UPhotoRun: what it is and how to remove it
UPhotoRun is a browser extension that causes unwanted commercial content to appear in places it should not. These kinds of applications are classified as browser hijackers because they change the settings and monetize user activity.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If UPhotoRun keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove UPhotoRun yourself 5 steps, about 15 minutes, no software needed.
Start the steps
UPhotoRun: summary
| Distribution | Shady websites, deceptive ads, freeware installations |
|---|---|
| NAME | UPhotoRun |
| TYPE | Browser hijacker; potentially unwanted program |
| SYMPTOMS | The search engine gets changed, ads appear where they should not |
| DANGERS | The app can lead to dangerous pages by manipulating the search results or showing ads from shady sources |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | UPhotoRun |
| Type | Search hijacker extension |
| Symptoms | An unknown program in Installed apps |
| Evidence | 5 write-ups by security sites; details still limited |
| Program | UPhotoRun |
| First seen | 22 December 2021 |
| Facts checked | 7 October 2026 |
Is UPhotoRun dangerous? What it collects
From our report of Dec 2021 · not reviewed since
The UPhotoRun extension causes unwanted pop-ups, banners, and redirects in your browser
UPhotoRun is a browser extension that causes unwanted commercial content to appear in places it should not.
These kinds of applications are classified as browser hijackers because they change the settings and monetize user activity. The ads can start appearing in the form of pop-ups, banners, links injected in the search results, or unexpected redirects.
Because the developers do not care about user privacy or security, they do not filter the ads that can appear on your screen. As a result, you might see ads with sensational content and messages that urge you to click. These can be giveaways, surveys, and free software offers.
If this happened on your family computer which your children and other family members use, it is especially important to eliminate the intruder as sometimes the ads could be promoting sites for adults. Besides, they can click on links that lead them to dangerous sites where they can get tricked into downloading other PUPs (potentially unwanted programs) or even malware.
From our report of Dec 2021 · not reviewed since
More from our earlier report on UPhotoRun
- Remove the extension in the browser settings
- Use a maintenance tool like to fix any remaining damage and optimize the machine
How UPhotoRun got into your browser
From our report of Dec 2021 · not reviewed since
On rare occasions, such apps like UPhotoRun can be downloaded from the official web stores like the chrome web store.
Even though all the applications go through an extensive review process, online stores have trouble determining what is an unwanted program. A particular browser extension could be found useful by one person and by the other one considered to be a virus.
However, official web stores are still the most reliable place for web-based apps. You just have to do your research - read the reviews, look at the ratings, and how many users it has. Browser hijackers usually have very little information about them, or they claim that the app was developed in collaboration with Google or another big tech company in the description, which is a red flag.
More commonly, browser hijackers are spread on shady websites that engage in illegal activities because they are unregulated. They are full of deceptive ads and redirects.
That is why you should never install anything from a page that opened randomly. As you can see in the picture above, this is the page that you might have seen. There is no extension name, or what it does.
The website only says that the extension is recommended and that it is available in the chrome web store, to make it seem trustworthy. The best thing you can do is avoid illegal streaming platforms, peer-to-peer file-sharing sites, and other shady sites that are unsafe.
How to remove UPhotoRun
How to remove UPhotoRun and get your search engine back
Remove the extension first.
The search settings only stay fixed once nothing on the PC can change them again.
Step 1: Remove extensions you did not add
In Chrome open
chrome://extensions, in Edgeedge://extensions, and in Firefox the menu > Extensions and themes.Remove every extension you do not remember adding, especially search, new tab, coupon, PDF, weather or video downloader add-ons. Check every browser and every profile, because each keeps its own list.
If an extension has no Remove button or comes back, a browser policy holds it (see "Managed by your organization" in the procedure below). The pages are the same on Windows 11 and Windows 10.
Chrome on Windows 11: More > Extensions > Manage extensions. Full procedure with screenshots: Remove a browser extension
Step 2: Put the search engine back
In Chrome open Settings > Search engine > Manage search engines and site search, make an engine you trust the default, and delete entries you did not add.
In Edge type
search engineinto the search box at the top of Settings and open Manage search engines; in Firefox use Settings > Search. Then check the homepage and the new tab page in the same settings, because hijackers change all three.If the wrong engine is back after a restart, an extension, a program or a policy still sets it, so finish the other steps and check again. The settings are the same on Windows 11 and Windows 10.
Chrome on Windows 11: check Search engine and On startup. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 3: Uninstall UPhotoRun
UPhotoRun is removed like any other program, from the list of installed apps. In Windows 11 that is Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and in both you can also use Control Panel > Programs and Features.
Select UPhotoRun, click Uninstall and follow the uninstaller to the end. Then look at the entries just above and below it when the list is sorted by date: bundled programs install at the same minute.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 4: Reset the browser
A reset removes what the steps above could miss:
- changed start pages
- site permissions
- hidden settings
In Chrome open Settings > Reset settings > Restore settings to their original defaults; in Edge Settings > Reset settings; in Firefox Help > More troubleshooting information > Refresh Firefox.
Tip: Bookmarks and saved passwords stay, while extensions are turned off and the search engine and start page return to the defaults.
Reset every browser on the PC, including Edge, which Windows 11 and Windows 10 always have.
Chrome on Windows 11: Settings > Reset settings. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of UPhotoRun that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of Dec 2021 · not reviewed since
Remove the intruder
Hijacker infections are quite common because people cannot distinguish them from legitimate apps.
Luckily, you can remove it the same way as any other browser extension via settings:
MS Edge (Chromium)
Once you eliminate the intruder, it is recommended to clear your browsers because of various tracking technologies. Web-based apps can use cookies to track your browsing behavior, like the websites you visit, links you click on, and things you purchase online.
Normally, they are used to personalize the user experience but they can also be sold to third parties and used to target you with ads even more. If the digital products and services you use do not have strong security systems in place, cookies can be hijacked and used for malicious purposes.
That is why it is crucial to regularly clean them and is a perfect tool for that. It can clear your browsers automatically without you having to worry about it. Besides, this powerful software can fix various system errors, registry issues, and corrupted files which is especially helpful after a virus infection.
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click on Uninstall at the bottom.
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select unwanted plugin and click Remove.
- Click Safari > Preferences...
- In the new window, pick Extensions.
- Select the unwanted extension and select Uninstall.
- Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
- Pick Manage Add-ons.
- You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.
From our report of Dec 2021 · not reviewed since
PUAs are the secret invaders
In some cases, removing only the extension is not enough.
You might still experience redirects, pop-ups, and banners appearing in your machine. If that is the case, you might have a PUP hiding in your system which generates commercial content and collects revenue for your clicks.
Potentially unwanted applications infiltrate the system disguised as "handy" tools or as bundled software - they come attached as a package in the installer together with the intended program. Identifying the app responsible for hijacking your browser might be difficult if you have never done this before. The program could look like antivirus software, system optimizer, media player, video, or image editing software.
If manual removal is what you still prefer, we have instructions for Windows and Mac machines:
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
To avoid the installation of PUPs, try avoiding freeware distribution sites as they include additional programs in the installers that monetize user activity. You can also choose the "Custom" or "Advanced" installation method, so no steps would be hidden from you.
Read the Privacy Policy and Terms of Use. The most important part is inspecting the file list up for the installation. Untick the boxes next to any unnecessary programs.
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till uninstallation process is complete and click OK.
- Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
- Pick the unwanted application by clicking on it once.
- At the top, click Uninstall/Change.
- In the confirmation prompt, pick Yes.
- Click OK once the removal process is finished.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
Questions about UPhotoRun
Can I safely uninstall UPhotoRun?
If you did not install UPhotoRun yourself and it is not part of your hardware or a program you rely on, yes. Uninstalling an unwanted program does not harm Windows. Before you do, search the exact name and publisher to be sure it is not a driver tool, a printer utility or a game launcher with an odd name.
Then remove it from Settings, Apps, Installed apps. Ignore any offers or warnings in its uninstaller about losing protection or performance. Afterwards check Startup apps and your browsers for leftovers, and restart once to confirm that it does not reinstall itself.
UPhotoRun came back after I uninstalled it. Why?
Something else is reinstalling it. Common causes are a second program from the same publisher, a scheduled task that downloads it again, or a browser extension that keeps prompting for it. Sort Installed apps by install date and uninstall each entry from the same day that you did not choose.
Then open Task Scheduler and look in the Task Scheduler Library for tasks with updater-style names that you do not recognise. Check Startup apps in Task Manager too. If UPhotoRun still returns, start Windows in Safe Mode, uninstall it there and run a Microsoft Defender offline scan, which looks for loaders that ordinary scans can miss.
Why can't I change my search engine back?
Because something keeps setting it. If an extension controls the search engine, Chrome and Edge show a note that an extension is controlling this setting, and your change is reverted. If a policy controls it, the field is greyed out and the browser shows Managed by your organization.
Remove the extension first, then the policies, and only then change the search engine; the change will stay. If it still reverts, look for a program in Installed apps or a scheduled task that reinstalls the extension.
Is only one browser affected?
Often not. Programs that install hijackers tend to change every browser they find, and sync can carry the extension to other computers signed in to the same browser account. Check Chrome, Edge and Firefox, even the ones you rarely use, and look at the shortcut targets on the desktop and taskbar for each.
If you use sync, remove the extension while signed in so the removal syncs too. Also check the On startup setting and the new tab page, because hijackers change those as well as the search engine.
What do I lose if I reset Chrome or Edge?
Less than you might think. A reset turns off all extensions, which you can turn back on one by one, restores the default search engine, home page, new tab and pinned tabs, and clears cookies, so you are signed out of most sites.
Bookmarks, history, saved passwords and autofill data stay. Firefox's equivalent, Refresh Firefox, keeps the same essentials but removes add-ons completely. Before you reset, make sure you know your main passwords or have them saved, since you will need to sign in again.
What is UPhotoRun?
UPhotoRun is a browser extension that causes unwanted commercial content to appear in places it should not. These kinds of applications are classified as browser hijackers because they change the settings and monetize user activity.
The summary table at the top of this guide lists the type, the detection names, the symptoms and the damage of UPhotoRun. Reading it first helps you decide whether your computer shows the same signs. The removal plan below it works in order, from the safest step to the more thorough ones.
Is UPhotoRun a virus?
Not in the strict sense: UPhotoRun is unwanted software, classed here as a search hijacker extension, not a self-copying virus. Security programs often label such software as adware, a potentially unwanted program or a browser hijacker.
It still needs removal, because it changes browser settings, shows ads and can lead you to unsafe pages. The larger risk is clicking an ad that leads to a fake update or scam page.
How did UPhotoRun get on my computer?
Our report lists the distribution as shady websites, deceptive ads, freeware installations. Software of this kind often comes bundled with free programs, fake updates or downloads from unofficial sites.
It can also arrive through a browser extension or a notification you allowed on a spam page. Think back to what you installed or allowed just before the first ad or redirect appeared.
Will Fortect remove UPhotoRun?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For UPhotoRun, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Cisco: What Is Malware? (read October 7, 2026)
- Wikipedia: Freeware (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)
- Microsoft Learn: How Microsoft names malware (read October 7, 2026)