Browser Redirect

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Parasite may reinstall itself multiple times if you don't delete its core files. We recommend downloading SpyHunter to scan for malicious programs installed with it. This may save you hours and cut down your time to about 15 minutes. 

Download SpyHunter Anti-Malware

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

This page aims to help you remove Amazon Assistant aa.hta “Virus” pretender. Our removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

If you like to use Amazon for your online purchases and rely on them for the best deals and most convenient shopping experience, then you’ve likely heard of Amazon Assistant. It’s a browser extension provided by Amazon, which basically acts like your personal assistant. It can help you compare prices, be aware of the latest offers and deals on the site and even keep track of your current orders. There are a bunch of useful features that this tool can supply you with and most users are happy to work with it. However, where there’s a useful program or add-on, there’s usually a fake lurking somewhere nearby, imitating it. Just like most edible mushrooms tend to have a poisonous lookalike, Amazon Assistant has its evil doppelganger in the form of a program called Amazon Assistant aa.hta “Virus” pretender. This is not the helpful and friendly browser extension provided by Amazon and therefore, you’d be better off removing it as soon as you’re done reading this article. We’ve provided a removal guide here specifically for that purpose.

What does the Amazon Assistant aa.hta “Virus” pretender do really?

Amazon Assistant aa.hta acts as a browser hijacker and tends to change the homepage and default search engine of your Chrome, Firefox, Edge, Explorer or other popular browser. Furthermore, it also tends to initiate frequent page redirects to various sponsored pages, which can be pretty annoying and really start interfering with your regular browsing. However, users also tend to jump to the conclusion that they’ve been infected with a virus. That’s not entirely accurate. Moreover, browser hijackers like Amazon Assistant aa.hta aren’t viruses at all and possess no actual harmful traits that could damage your system. For example, they are incapable of corrupting your files, encrypting or otherwise altering them like Trojans and ransomware can do, for example. Nevertheless, there are still several aspects of programs like this, which may not make them all that desirable to keep on your system.

For one, browser hijackers are known for their ability to administer certain changes to your system’s Registry keys. Such alterations could potentially make your PC more vulnerable to external threats such as viruses and other malware. And that’s certainly not the kind of exposure you would like to have, you can trust us on that. Another thing is that programs likes this also often tend to display fake warnings and popup notifications informing you of outdated software, detected threats and other such things. On some occasions, clicking on a notification like this or following its link may land you on a malicious or shady website that may also infect you with something undesirable to say the least. Then last but not least, programs like Amazon Assistant aa.hta are also often designed to look through your browsing history and extract certain information from it that can later be used for marketing purposes. It can then be sold to third party marketing companies, for example, for additional profit. Alternatively, the developers may use it for their own advertising purposes.

How these programs get distributed

One of the main questions that users ask themselves when they find out they’ve been infected by a browser hijacker or similar program is: where did it come from? And you’re probably not going to like the answer, but chances are you probably installed it yourself, without even realizing it. Amazon Assistant aa.hta usually relies on program bundles for its distribution. For instance, you may have downloaded a program recently from an open source download site or similar file-sharing platform. The hijacker was most likely bundled in its setup, which is typically not openly advertised exactly for the purpose of stealth installation. If you run the installation wizard of a program bundle like that using the default or automatic settings, you will be sure to install all the contents of the bundle alongside your main program. This can very easily be avoided if users would just spend the extra minute and additional few clicks on the advanced or custom settings. These will allow you more control over the installation process and will give you more freedom to determine what goes where and so on. But more importantly, these options will also give you a full list of all the added programs, from which you will be able to remove all those that seem untrustworthy or unnecessary to you.


Name A program pretending to be Amazon Assistant/aa.hta
Type PUP/Browser Hijacker
Danger Level Low or Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms Usually a changed browser homepage or new default search engine is what would suggest the presence of this hijacker
Distribution Method Mainly with the help of program bundles thatg are typically distributed on file-sharing and open source download platforms.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version. More information about SpyHunter and steps to uninstall.

Amazon Assistant aa.hta “Virus” pretender Removal

If you are a Windows user, continue with the guide below.

If you are a Mac user, please use our How to remove Ads on Mac guide.

If you are an Android user, please use our Android Malware Removal guide.

If you want to remove the legitimate Amazon Assistant Browser extension proceed to the bottom of the following removal guide.


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



We get asked this a lot, so we are putting it here: Removing parasite manually may take hours and damage your system in the process. We recommend downloading SpyHunter to see if it can detect parasite files for you.

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 


Hold together the Start Key and R. Type appwiz.cpl –> OK.


You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:


Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.


Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.



  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).


Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Amazon Assistant aa.hta from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Amazon Assistant aa.hta from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove.
chrome-logo-transparent-backgroundRemove Amazon Assistant aa.hta from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.


To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

If you want to avoid the risk, we recommend downloading SpyHunter
a professional malware removal tool.

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!

To uninstall the legitimate Amazon Assistant browser extension:

  • Review Step 2 of the guide above and execute the explained sequence of actions carefully.
  • After that review Step 5 of our guide above and repeat the sequence of actions carefully and methodically.
  • You should be all set with the uninstall of Amazon Assistant, however we are open to your questions if you face any troubles!


  • I just had this issue, and after half an hour of ******* around with safe mode and trying to figure it out without damaging my files or having to pay for a cleaning sofware, I found that the free version of CCleaner (that I already had on my PC) got rid of the problem in minutes. No safe mode required either. So you know… this is kinda making it more complicated than needed.

    • In this case you were able to fix the issue that way but it might not always be as easy. We just offer a manual and thus more detailed way of finding and eliminating the unwanted software from your PC in case other methods fail or in case the user doesn’t want to use any removal software.

Leave a Comment