Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

This page aims to help you remove Amazon Assistant aa.hta “Virus” pretender. Our removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

If you like to use Amazon for your online purchases and rely on them for the best deals and most convenient shopping experience, then you’ve likely heard of Amazon Assistant. It’s a browser extension provided by Amazon, which basically acts like your personal assistant. It can help you compare prices, be aware of the latest offers and deals on the site and even keep track of your current orders. There are a bunch of useful features that this tool can supply you with and most users are happy to work with it. However, where there’s a useful program or add-on, there’s usually a fake lurking somewhere nearby, imitating it. Just like most edible mushrooms tend to have a poisonous lookalike, Amazon Assistant has its evil doppelganger in the form of a program called Amazon Assistant aa.hta “Virus” pretender. This is not the helpful and friendly browser extension provided by Amazon and therefore, you’d be better off removing it as soon as you’re done reading this article. We’ve provided a removal guide here specifically for that purpose.

What does the Amazon Assistant aa.hta “Virus” pretender do really?

Amazon Assistant aa.hta acts as a browser hijacker and tends to change the homepage and default search engine of your Chrome, Firefox, Edge, Explorer or other popular browser. Furthermore, it also tends to initiate frequent page redirects to various sponsored pages, which can be pretty annoying and really start interfering with your regular browsing. However, users also tend to jump to the conclusion that they’ve been infected with a virus. That’s not entirely accurate. Moreover, browser hijackers like Amazon Assistant aa.hta aren’t viruses at all and possess no actual harmful traits that could damage your system. For example, they are incapable of corrupting your files, encrypting or otherwise altering them like Trojans and ransomware can do, for example. Nevertheless, there are still several aspects of programs like this, which may not make them all that desirable to keep on your system.

For one, browser hijackers are known for their ability to administer certain changes to your system’s Registry keys. Such alterations could potentially make your PC more vulnerable to external threats such as viruses and other malware. And that’s certainly not the kind of exposure you would like to have, you can trust us on that. Another thing is that programs likes this also often tend to display fake warnings and popup notifications informing you of outdated software, detected threats and other such things. On some occasions, clicking on a notification like this or following its link may land you on a malicious or shady website that may also infect you with something undesirable to say the least. Then last but not least, programs like Amazon Assistant aa.hta are also often designed to look through your browsing history and extract certain information from it that can later be used for marketing purposes. It can then be sold to third party marketing companies, for example, for additional profit. Alternatively, the developers may use it for their own advertising purposes.

How these programs get distributed

One of the main questions that users ask themselves when they find out they’ve been infected by a browser hijacker or similar program is: where did it come from? And you’re probably not going to like the answer, but chances are you probably installed it yourself, without even realizing it. Amazon Assistant aa.hta usually relies on program bundles for its distribution. For instance, you may have downloaded a program recently from an open source download site or similar file-sharing platform. The hijacker was most likely bundled in its setup, which is typically not openly advertised exactly for the purpose of stealth installation. If you run the installation wizard of a program bundle like that using the default or automatic settings, you will be sure to install all the contents of the bundle alongside your main program. This can very easily be avoided if users would just spend the extra minute and additional few clicks on the advanced or custom settings. These will allow you more control over the installation process and will give you more freedom to determine what goes where and so on. But more importantly, these options will also give you a full list of all the added programs, from which you will be able to remove all those that seem untrustworthy or unnecessary to you.


Name A program pretending to be Amazon Assistant/aa.hta
Type PUP/Browser Hijacker
Danger Level Low or Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms Usually a changed browser homepage or new default search engine is what would suggest the presence of this hijacker
Distribution Method Mainly with the help of program bundles thatg are typically distributed on file-sharing and open source download platforms.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version. More information about SpyHunter and steps to uninstall.

Amazon Assistant aa.hta “Virus” pretender Removal

If you are a Windows user, continue with the guide below.

If you are a Mac user, please use our How to remove Ads on Mac guide.

If you are an Android user, please use our Android Malware Removal guide.

If you want to remove the legitimate Amazon Assistant Browser extension proceed to the bottom of the following removal guide.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)


Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)
Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result
Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)ClamAV
Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)AVG AV
Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)Maldet

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Hold together the Start Key and R. Type appwiz.cpl –> OK.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Properties —–> Shortcut. In Target, remove everything after .exe.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)  Remove Amazon Assistant aa.hta from Internet Explorer:

Open IE, click  Amazon Assistant aa.hta “Virus” Removal (March 2019 Update) —–> Manage Add-ons.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Find the threat —> Disable. Go to Amazon Assistant aa.hta “Virus” Removal (March 2019 Update) —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update) Remove Amazon Assistant aa.hta from Firefox:

Open Firefoxclick  Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)  ——-> Add-ons —-> Extensions.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Find the adware/malware —> Remove.
Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)Remove Amazon Assistant aa.hta from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Rename it to Backup Default. Restart Chrome.

Amazon Assistant aa.hta “Virus” Removal (March 2019 Update)

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!

To uninstall the legitimate Amazon Assistant browser extension:

  • Review Step 2 of the guide above and execute the explained sequence of actions carefully.
  • After that review Step 5 of our guide above and repeat the sequence of actions carefully and methodically.
  • You should be all set with the uninstall of Amazon Assistant, however we are open to your questions if you face any troubles!

About the author


Violet George

Violet is an active writer with a passion for all things cyber security. She enjoys helping victims of computer virus infections remove them and successfully deal with the aftermath of the attacks. But most importantly, Violet makes it her priority to spend time educating people on privacy issues and maintaining the safety of their computers. It is her firm belief that by spreading this information, she can empower web users to effectively protect their personal data and their devices from hackers and cybercriminals.


  • I just had this issue, and after half an hour of ******* around with safe mode and trying to figure it out without damaging my files or having to pay for a cleaning sofware, I found that the free version of CCleaner (that I already had on my PC) got rid of the problem in minutes. No safe mode required either. So you know… this is kinda making it more complicated than needed.

    • In this case you were able to fix the issue that way but it might not always be as easy. We just offer a manual and thus more detailed way of finding and eliminating the unwanted software from your PC in case other methods fail or in case the user doesn’t want to use any removal software.

Leave a Comment