Aliexpress virus: what it is and how to remove the redirects and ads
The Aliexpress virus is adware that sends your browser to AliExpress pages and fills it with AliExpress-style ads; the shop itself is genuine and is not the infection. The answer is to find and remove the program or extension that came with free software, using the steps below.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If redirects to aliexpress.com keep coming back, a free scan can check extensions, programs and browser settings in one pass.
Do it yourself · free Remove Aliexpress virus yourself 1 step, about 5 minutes, no software needed.
Aliexpress virus: summary
| Type | Adware (potentially unwanted program) that redirects the browser to AliExpress pages and shows AliExpress ads; AliExpress itself is a genuine shop |
|---|---|
| Risk | Medium: redirects and ads on every site, and phishing lookalikes of the shop if a redirect ends on the wrong page |
| Symptoms | Redirects to shopping sites, AliExpress pop-ups, random words turned into links, a slower PC |
| How to get rid of it | Scan with Microsoft Defender (full and offline), uninstall programs added by the free software you installed, remove unknown extensions, reset the browser (steps below) |
| Our check (6 October 2026) | Plain requests to the three 2018 addresses: 404, 500 and an affiliate-tracking redirect; no browser test, one visit, clears nothing |
| First reported by us | 25 January 2018; reader questions about the redirects go back to November 2015 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| aliexpress.com registered | 16 April 2006 (registry record); the adware borrows the shop's name, not the other way round |
|---|---|
| Spread by | Bundled free software; PCrisk also lists deceptive pop-ups and fake Flash Player installers |
| Microsoft detection | No Microsoft detection name is known for this adware; Defender can still flag the bundled program itself |
| Evidence | Our 2018 report and its two screenshots, reader questions from 2015 to 2016, the registry's record, our October 2026 request check |
| Name | Aliexpress virus |
| Domains | aliexpress.com |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| First seen | 25 January 2018 |
| Distribution | Typically ad scripts on free streaming, file-hosting and adult sites, typo domains and hacked websites |
| Damage | Redirects to scam pages, fake updates and tech support scams |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026: plain web requests to three AliExpress addresses and the registry's RDAP record for aliexpress.com. We did not run a browser test and did not test any adware program; the adware's behaviour is from our 2018 report, reader questions and PCrisk.
What the Aliexpress virus is and how it works
There is no program called Aliexpress virus, and AliExpress is a genuine online shop. The name describes adware that sends your browser to AliExpress pages or fills it with AliExpress-style ads, usually after you installed something else. The shop is not the infection; the program or extension that sends you there is.
- 1
Free software arrives with extras
The adware usually comes inside a free or shareware installer. If you click through the Recommended or Quick setup, extra add-ons are installed along with the program you wanted.
- 2
The browser starts to be redirected
Pages open on an AliExpress address such as
superdeals.aliexpress.comorbest.aliexpress.comthat you did not type, or a pop-up shows sponsored AliExpress products on sites that never carried ads. - 3
The offers are bait
The adware can show discount coupons that lead to survey pages asking for personal details, price comparisons that are not real, or a lookalike of the shop that is not AliExpress at all.
- 4
The PC slows down
The program keeps processes running in the background and, according to our 2018 report, adds links to ordinary text on the pages you read. Each browser on the PC may carry its own copy of the add-on.
- What it is
- Adware, a potentially unwanted program (PUP); not a virus in the technical sense
- Addresses in the 2018 report
- activities.aliexpress.com, superdeals.aliexpress.com, best.aliexpress.com; the report adds that other domains can be used
- How it spreads
- Bundled with free software; PCrisk also lists deceptive pop-up ads and fake Flash Player installers
- Typical signs
- Redirects to a shopping site, AliExpress ads on every page, random words turned into links, a slower PC
- What it does not do
- Visiting aliexpress.com itself does not infect the PC; the adware on the PC is the cause
If your browser (Chrome, Firefox, Edge or another) keeps redirecting you to a shopping site or shows AliExpress ads you did not ask for, treat that as the main symptom that adware is installed on the PC.
Is Aliexpress virus dangerous?
Our check on 6 October 2026
The adware lives on the PC, not on the shop's website, so a visit to aliexpress.com cannot show whether you are infected. We only asked the three addresses from the 2018 report what they answer today. This was one plain request each, not a browser visit, and a quiet result clears nothing.
Three AliExpress addresses · plain web request · Europe · 6 October 2026
- activities.aliexpress.comAnswered with status 404 (page not found) for its front page.
- superdeals.aliexpress.comAnswered with status 500 (server error) for its front page.
- best.aliexpress.comAnswered with a redirect (status 302) to an
s.click.aliexpress.comlink that carries an affiliate tracking key and the targetbest.aliexpress.com. So the address sends the visitor on through a tracking link before showing the shop. - Registration of aliexpress.comRegistered 16 April 2006, paid until 16 April 2030, last record change 28 August 2026 (registry RDAP). The registry record does not name the owner to us.
- Not testedA browser visit, notification requests, pop-ups, other countries, phones, a visit that arrives from an ad or a bundled program, a second visit. Adware pages and ad chains often show their offer only to some of these.
The shop is real, the redirects are not The addresses belong to a genuine shop and our requests found nothing to remove on the site. That says nothing about the program on your PC that sends you there: if redirects or ads appear, clean the PC and browser.
The tracking link on best.aliexpress.com fits the old report's remark that adware uses these domains to earn advertising revenue. We cannot tell who is paid for a click, so we state only what the request returned.
How the Aliexpress redirects were reported
16 April 2006
The aliexpress.com name is registered
The registry records this as the registration date of the domain. The shop's own address is much older than the adware that borrowed it.
November 2015
First reader questions
A reader asked how to stop coupons from DealNinja, AliExpress and Alibaba arriving on every site; another asked how to delete
Activities.aliexpress.compop-up ads from Chrome.December 2015
Search hijackers that redirect to the shop
Readers described
surfpageing.comset as their start page andGo.goadvs.comads sending them to Alibaba and AliExpress pages they did not want.January 2016
Another ad domain forces the shop
A reader reported that
Addg.xyzpushed an AliExpress page, slowed the PC and showed ads related to the words they had searched for.October 2016
Superdeals pop-ups
A reader reported daily pop-ups loading
Superdeals.aliexpress.com, which the 2018 report calls a second version of the same adware: the same aggressive commercial content, but a different domain.January 2018
Our report: three versions of the adware
We described redirects to
activities.aliexpress.com,superdeals.aliexpress.comandbest.aliexpress.com. The first picture is from that report: three browser windows, the top one onsuperdeals.aliexpress.com, the middle one onbest.aliexpress.comand a third one still loading a page fromn.clickforms.ruthat carried a Featured Brands banner. Both AliExpress addresses carry affiliate tracking labels (aff_platform) in the address bar.
The 2018 report's picture of the redirects: two AliExpress addresses with affiliate tracking labels in the address bar, and a third page from another domain still loading. January 2018
The ad pop-up the adware showed
The main picture at the top of this page shows the other face of the adware: a pop-up headed Awesome Deals For You with three sponsored products priced $9, $14.27 and $14.54, marked Sponsored ads, over the same two AliExpress pages. The woman is a stock photo added by us as decoration in 2018.
6 October 2026
Our check of the three addresses
activitiesanswered 404,superdealsanswered 500 andbestredirected through an affiliate tracking link. We cannot tell from outside whether any PC is still being sent there.
The later versions differ only in the domain the browser is sent to: the 2018 report says the redirect to Superdeals.aliexpress.com is itself a warning that adware has got in, and that the other characteristics stay the same. It can show pop-ups and ads that look like useful shopping offers or discounts. That lowers the browsing experience and may put your security at risk.
Real AliExpress or a fake: check the address first
Before you log in or pay on any page that looks like AliExpress, read the address bar. If it is not an aliexpress.com address that you reached on purpose, do not trust it.
| What you see | What it can mean | What to do |
|---|---|---|
| A coupon or discount code that opens a survey asking for your name, phone or card | Fake discount coupons that lead to questionable sites, the 2018 report says; the survey is the real aim | Close the tab and do not fill anything in |
| A price comparison panel or toolbar on a shop page you did not install | Fake price comparison shown by the adware | Check your extension list (steps below) |
| A page that looks like AliExpress but the address ends in another domain | A phishing page that copies the shop, built to steal login details | Do not log in; type the shop's address yourself |
| An AliExpress address you did not type, arriving after you opened another site | A redirect from adware or an ad chain, even when the page itself is genuine | Treat it as a sign of adware and clean the PC |
Do
- Type the shop's address yourself or use its own app when you want to shop.
- Read the whole address, not only the first letters, before you log in.
- Use a payment method that lets you dispute a charge.
Don't
- Log in on a page that you reached through a pop-up or a coupon.
- Enter bank, card or login details on a survey page.
- Assume that an AliExpress page is safe just because the shop is real: the page may only be the endpoint of a redirect.
How the adware gets in: bundled free software
Adware that causes redirects and aggressive ads is usually added to software bundles, free or shareware downloaded from various online sources. It gets in because the installer's easy option hides what else comes with it.
- 1
You download something free
A tool, a player or a converter from a site that is not the maker's own. The installer is a bundle, with the add-ons packed inside it.
- 2
You choose Recommended or Quick
This option does not openly list the extra add-ons. By clicking through it you give permission to install the whole package without knowing what is hidden in it.
- 3
Nothing seems to happen
The adware installs quietly. The first sign is the first unwanted redirect or AliExpress ad, sometimes days later.
PCrisk adds two other routes for this redirect adware: deceptive pop-up ads, and fake Flash Player installers. Adobe ended Flash Player in 2020, so any installer that claims to update it is not genuine.
The real risks, from most to least serious
AliExpress itself is not dangerous to visit; the harm comes from what the adware does on your PC and from the fakes it can lead to.
- High
Phishing pages that copy the shop
Some redirects can end on a page that looks exactly like AliExpress. If you log in there, the login details and any card number go to the page's owner, not to the shop.
- Medium
Survey pages that ask for personal details
Fake discount coupons can lead to pages that ask you to fill in a survey or enter personal information to claim a prize. The 2018 report lists personal details, banking information and card details as the data these programs may try to get; we did not confirm that for any one program.
- Medium
Ads on every website and hyperlinks inside ordinary text
The adware can display ads on each website you visit and turn random words in the text into links. Clicking these can take you to more redirects or more unwanted software.
- Low
A slower PC and a worse browsing experience
The adware runs processes in the background, which makes the system sluggish. PCrisk lists decreased performance and browser tracking as the typical damage.
How to remove Aliexpress virus
How to stop the Aliexpress virus redirects
Work in this order and test a few links after each step, so you know which one was the cause.
Which browser shows the ads?
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself, especially ad blockers, "search" or PDF helpers added recently.Full procedure with screenshots: Remove a browser extension
Clear the site data
Press Ctrl + Shift + Delete, choose All time, tick Cookies and other site data and Cached images and files, and click Delete data.
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm with Reset settings. This resets the start page, search engine and pinned tabs and turns off extensions; bookmarks and saved passwords stay. To stop notifications after you close Chrome, also turn off Settings > System > Continue running background apps when Google Chrome is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove extensions you do not recognise
Paste
edge://extensionsinto the address bar and click Remove under anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear the site data
Open Settings > Privacy, search, and services > Delete browsing data > Choose what to clear, set All time, tick Cookies and other site data and Cached images and files, and click Clear now.
Reset Edge
Open Settings > Reset settings > Restore settings to their default values and confirm with Reset. Extensions are turned off and the start page goes back to default; favourites, history and saved passwords stay. To stop notifications after you close Edge, turn off Settings > System and performance > Continue running background extensions and apps when Microsoft Edge is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove add-ons you do not recognise
Paste
about:addonsinto the address bar, open Extensions, and choose Remove from the three-dot menu of anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear cookies and site data
Open Settings > Privacy & Security > Cookies and Site Data > Clear Data, tick both boxes and click Clear.
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed and the home page goes back to default; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Take back any notification permission
Safari 18 and later on macOS: open Safari > Settings > Websites > Notifications, select any site you do not recognise and set it to Deny, or click Remove. Untick Allow websites to ask for permission to send notifications at the bottom so no site can ask again.
Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install yourself and click Uninstall.
Clear the site data
In Safari > Settings > Privacy > Manage Website Data, remove the site's data, or use History > Clear History > all history. To empty the cache as well, turn on Show features for web developers in Settings > Advanced and choose Develop > Empty Caches.
Check the Mac for apps from the ads
Ads also target Mac users with fake players and "cleaners". In Finder > Applications, move anything unknown to the Bin. In System Settings > General > Login Items & Extensions, remove unknown items. Then use Go > Go to Folder to check
/Library/LaunchAgents,~/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor folders and files with the same unknown names, and empty the Bin.
Then, whichever browser you use
Step 1: Scan the PC if you downloaded anything from the ads
Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep the ads from coming back
How to remove the Aliexpress redirects and ads
The quickest way back to normal browsing is to scan the PC with up-to-date security software and then remove what the scan did not catch. Manual removal is also possible: you uninstall programs and browser extensions that may be related to the adware, remove related entries and reset the browsers that were affected.
- 1
Update Microsoft Defender, then scan
Open Windows Security > Virus & threat protection > Protection updates and update first: outdated tools may not identify this threat. Then run a Full scan, and after it the Microsoft Defender Antivirus (offline scan) under Scan options, which restarts the PC and runs before Windows loads. You can use another reputable security product the same way.
- 2
Uninstall programs from the day it began
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall anything you did not choose, especially free tools installed around the first redirect. Confirm if User Account Control asks. The old Control Panel route (Uninstall a program) does the same on Windows 7 and 8 (Uninstall a program or app in Windows On uGetFix).
- 3
Remove the extensions
Adware components may sit on the PC and also in every browser installed on it, so check each one. In Chrome open More > Extensions > Manage extensions and click Remove on anything you did not choose (). The tabs above give the steps for Edge, Firefox and Safari.
- 4
Clear the site data and reset the browser
Use the clear-data and reset steps of each browser above; they remove leftover settings, search engines and start pages the adware set. Bookmarks and saved passwords stay.
- 5
Change passwords you typed on a redirected page
If you logged in or entered a card number on a page you reached through a redirect, change that password now and tell your bank about the card.
Take a copy of your important files before a major clean-up. On a Mac, moving an app to the Bin is not always enough, because adware leaves files for persistence; the Mac tab above lists the folders to check.
How to keep it from happening again
Nearly every case starts with an installer. These habits cut that route and the damage of the clicks that still get through.
Do
- Download software from the maker's own site or the system's store, and choose reliable sources; the 2018 report also advised this.
- When an installer offers Custom or Advanced setup, choose it, go slowly and untick every pre-selected "additional download": bundling only works when nobody looks.
- Keep Microsoft Defender running and its protection updates on, and keep Chrome's Enhanced protection or Microsoft Defender SmartScreen turned on.
- Keep a current backup of your files (File History or OneDrive), so an infection does not cost you your documents.
- On public networks, a VPN hides your IP address from the sites and ad networks you visit; it does not block ads or malware.
Don't
- Choose the Recommended or Quick install of a free program without looking at what it adds.
- Download from pop-ups or from pages that tell you to update Flash Player.
- Click a coupon or discount banner that sends you to a survey.
- Trust a page only because it looks like the shop; read the address.
Questions about Aliexpress virus
Is the Aliexpress virus real?
Yes, but the name is misleading: it describes adware, not the AliExpress shop. The shop is a genuine online store, and visiting it does not infect a PC.
The problem is a potentially unwanted program or browser extension, usually installed with free software, that redirects your browser to AliExpress pages or fills it with AliExpress ads. Our 2018 report named three addresses it used:
- activities.aliexpress.com
- superdeals.aliexpress.com
- best.aliexpress.com
If your browser keeps opening such pages or showing ads on every site, treat it as adware on the PC and follow the removal steps on this page.
Is AliExpress a virus or a scam?
No. AliExpress is a genuine shopping platform, registered as aliexpress.com since 16 April 2006, and our October 2026 check found its addresses answering normally or redirecting to the shop. The scams use its name:
- fake sites that look like it
- coupons that lead to surveys
- adware that sends you to its pages
The 2018 report says the key check is the domain name: if it is not Aliexpress.com, do not trust it. Always type the address yourself or use the shop's own app instead of a link or a pop-up.
Why does my browser keep redirecting me to AliExpress?
Most likely a program or extension on the PC is doing it. Adware redirects the browser to shopping sites and shows ads on each page you visit, and it usually arrives bundled with free software that you installed through the Recommended or Quick setup.
It can also come from deceptive pop-ups or fake Flash Player installers, according to PCrisk. A single redirect after clicking an ad proves little; redirects on many sites, extra ads and links inside ordinary text point to adware. Scan with Microsoft Defender, then check the installed apps and the extension list of each browser.
What are activities.aliexpress.com, superdeals.aliexpress.com and best.aliexpress.com?
They are AliExpress addresses that our 2018 report listed as three versions of the adware's redirect. Readers asked about the first in 2015, and about the superdeals address in 2016.
On 6 October 2026 the activities address answered with a 404, the superdeals address with a 500, and the best address redirected through an affiliate tracking link to the shop. The addresses themselves belong to the shop; what is wrong is that a program on a PC sent the browser to them. Adware can use other domains too.
How do I remove the Aliexpress virus?
Update Microsoft Defender, run a full scan, then run the offline scan, which runs before Windows loads. Next open Settings, Apps, Installed apps, sort by install date and uninstall free programs you did not choose, especially those installed around the first redirect.
Then remove unfamiliar extensions in every browser, clear the site data and reset the browser; the tabs on this page give the steps for Chrome, Edge, Firefox and Safari. Adware components can sit in each browser installed on the PC, so check them all. If you typed a password on a redirected page, change it afterwards.
Can the Aliexpress virus steal my passwords or card details?
The adware can try, and the phishing pages it may lead to certainly do. The 2018 report says such programs may try to steal personally identifiable details such as banking information, card details or login credentials; we could not confirm that for a single program, so treat it as a risk rather than a fact.
The practical danger is a page that looks exactly like AliExpress but is not on its domain: whatever you type goes to its owner. If you entered a password or card number after a redirect, change the password and tell your bank about the card.
Do I have to uninstall AliExpress to remove it?
No. The shop's own app or account is not the problem and does not need removing. Remove the adware: the program installed with free software and the extension it added to your browser.
Look in Settings, Apps, Installed apps in Windows 11 for programs added on the day the redirects began, and in each browser's extension page for add-ons you did not choose. If you are unsure which program belongs, skip the list and run the Microsoft Defender full and offline scans instead.
How do I stop it coming back?
Change how you install software. Download programs from the maker's own site or the system store, and when an installer offers Custom or Advanced setup, choose it, go slowly and untick every pre-selected additional download. The Recommended or Quick option is what lets bundled adware in.
Keep Microsoft Defender updated, keep a backup of your files, and type shop addresses yourself rather than following coupons or pop-ups. If redirects return after a clean-up, a program is still on the PC, and a new scan should be your next step.
Does a VPN stop the Aliexpress redirects?
No. A VPN hides your IP address from the sites and ad networks you visit, which helps privacy on public networks, but it does not remove an adware program from your PC or block its redirects.
The redirects are produced by the program or extension inside your browser, before any VPN matters. Remove the adware with the steps on this page. A VPN is a prevention extra, not a cure.
Will Fortect remove Aliexpress virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Aliexpress virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Verisign RDAP: aliexpress.com registration record (read October 6, 2026)
- PCrisk: Aliexpress.com redirect (removal guide) (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)
- Chrome Web Store Help: Install and manage extensions (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)