Norassie is a browser hijacker that redirects search queries, modifies homepage and new-tab settings, and injects unwanted advertisements into web browsing sessions. This potentially unwanted program (PUP) typically arrives bundled with free software installers and immediately takes control of browser configurations across Chrome, Firefox, Edge, and other popular browsers. While not as destructive as ransomware or banking trojans, Norassie degrades system performance, compromises privacy by tracking browsing habits, and exposes users to potentially malicious advertising networks.
Users often discover Norassie after noticing their default search engine has changed to an unfamiliar provider, or when every search query gets routed through suspicious redirect chains before displaying results. The hijacker generates revenue for its operators through forced traffic and pay-per-click advertising schemes, making your browser a profit engine for threat actors while slowing down your machine and compromising your online privacy.
Threat Profile
| Family | Browser Hijacker / PUP (Potentially Unwanted Program) |
|---|---|
| Common Aliases | Norassie redirect, Norassie search hijacker, PUP.Optional.Norassie |
| Platform | Windows (all recent versions); occasionally observed on macOS variants |
| First Documented | Variants circulating since approximately 2017-2018 |
| Distribution Method | Software bundling, fake download buttons, deceptive installers, pirated software packages |
| Persistence Mechanism | Browser extension installation, scheduled tasks, registry Run keys, local application data folders |
| Primary Capabilities | Search redirection, homepage modification, new-tab hijacking, ad injection, browsing data collection |
| Data at Risk | Browsing history, search queries, clicked links, potentially form data and cookies |
| Network Behavior | Frequent connections to ad networks and redirect domains; user-agent tracking; third-party cookie generation |
| Typical Artifacts | Browser extensions with generic names, AppData folders with random-looking subfolder names, scheduled tasks for persistence |
| Detection Names | PUP.Optional.Norassie, Adware.Norassie, BrowserModifier:Win32/Norassie (varies by vendor) |
| Removal Difficulty | Moderate — reinstalls itself if all components aren't removed; requires browser reset in most cases |
How It Spreads
Norassie primarily distributes through software bundling operations where legitimate-looking free software installers carry the hijacker as an optional component. The installation screens typically use pre-checked boxes or deliberately confusing layouts that trick users into accepting the additional software. Many users click through installation wizards using "Express" or "Recommended" settings without reading the fine print that discloses the bundled components.
Pirated software packages and key generators represent another major distribution vector. Threat actors know that users downloading illegal software copies are less likely to scrutinize installers carefully and often disable their antivirus software to run cracks or keygens. This creates the perfect environment for browser hijacker installation. The hijacker may arrive alongside the desired software or disguised as a necessary component for the pirated application to function.
Common infection vectors include:
- Bundled freeware installers — download managers, PDF converters, video players with "sponsored offers"
- Fake download buttons on file-sharing sites that lead to installer packages rather than the actual file
- Pirated software bundles from torrent sites or warez forums
- Deceptive browser update prompts on compromised or malicious websites
- Malvertising campaigns that push fake Flash Player or codec updates
- Email attachments disguised as legitimate software or document viewers
- Compromised third-party download portals that repackage legitimate software with bundled PUPs
What It Does On Your Machine
Once installed, Norassie immediately configures itself to launch with Windows and modifies browser settings before you notice anything wrong. The hijacker installs browser extensions or helper objects that intercept search queries and navigation attempts. When you type a search term into your address bar or visit your homepage, Norassie redirects the request through one or more intermediate domains before eventually displaying search results — often from a legitimate search engine, but with injected advertisements at the top of the page.
The redirection chain serves multiple purposes for the operators. Each redirect generates revenue through affiliate programs and pay-per-click schemes. The intermediate servers also log your search queries, clicked links, browsing timestamps, and system information like your IP address and user agent string. This data gets aggregated into browsing profiles that can be sold to advertising networks or used to target you with more effective (and more intrusive) advertisements.
Browser performance degrades noticeably under Norassie's influence. Pages load slower because of the redirect chain and injected scripts. The browser consumes more memory as the hijacker's extension runs constantly in the background. You may notice unfamiliar toolbars appearing, your homepage resetting even after you change it back, or new-tab pages displaying search boxes you didn't install. Some variants inject additional advertisements into legitimate websites, inserting banner ads or pop-unders that the website itself didn't place.
The hijacker establishes persistence through multiple mechanisms to survive basic removal attempts. It creates scheduled tasks that reinstall browser extensions if you remove them manually. It places executables in AppData folders with randomized names that launch at startup. Some variants modify browser shortcut targets to include command-line parameters that force homepage settings. This multi-layered persistence means that removing the browser extension alone rarely solves the problem — the hijacker just reinstalls itself the next time you restart the browser or reboot the machine.
Manual Removal — Step by Step
Disconnect and Document
Disconnect your computer from the internet to prevent the hijacker from downloading additional components or updating itself during removal. Take screenshots of any unfamiliar browser extensions, changed homepage settings, or suspicious programs in your installed software list — this documentation helps identify all related components. Write down any error messages or suspicious behavior you've noticed.
Boot Into Safe Mode with Networking
Restart your computer and boot into Safe Mode with Networking. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select option 5 for Safe Mode with Networking. Safe Mode prevents the hijacker's startup components from loading, making removal much easier. You'll need networking enabled to download scanning tools in later steps.
Uninstall Suspicious Programs
Open Control Panel (Windows key + R, type "appwiz.cpl", press Enter) and sort installed programs by installation date. Remove any unfamiliar programs installed around the time you first noticed browser changes. Look for entries with publisher names you don't recognize, especially those with generic names like "Search Protect," "Web Assistant," or anything containing "Norassie." Uninstall these programs, but don't restart yet — there's more cleanup to do.
Remove Persistence Mechanisms
Open Task Scheduler (Windows key + R, type "taskschd.msc") and look for scheduled tasks you didn't create, particularly any running tasks with generic names or tasks that launch executables from AppData folders. Delete suspicious tasks. Then open Registry Editor (Windows key + R, type "regedit") and navigate to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Remove any entries that reference Norassie or unknown executables in AppData locations. Make note of the file paths before deleting the entries.
Delete Hijacker Files
Using the file paths you documented from registry entries and scheduled tasks, navigate to those folders in File Explorer and delete the entire parent folders. Common locations include %LOCALAPPDATA%\[RandomGUID]\ and %APPDATA%\Norassie\. Show hidden files and folders (View menu > Show > Hidden items) to see these locations. If Windows says files are in use, that means you're not fully in Safe Mode or a related process is still running — check Task Manager for suspicious processes and end them before trying again.
Clean All Browsers Thoroughly
For each browser you use, remove all extensions you didn't intentionally install. In Chrome, go to chrome://extensions/. In Firefox, go to about:addons. In Edge, go to edge://extensions/. Remove anything unfamiliar. Then reset each browser completely: in Chrome settings go to "Reset and clean up" > "Restore settings to their original defaults." In Firefox, go to about:support and click "Refresh Firefox." This removes extensions, resets homepage/search settings, and clears temporary data while preserving bookmarks and passwords.
Scan with Reputable Anti-Malware Tools
Download and run Malwarebytes Free (from malwarebytes.com — verify the URL carefully). Run a full Threat Scan. Malwarebytes specifically targets PUPs and browser hijackers that traditional antivirus might miss. Let it quarantine everything it finds. Follow up with a scan from your existing antivirus if you have one, or use Windows Defender's offline scan feature (Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan). This catches any components the first scan missed.
Check Browser Shortcuts
Right-click your browser shortcuts on the desktop and taskbar and select Properties. Look at the Target field — it should end with the browser executable name (chrome.exe, firefox.exe, msedge.exe) and nothing else. If you see additional parameters after the .exe, especially URLs or command-line switches you didn't add, remove everything after the .exe path. Some hijackers modify shortcuts to force homepage settings through command-line parameters that survive browser resets.
Change Important Passwords
Because browser hijackers can intercept form data and track browsing activity, change passwords for important accounts after removal — especially banking, email, and any accounts where you store payment information. Use a different device or wait until after verifying the hijacker is completely gone. Enable two-factor authentication on critical accounts if you haven't already. This protects you even if the hijacker captured credentials before removal.
Restart Normally and Verify
Restart your computer normally (not in Safe Mode). Watch carefully during startup for any suspicious windows or error messages. Open your browser and verify that your homepage, search engine, and new-tab page are what you expect. Visit a few websites and confirm no unexpected ads are being injected. Check Task Manager (Ctrl+Shift+Esc) for unfamiliar processes consuming resources. If everything looks clean after 24 hours of normal use, you've successfully removed the hijacker.
Prevention
- Always choose Custom or Advanced installation options when installing free software. Read every screen carefully and uncheck any boxes offering toolbars, browser changes, or "recommended" additional software. The few extra seconds spent reading save hours of cleanup later.
- Download software only from official publisher websites, not third-party download portals. Sites like Download.com, Softonic, and CNET Downloads have been caught bundling PUPs with legitimate software. Go directly to the developer's website or use the Microsoft Store for Windows applications.
- Keep reputable antivirus or anti-malware software running with real-time protection enabled. Windows Defender is adequate for most users if kept updated. Consider Malwarebytes Premium for stronger PUP detection if you frequently download free software.
- Use browser extensions that block malicious sites, such as uBlock Origin or Windows Defender Browser Protection. These extensions warn you before visiting known malware distribution sites and block many malicious download attempts automatically.
- Enable click-to-play for plugins and disable automatic downloads in browser settings. This prevents drive-by downloads and forces you to consciously approve any file download, giving you a chance to notice suspicious activity.
- Keep your operating system and browsers updated with the latest security patches. Many browser hijackers exploit known vulnerabilities that have been patched in recent updates. Enable automatic updates on Windows and your browsers.
- Be extremely skeptical of update prompts on websites. Legitimate software updates come through the application itself or Windows Update, not through website pop-ups. No website needs you to "update your Flash Player" or "install a video codec" to view content in 2024.
- Review installed browser extensions quarterly and remove anything you don't actively use. Browser hijackers sometimes sneak in as legitimate-looking extensions that sit dormant before activating. If you don't remember installing it, remove it.
Bring It In
Browser hijacker removal looks straightforward on paper, but the persistence mechanisms can be surprisingly stubborn. If you've tried these steps and still see redirects, changed settings that won't stay fixed, or unfamiliar processes consuming resources, you're dealing with either a more sophisticated variant or multiple infections working together. That's where professional removal makes sense — we see these infections daily and know where hijackers hide their backup components.
Computer Repair Roswell is located right here in Roswell, Georgia, and we handle browser hijacker removal same-day in most cases. Bring your machine to our shop or give us a call at (770) 569-2918 to describe what you're seeing. We'll give you an honest assessment of whether you need professional help or can finish the job yourself with a bit of guidance. No pressure, no upselling — just straightforward tech support from people who've been cleaning infected machines for years. We're open Monday through Saturday and can usually fit urgent infections into our schedule within 24 hours.