhere on the modern web—any prompt to install it is malicious.
- Enable Windows Defender SmartScreen (or your antivirus equivalent) and keep Windows Update current. SmartScreen blocks many known hijacker installers before they run. Regular Windows updates patch vulnerabilities that could allow forced installation of unwanted software.
- Review your browser extensions monthly. Open your extensions page and remove anything you don't actively use or recognize. Hijacker developers sometimes buy legitimate extension projects and push malicious updates to existing user bases, so an extension you installed safely months ago might have turned malicious.
- Create a limited user account for daily use rather than always running as Administrator. Browser hijackers installed under a limited account can only modify that user's browser settings and can't install system-wide scheduled tasks or modify HKEY_LOCAL_MACHINE registry keys. This containment makes removal much easier.
- Be skeptical of system warning pop-ups while browsing. Legitimate security alerts come from your installed antivirus or Windows Security Center, not from websites. Any webpage claiming your system is infected or requires immediate cleaning is lying—close the tab and run a scan with your real antivirus if concerned.
Bring It In
Browser hijackers like Foylos.dxyz are deceptively stubborn. They hide across multiple system locations, disguise themselves with random names, and reinstall themselves from scheduled tasks the moment you think you've won. Many customers spend hours following removal guides only to find the hijacked homepage reappearing the next day. That's because complete removal requires not just deleting the visible extension but also cleaning up registry policies, scheduled tasks, modified shortcuts, leftover file folders, and sometimes even Group Policy Objects that most users never knew existed. Miss one persistence mechanism and you're back to square one.
Computer Repair Roswell has removed hundreds of browser hijackers from Roswell, Alpharetta, and North Fulton County computers. We use professional-grade malware removal tools combined with manual registry and filesystem cleanup to eliminate every trace of the infection. More importantly, we identify how it got on your system in the first place and show you how to avoid it in the future. The process typically takes 1-2 hours and costs far less than the time you'd spend fighting it yourself—plus you get our 90-day guarantee that it won't come back. Call us at (770) 569-2609 or stop by our Roswell location at 1000 Mansell Road. We'll get your browser back to normal and your search results going where they should: straight to Google, not through some sketchy redirect chain collecting data along the way.