Regaining Control Over Edge

Regaining Control Over Edge

With the public introduction of Windows 10 and its default browser, Edge, we have noticed that quite a few people have run into this predicament:

If Edge is set to start with the same tabs that were open when it was last closed (Previous pages), and you happened to get redirected to a site that locks up your browser (e.g. Browlock), there is no easy way to escape the infinite loop that keeps reopening Edge with the locked page.

previoussetting

As I was searching for a fix to this, I have found several solutions that were aimed at breaking the connection with the site that has the browser locked, like adding the site to your  HOSTS file, putting the computer in “Airplane mode”, or simply terminating the internet connection.

But when trying these, they didn’t work for me, probably because the site is in the cache and since there is no way to clear this if you can’t access the Settings menu, you are still stuck.

So I looked in the registry for the “Startpage” values and I found this little gem where Microsoft tells us it is against Windows policy to make alterations:

protected

Now I’m a Microsoft MVP and have been for 12 years and I’d like to keep it that way, so I stayed away from that key. Besides, the underlying values look like they are encrypted.

Another proposed fix I found was to delete this key in its entirety.

HKEY_CURRENT_USERSOFTWAREClassesLocal SettingsSoftwareMicrosoftWindowsCurrentVersion AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbwe 

–which may be fine if you have just started using Edge, but I would never recommend doing that. If you have changed some settings and got it tuned just the way you like it, I think that solution would cause a complete reset of all Edge’s settings to default, if not worse.

And then I found this article about How to Stop Edge Browser From Restoring Tabs After a Crash. That looked promising so I started testing. I disabled my protection and went to a known Tech Support scam site that is in our blocklist.

browlocksite

The key mentioned in that article is used to determine the behavior of Edge when restarting after a crash. Terminating Edge via the Task Manager is also treated as a crash, and that is the only way the trapped user can close that hijacked tab anyway.

The key that is discussed in the article is this one.

HKEY_CURRENT_USER/Software/policies/Microsoft/MicrosoftEdge/Recovery 

And it is not present by default, so it has to be created and populated with the “AutoRecover” value.

The registry fix

I have tried to simplify the method outlined there a bit, so users don’t have to edit the registry manually. (Always make sure you have a working backup if you should decide to do so anyway.)

If you are simply looking for a fix, you can find it on our forums including a zip file containing the two registry files that you can merge to turn the AutoRecover function on and off.

Please note that this fix was written explicitly for Windows 10 and Edge. If it helps in other cases that is pure coincidence.

To recover Edge with just one tab, merge the following registry file with the registry:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoftMicrosoftEdgeRecovery] "AutoRecover"=dword:00000002

To recover Edge with the “Previous pages” or better put, to have it follow the behavior specified under Settings again, you have to set that value to 0, as illustrated below:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoftMicrosoftEdgeRecovery] "AutoRecover"=dword:00000000

To be on the safe side, I would wipe the browser cache after getting Edge to work again properly.

Note that there are many security solutions out there that stop you from ending up at such sites, like Malwarebytes Anti-Malware Premium with Malicious Website Protection enabled.

protection2

Other browsers

Other browsers are much easier to take out of such a loop, because they either stop repeating the popup at some point without you having to close the browser, or allow the user to open a second instance of the browser with which you can access the settings. We can only hope that Microsoft Edge will follow suit soon.

Summary

Getting stuck in a loop is no fun especially when it makes your browser unusable. Microsoft Edge has a bigger chance of that happening due to its default settings and not so adequate protection against “Browlock” and similar sites. We have found a way to get out of such a loop, but we would prefer a solution that doesn’t get us in there in the first place.

Pieter Arntz

ABOUT THE AUTHOR

Pieter Arntz

Malware Intelligence Researcher

Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.