This page aims to help you remove Smartnewtab Virus. These Smartnewtab Virus removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.
Important information. Read it.
Smartnewtab Virus is a computer program strongly resembling the behavior of the type of malicious software known as Browser Hijacker. In this article we will try to explain what an Browser Hijacker software really is and how you ended up with it in the first place, along with extensive removal instructions of course.
Remove Smartnewtab Virus
Smartnewtab Virus – how does it work?
As we said you will be dealing with Browser Hijacker. This type of viruses are characteristically going to put you through a lot of advertisements – pop-ups, pop-unders, banner or even whole pages filled with Ads (short for advertisements). You can also expect a heavy dose of browser redirects. What we mean by that? When you try to open a certain web address in addition to it or instead of it another websites opens up in a new tab or in a new windows. You should stay clear off of both the ads and the websites you have been redirected to as any interaction with them increases greatly the chance that more malware is headed your way.
Smartnewtab Virus – how were you infected?
Malware spreading is an advanced practice and over time a plethora of different approaches have been developed and tried. We will list the most popular ones along with some tips on how to avoid them.
- Any time you receive a new e-mail in your inbox with an attachment in it you should be wary. Even if it is from a supposedly legitimate sender, maybe even a well-known company or your gas/phone/electricity provider. You should always check the files before downloading them (most mail clients have built-in scanners) and once again before actually opening them.
- If you are downloading from web-sharing websites or you are a fan of p2p (torrents) then you should be always careful what files are actually being downloaded onto your computer. If possible check the trust-level of the uploader first, although that is far from being a reliable barometer, and always scan the files before opening them. Especially in the case of .exe files, you just don’t know if that is not a malicious application disguised as something else.
- Software bundles. The most likely scenario in which you ended up with Smartnewtab Virus. In other words the inclusion of additional programs inside the installer of a program or any type of software actually, that you decided to install. Mostly the program would be a free one and the only way for you to prevent this if you select advanced installation options and carefully review and untick anything that might be different from your initial selection.
Before starting with Step 1 of our removal guide take the time to read this as it will spare you some questions that might pop-up during the removal process. The important thing to understand and remember is there are different “versions” of Smartnewtab Virus floating around the web space. There are different reasons for this, though it is mainly to make it harder for removal guides and blogs to prepare a universal removal solution. It is true that our task has been made especially hard as a result but we have done our best to comply complete and extensive removal instructions. You may find some parts to be redundant or completely irrelevant to your particular problem, if that is indeed the case do not be immediately alarmed by skip these parts and continue with the rest. If you have questions or tips, use the comments section. We are always open to feedback from our readers.
SUMMARY:
| Name | Smartnewtab |
| Type | Browser Hijacker |
| Detection Tool |
Remove SmartNewTab Virus
Search Marquis is a high-profile hijacker – you might want to see if you’re not infected with it as well.
Hello Oana,
You should delete all lines that contain these URLs – they were added by the virus. Don’t forget to save the changes to the Hosts file after you do it!
Please let me know if it worked or if you are having any problems.
Hello Fiona,
Yes, you should be safe now.
Please let me know if the virus resurfaces. These things constantly change.
Hi again,
Yes, if you have a restore point before the computer was infected you can use it to get rid of the virus. It works most of the time.
Did you manage to remove SmartNewTabs?
There hasn’t been any pop-ups or redirects ever since I first commented so I think it’s gone. I’ll do a system restore just in case. Thanks for all the help!
Glad we could help 🙂
what are these?
http://prntscr.com/a010w2
Hi,
Nothing good I am afraid – these are domains for the pop-up tabs. Delete all of these lines, then save and close the file.
Let me know if you have any problems or the viruses remains after you finish with the guide.
Um, i need to save it as file .txt ?
Um should i save file as .txt ?
Hello,
Yes, you should save and overwrite this file as a .txt Hosts file.
If you have any problems with that let me know.
Hi Leonardo,
Did you turn on Safe Mode first? Also you specifically open the file as administrator – locate in on your computer, right click on it, select properties and set it to work as an administrator from there.
Did that help?
I did everything and i contiune having smartnewtab popups. I have even uninstalled Chrome and installed Firefox and in Firefox I still have this Smartnewtab. I don’t know what else i can do
Hi Victor,
If you reinstalled your browser and still get the Ads this means you likely missed something within the guide. Are you sure you did all the steps in the order prescribed?
Let me know when you re-do them or if you are absolutely sure you havn’t missed anything.
Hi again,
It is really hard for me to blind-guess the reason if you’ve done everything already.
What you can do is download SpyHunter from one of the banners on this page. The system scan is free to use, so please do it and tell me the result.
Glad I could help!
Hi bro,
I am also a victim of this.I will try the given method. I just want to know, why these guys inject the virus into the downloads? Will they get paid for that? I m very curious about this, please give me if you have answer
Thanks,
Vinod
Hi Vinod,
These people earn money every time someone clicks on the Ads or buys something. It may time for some people to realize they’ve been infected and that’s what they rely on.
I have these:
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
Hello there, you need to delete all those lines from the file, then save it.
Hi, what you need to do is simply delete those lines from the file, then save it. If you don’t get permission to do that first run Notepad as an admin (search for notepad in windows search,, right click on exe-> run as admin) and then open the Hosts file from the inside menu of Notepad: File->Open. Navigate manually to the file.
Then skip safe mode and proceed with the guide. If any one step does not apply, go ahead with the next. The creators of these things often attempt to switch things to make removal guides redundant.
Great catch – I’ll use this in the guide. Thank you 🙂
Hello,
You can try a little trick. Save the file to another location, for example your desktop. Then use this newly saved file to replace the one in the original location. Let us know if that helps.
I encountered these IP other than local host . please help me out . I have successfully removed some of the contents just tell me how to reset edge browser .
127.0.0.1 union.baidu2019.com127.0.0.1 http://www.czzsyzxl.com127.0.0.1 http://www.czzsyzgm.com127.0.0.1 123.sogou.com127.0.0.1 down.baidu2016..com
Hello,
You definitely have to delete these entries from your hosts file.
Hi Ashwin,
I am going to need a little more details. Which part of the guide didn’t work for you? Did you do everything from there?
Hi there, sorry for the delay.
If you are absolutely sure you’ve tried everything, then it is a good idea to give some anti-malware program a try.
Grab SpyHunter and run a system scan. Even if you don’t want to buy the software it can pin-point you to the folder hosting the virus files.
Hi Akshat,
You should delete those lines from the file.
If you experience any problems with permission rights do the following:
Search for Notepad in Windows search -> right click on the executable and select Run as Administrator.
From inside Notepad click on the File-> Open menu and navigate to the hosts file
You should now be able to save the file properly.
Hi Pawar, in which steps did you find presence of the virus?
Hi Vishesh, what language is your windows installed in? Do you see the chinese letters only at the end of the file?
Hi Naman, delete all of these from your file. Let me know how it goes.
Hi Sourav, all of these are legit. Your problem lies elsewhere.
Hi anurag, you should delete all of these lines from the file.
The file should be there. Did you reveal hidden files?
Hi there, you should delete these lines from the file. If you don’t get access permission try searching for Notepad first -> right click run as admin and open the Hosts file from the inside Open menu.
Hi,
I don’t find these entries to be malicious but if you have any doubts you can always just copy/paste the contents of your hosts file into another .txt file (make a back-up of sorts) and delete them from hosts. If you are not happy with the result just paste them back.
Hi,
What browser are you using? Do you have problems with a single one or with a number of them?
I’m using google chrome and opera. Every time I’m on any website even on youtube videos i clicked smartnewtab appears every single time.
Hi Vatsal, did you go though the steps of the guide already?
Yes i did!
Can you tell me in which steps did you spot the presence of the virus?
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
127.0.0.1 union.baidu2019..com
Our team found out that these are actually local hosts and they are legit, so don’t worry about them.
though i removed, they still appear what to do
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
127.0.0.1 union.baidu2019..com
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
127.0.0.1 union.baidu2019..com
Hi Parvathy,
these IPs are legit. We researched them and they are harmless. Contact us if you have other questions.
Hi. I’ve got some of those Suspisous looking local hosts on step 3… HELP!
Hi David,
can you post us a screenshot or Copy/Paste some of them here so w can check them ?
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 http://www.czzsyzgm.com
127.0.0.1 http://www.czzsyzxl.com
should i just delete them from the notepad file?
Hi David, there is no need to delete entries starting with 127.0.0.1. Do you have anything else in there?
I have something suspicious in the local hosts file @step 3
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
Hi Bishwarup,
you should definitely delete these IPs.
Hi Mikka,
yes. You have to complete every step in Safe Mode.
is jamben folder one of the virus??
Hi megat,
do you remember installing program with that name ? Or do you use it by chance?
i dont remember…..
i dont remember, sorry…
Hi Mickey,
you should delete that IP. Do you have more like this one? If you have, post them in the comments again to check them.
Them that is it. Did you menage to complete the whole guide ?
I did, and so far, I’ve gotten rid of the virus 😀
Congratulations Mickey ! Remember if you find anything suspicious, we are here to help 🙂
Thanks so mvch guys, im forever greatful 🙂
You are most welcome Mickey. Remember we are here to help 🙂
You are most welcome Mikka. Remember if you have any suspicious activities on your system we are here to help 🙂
Hi Coats,
did you execute the steps in Safe mode?
Hi Coats,
did you execute every step in Safe Mode ?
Yes. :C
Hi again,
at this point i suggest to you to download our software from one of the banners above and use the free scan feature. The scammer will locate any infected file where you can delete it manually. Keep us posted if you need further assistance.