Adware:Win32/Sogou Removal: Fix Sogou Ads and Redirects

Adware:Win32/Sogou is a Microsoft Defender detection for adware that can show unwanted ads while you browse and may change browser behavior. If you see this alert, or if searches suddenly pass through sogou.com or 123.sogou.com, keep the detection quarantined, remove the app or extension that introduced it, reset browser search/startup settings, and scan Windows for leftovers if the alert or redirects return.

Sogou is also a real Chinese search, browser, and input-method brand, so the name alone is not enough to judge every file. The safety question is how it arrived, what it changed, and whether a security tool is naming Adware:Win32/Sogou, PUA:Win32/Sogou, or similar adware behavior. Do not whitelist the item just because the word Sogou looks familiar.

What Is Adware:Win32/Sogou?

Microsoft Security Intelligence describes Adware:Win32/Sogou as an adware program detected by Microsoft Defender Antivirus. Microsoft says the threat can display ads that users cannot control while browsing and lists older technical traces such as %CommonProgramFiles%\pushware\cpush.dll, %CommonProgramFiles%\pushware\uninst.exe, and Internet Explorer browser-helper-object registry changes [1]. A newer related Microsoft entry, PUA:Win32/Sogou!pz, is classified as a potentially unwanted app that can cause unexpected behavior such as added files, changed settings, slow performance, freezing, or reduced storage space [2].

In practical cleanup terms, treat Sogou adware as an unwanted browser and Windows persistence problem. The visible symptom may be a search redirect, pop-up ads, a Sogou-named program, a Sogou browser component, or a security-tool alert. The real fix is to remove the source and then check whether a browser extension, notification permission, startup item, policy, or leftover file is restoring it.

Common Symptoms

Is Sogou Always Malware?

No. A Sogou input method, browser, or search component can be intentionally installed, especially on systems used for Chinese-language typing or Chinese web services. But a legitimate brand can still be involved in an unwanted installation or be detected when a component behaves like adware. Use the situation, source, and behavior to decide.

Sogou Adware Cleanup Flow

Use the cleanup order below so you do not remove the visible browser setting while leaving the restoring component behind.

1. Remove Suspicious Sogou Or Bundle Entries

Start with Windows installed apps. Open Settings > Apps > Installed apps, sort by install date, and look for Sogou, Sogou Explorer, Sogou Search, PushWare, unfamiliar download managers, search helpers, driver updaters, coupon tools, video tools, or software installed around the same time the ads started.

1. Uninstall the suspicious app through Windows first. Do not just delete the folder.
2. If the uninstaller is in Chinese and you are unsure, pause before clicking through random dialogs. Use the app name, install date, and publisher to confirm what you are removing.
3. After uninstalling, reboot once and check whether the alert or redirect returns.
4. If Windows cannot remove the program or it immediately comes back, continue with browser and startup checks before deciding the machine is clean.

If you see Sogou adware or other suspicious applications that you don't remember installing, you should remove them as well.

2. Remove Browser Extensions And Search Changes

Many Sogou redirect cases feel like a browser problem because the visible symptom is a search or homepage change. Chrome’s own help notes that Windows or Mac applications can install Chrome extensions, and Chrome lets users remove extensions from the Manage extensions page [3]. Check every browser you use, not only the one that opened the alert.

1. Open Chrome, Edge, Firefox, or the affected browser’s extensions page.
2. Disable suspicious search helpers, coupon tools, shopping assistants, PDF/video helpers, or Sogou-named add-ons.
3. Run a few searches from the address bar. If the redirect stops, remove the extension.
4. Open browser settings and restore the default search engine, startup page, homepage, and new-tab behavior.
5. Remove unwanted notification permissions if the adware also shows fake alerts or prize pop-ups.

Open Extensions/Add-ons again and remove any entry linked to Sogou adware or clearly out of place.

If an extension returns after you remove it, treat that as a persistence problem. Our guide for an extension that keeps reinstalling itself explains how browser sync, policies, scheduled tasks, and companion apps can bring the same add-on back.

After reset, verify that Sogou adware is no longer set as your default search engine or homepage.

3. Check Startup, Policies, Shortcuts, And Notifications

Resetting the browser is not enough if something outside the browser keeps restoring Sogou settings. Check these places before you call the cleanup finished:

• Startup apps: disable unknown entries created around the same date.
• Task Scheduler: look for tasks that launch a browser, updater, script, or file from AppData, Temp, ProgramData, or Downloads.
• Browser shortcuts: right-click the shortcut and make sure no Sogou URL appears after the browser executable path.
• Chrome and Edge policies: open chrome://policy or edge://policy. On a personal PC, unknown search-provider or forced-extension policies are suspicious.
• Notification permissions: remove unfamiliar allowed sites, especially if ads appear as Windows-style notifications.

If Chrome or Edge says the browser is managed on a personal computer, use our Managed by Your Organization cleanup guide before resetting the browser again. If the symptom is many tabs opening by themselves, compare it with the browser opens multiple tabs checklist.

If Sogou adware keeps showing unwanted pop-ups, you likely granted it permission to send notifications. To stop them, you need to revoke that permission in your browser settings.

4. Scan For Adware Leftovers And Persistence

Manual cleanup can remove the visible app and browser setting, but adware often leaves behind a launcher, browser helper, scheduled task, startup entry, notification permission, or bundled component that restores the problem. A full Gridinsoft Anti-Malware scan is useful when Adware:Win32/Sogou returns after reboot, the browser keeps redirecting, the affected item is under a user-writable folder, or the issue followed a bundled installer.

Run the scan, remove detections, reboot, and scan again if symptoms return. Gridinsoft Anti-Malware can check for unwanted apps, adware files, browser changes, startup entries, scheduled tasks, and persistence. It cannot prove a computer was never exposed, and it cannot undo account theft if credentials were entered on a bad page, but it can help clear the local infection path that keeps ads and redirects alive.

If The Alert Keeps Coming Back

A recurring Sogou alert usually means one of three things: the original bundle is still installed, the browser setting is being restored, or a startup/policy entry keeps relaunching the component. Before restoring anything from quarantine, capture the detection name, path, source app, publisher, and install date.

• If the affected file is under %CommonProgramFiles%\pushware\, an unknown app folder, AppData, Temp, or Downloads, keep it quarantined and scan for the launcher.
• If the path belongs to an intentionally installed Sogou input method or browser, remove or update that program from its official source before allowing the file.
• If browser search changes return on more than one device, pause browser sync and clean each signed-in browser profile.
• If you are convinced the file is legitimate, collect the hash, source URL, digital signature, and detection name before using our false-positive reporting checklist.

What Not To Do

• Do not restore Adware:Win32/Sogou from quarantine just because Sogou is a known brand.
• Do not install random “Sogou remover” tools from search results.
• Do not delete browser profile folders before exporting bookmarks and checking sync.
• Do not ignore changed search settings if the same PC also shows fake alerts, pop-ups, or new extensions.
• Do not sign in to banking, email, or admin accounts from a browser that is still redirecting through unknown pages.

How To Avoid Sogou-Style Adware Again

• Download apps from official sources and avoid repacked installers, cracks, fake codec prompts, and driver bundles.
• Choose custom installation and decline optional search tools, browser helpers, and notification prompts.
• Review browser extension permissions before enabling an add-on installed by a desktop app.
• Keep browser sync paused while cleaning a redirect that appears on multiple devices.
• Use our broader PUA and browser hijacker removal guide if other redirect domains appear after Sogou is gone.
• For background on the category, see what adware is and how it spreads.

FAQ

References

1. Microsoft Security Intelligence. “Adware:Win32/Sogou.” Microsoft, published October 6, 2015, updated September 15, 2017, accessed July 5, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware%3AWin32%2FSogou
2. Microsoft Security Intelligence. “PUA:Win32/Sogou!pz.” Microsoft, published September 15, 2023, accessed July 5, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3AWin32%2FSogou%21pz&threatId=407434
3. Google Chrome Web Store Help. “Install and manage extensions.” Google, accessed July 5, 2026. https://support.google.com/chrome_webstore/answer/2664769