Powered by Capricornus Virus (Removal Guide)

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

This page aims to help you remove Powered by Capricornus Virus. These Powered by Capricornus Virus removal instructions work for Chrome, Firefox, Internet Explorer and Safari, as well as every version of Windows.

If you have Powered by Capricornus Virus installed on your machine then it is likely that your computer is performing poorly then usual and also that you are seeing a large number of online advertisements on every page you visit. What you are dealing with is called an Adware application and it specializes into displaying these unwanted Ads on your screen. There is no way to turn them off – your only option is to remove every trace of Powered by Capricornus Virus.

Ads by Capricornus

Powered by Capricornus Virus in your Control Panel

Fortunately for you Adwares are considered to be the least of dangers when we talk about malicious software. Powered by Capricornus Virus will not damage your computers or steal your data directly and if you follow our instructions you will be able to remove it without a trace.

Never download any software linked by Powered by Capricornus Virus

As mentioned above on its own Powered by Capricornus Virus is going to be annoying, but not exactly dangerous. Adware applications like Powered by Capricornus Virus enjoy a semi-legal status of being likely unwanted and not particularly useful, but not malicious either. This allows them to be distributed legally and also included into software packages called bundles – but more on that later. What is important to remember is that while Powered by Capricornus Virus may not be harmful on its own the Ads may link to dangerous sites and any file downloaded could be infected by a virus or trojan, so remove it immediately. Whoever developed Powered by Capricornus Virus is likely getting a premium whenever an Ad is clicked and Adware programs are not exactly known for their high quality control over the Ads displayed. It is certainly possible that no all Ads displayed are dangerous, but we do not recommend you to risk it. Ignoring everything will be your safest bet.

Powered by Capricornus Virus – method of delivery

You probably don’t recall installing Powered by Capricornus Virus on your own. This is because Powered by Capricornus Virus was part of a software bundle or was posing as a different file or program and you had no idea about its presence when you installed the executable containing Powered by Capricornus Virus.

A program bundle is actually an installer for a certain program that has a couple of more programs “bundled” inside of it.

  • This means that when you install the main program and proceed with the Default installation option the installer will assume “by default” that you also want the extra programs and install them without asking you for permission. To avoid such a situation we strongly recommend people to stop using the Default option of program installers.

Always select Advanced – it only takes a couple of extra clicks, but you get insight and control over what programs exactly are going to get installed and you also have the option of blocking any or all of the extra programs from installing. Try to always use this option, as the extra programs are seldom useful – it’s much more likely to end up with something like Powered by Capricornus Virus in your computer, because the pure time it takes to remove it is quite long.

  • Files obtained from torrents, warez and online storage sites may be particularly dangerous.

Such sites also often employ fake download buttons. If you click on the wrong button a download containing a file matching the name of the file you sought for. Unfortunately this file is a fake and the only thing it contains is a virus infected executable. Other possible problems may come from:

  • Spam email and especially their attachments. Obviously the main theme here is to confuse you into believing this isn’t spam, but something sent to you “by mistake.”

We strongly encourage anyone to shy away from opening and downloading anything from an email unless you know 100% it is legitimate.


Name Powered by Capricornus Virus
Type  Adware
Danger Level Medium
Symptoms Sudden advertisements and pop up prompts to download something; a general sluggishness of your PC
Distribution Method Software bundles, bad torrents and misleading executables.
Detection Tool Malware and Adware are notoriously difficult to track down, since they actively try to deceive you. Use this professional parasite scanner to make sure you find all files related to the infection.Sponsored


1: Enter Safe Mode.
2: Remove Powered by Capricornus Virus from Chrome, Firefox, Internet Explorer and Safari.
3: Remove the virus from browser shortcuts.
4: Uninstall the virus from your Add/Remove Programs.
5: Permanently delete Powered by Capricornus Virus from Task Manager’s processes.
6: Uninstall the virus from Regedit and Msconfig.

Powered by Capricornus Virus Removal

Things readers are interested in:



UPDATE! You can visit this article for an updated version of the guide: Remove Pop-Up Ads from Chrome/Firefox (Adware Virus)

The first thing to do is a reboot in Safe Mode. If you already know how to do it, just skip this and proceed to Step 2. If you do not know how to do it, continue reading:

For Windows 98, XP, Millenium and 7: 

Restart your computer. To be sure you don’t miss the time when you need to press it, just spam F8 as soon as the PC starts booting. Then choose Safe Mode With Networking.

For W8 and 8.1:

Click the Start button, then Control Panel —> System and Security —> Administrative Tools —> System Configuration.Administrator permission required


Then check the Safe Boot option and click OK.  Click  Restart in the pop-up.

For W10:

  1. Open the Start menu.
  2. Click the power button icon in the right corner of the Start menu to show the power options menu.
  3. Press and hold down the SHIFT key on the keyboard and click the Restart option while still holding down the SHIFT key.

W10 will perform the reboot. Next do the following:

Click the Troubleshoot icon, then Advanced options —> Startup Settings. Click Restart.
After the reboot click on Enter Safe Mode With Networking (Fifth Option).


To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

It is highly likely that all of your internet browsers bare the stain of Powered by Capricornus Virus. It is time we begin removing this bugger. To begin the process read and execute the instructions as outlined in Step 2 and Step 3 of this guide. Make sure to run them for every browser installed on your computer currently.

Also please be wary that Powered by Capricornus Virus may try to form some confirmation message on removal attempt. This message might prompt you to a survey site or may try to download another dangerous program on your PC. Close and such pages and deletes any files that download as a result of your attempt to delete Powered by Capricornus Virus.

ie9-10_512x512  Remove the Malware from Internet Explorer:

Open IE, then click  IE GEAR —–> Manage Add-ons.

pic 3

Find Powered by Capricornus Virus . Remove it by pressing Disable.

If your Home Page is different from the usual, click IE GEAR —–> Internet Options>edit the URL box with your preferred search engine, and click Apply.

firefox-512 Remove Powered by Capricornus Virus from Firefox:

Open Firefoxclick on mozilla menu (top right) ——-> Add-onsHit Extensions next.

pic 6

Powered by Capricornus Virus  should be somewhere around here –  Remove it.

chrome-logo-transparent-background Powered by Capricornus Virus Removal in Chrome:

 Start Chrome, click chrome menu icon —–>More Tools —–> Extensions. There,  find the malware and  select  chrome-trash-icon(Remove).

pic 8

 Click chrome menu icon again, and proceed to Settings —> Search, the fourth tab, select Manage Search Engines.  Remove everything but the search engines you normally use.

safari Remove the malware from Safari:

Open Safari, and click Safari —–>Preferences —–> Extensions—–>Uninstall the malware.


Right click on the browser’s shortcut, then click Properties.

NOTE: We are showing Google Chrome, but the method is the same for Chrome, Firefox, Internet Explorer, Safari, and Microsoft Edge.


Once you’ve reached Properties —–> Shortcut (on the band at the top), then in the Target type field, REMOVE EVERYTHING AFTER .exe.


Hold the Start Key and R together. Write appwiz.cpl in the field, then click OK.


You are now in the Control Panel. Search around for Powered by Capricornus Virus and suspicious-looking programs. Uninstall it/them. Also, be extremely careful. Viruses often spend one last ditch effort to trick you into installing more of their kind. If you see a screen like this when you click Uninstallchoose NO:


Hold the Start Key and R againbut this time copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A .txt file will open – don’t type or change it. If you are hacked and someone has access to your PC, there will be a bunch of other IPs connected to you at the bottom. This is what a hosts file looks like:

hosts_opt (1)

If there are a bunch of strange IPs connecting to you below “Localhost” you may be hacked, and it’s best to ask us in the comments for directions.


If you are receiving messages about being locked by the admin when you try to delete extensions in your browsers, go in C:\Windows\System32\GroupPolicy\Machine. There should be a file registry.pol. Delete that file.


Open the Task Manager by right clicking on the Taskbar and choosing Start Task Manager.


Once it opens, choose the Processes Tab. Look at all of the processes in front of you and try to determine which ones are a virus. Google them or ask us in the comments and we will provide the best assistance we can.


This is the most important and difficult part. If you delete the wrong file, it may damage your system irreversibly. If you can not do this,
>> Download SpyHunter - a professional parasite scanner and remover.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Right click on each of the virus processes separately and select Open File LocationEnd the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a virus, copy the folders somewhere, then delete the directories you were sent to.



Take a look at the following things:

Type msconfig in the search field and hit enter: you will be transported to a Pop Up window. 


Go in the Startup tab and Uncheck entries that have “Unknown” as Manufacturer.

Type Regedit in the windows search field and press Enter.

Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If you can’t find them this way, look in these directories, and delete/uninstall the registries manually:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious, but bear in mind they are always different.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

Remember to leave us a comment if you run into any trouble!

Did we help you? Please, consider helping us by spreading the word!

  • Douglas

    Thanks, this really helped me!

    • Mano vc conseguiu tirar como?Que passa foi 100% efetivo?

  • Scott North

    I have 3 strange IPs below “Localhost

    • HowToRemove.Guide Team

      Hello Scot,

      Can you tell us what the IPs are? It is likely they are a sign for malicious presence.

  • Shadowslicer88

    Didn’t help, I have no extensions and no progrmas that have Capricornus in it but it keeps showing on my chrome pages.

    • HowToRemove.Guide Team

      Can you tell us what exactly did you do up to this point and which steps you were not able to perform?

      • Shadowslicer88

        Up to the ip part but before this, I checked my extensions, they were normal, my programs were normal. Idk whats wrong but I still see the adds from Capricornus.

      • Shadowslicer88

        I solved the issue, there was a folder in my programs section named “user extension” i clicked on program to see what it was, my computer said It couldn’t confirm this application was from the actual company or whatever the file said, I deleted it and I’m pretty sure it’s gone for now.

      • Shadowslicer88

        Wait no, i refreshed and it’s still there… 🙁

        • HowToRemove.Guide Team

          Since we don’t know if you missed something or the particular version of the Capricornus virus that you have is something different, it is probably best if you download the software suggested in the article. Since the scanner part is completely free, you can perform and scan and let us know afterwards.
          Hope we can help you.

  • Dominique Justicesya Simorangk

    Please help me, I couldn’t find extentions or programs that have Capricornus, so I couldn’t uninstall anything but ads by capricornus keep popping out on my chrome.

    • HowToRemove.Guide Team

      Hello Dominique,

      Which of the steps in our guide did you manage to complete?

  • HowToRemove.Guide Team

    Try downloading the scanner/remover from one of our ads. The scanner is free and it can help you detect the infected files.

    • Alicia

      Where do I download this scanner/remover from?

      • HowToRemove.Guide Team

        Hello Alicia,
        Just click on one of the advertisements easily visible in the article above, in fact if you scroll to the top of the page you will notice one such banner.
        Happy Holidays and let us know if you need any help! 🙂

  • HowToRemove.Guide Team

    Hello Faris Faishol,
    Definitely delete all of these. They are part of the virus. Copy them to a text file in case where we made some big mistake and you need them. You don’t – I am sure they are part of the virus, but we should always be on the safe side.
    Tell us later if that fixed your problem. 🙂

    • Faris Faishol

      its working, thanks

      • HowToRemove.Guide Team

        That’s great. 🙂 Write to us if you need any more help.

        • Lily Johns

          Hi, I have the same issue and those IPs are the one on my laptop, but I’m still confused on how to delete them? I’m new to this, so I don’t understand. Could you explain it so that a teen could understand? I also have a windows 10 laptop, so I don’t know if that affects this at all

        • Lily Johns

          I did everything else, i just cant find any in my task manager and I’m not sure how to delete those IP’s, i’m completely lost.

          • HowToRemove.Guide Team

            Hello Lily Johns,

            You don’t need to do much to delete the IPs. This is a .txt file, so it is quite easy to manipulate. As stated above just copy/paste the IPs in question to another blank .txt file, so that you can revert back if something bad happens. Then just delete the IPs from the hosts file, just as you would delete any text.

            Let us know if that fixed your issue.

  • Fke Ac

    i followed all steps but capricornus still opens, actually when i was trying to remove malware from chrome there was nothing unusual.
    i’ve done all other steps successfully but the sacnner from here still found a lot of stuff but i don’t want to use him because he costs a lot is there anything else i can do?

    i tried to use other malware scanner but i couldnt download them completly

    • HowToRemove.Guide Team

      Hellow Fke Ac,
      Can you follow the files with the scanner? Not wanting to pay is absolutely fine – to be honest, I encourage you to try every free method before resorting to paying anything. Can you use the scanner to help you locate the infected files?
      Alternatively, pay attention especially to the last 2 steps, particularly the parts with the Task Manager and Regedit. If you missed something, these are the probable places you did so.
      Tell me how it went and if you have any problems or questions, just ask away. 🙂

  • HowToRemove.Guide Team

    You should NOT type “remove everything” there. You delete something IF there is something to be removed after .exe. For example
    chrome.exe safe.capricornus(dot)com
    In this instance you remove the capricornus line after .exe. If you do not have anything after exe you just move on with the guide.

  • HowToRemove.Guide Team

    Hello Dominique,
    Happy New Year! 🙂 Move on with the rest of the guide. Maybe you didn’t miss anything. There are different versions of the Capricornus Adware and there is no way for us to know exactly which one of them you have on your PC, so we provided instructions that encompass all of them.
    If you have difficulty finding the infected files, I suggest downloading the scanner from our ads. It can help you track down Capricornus to the root and you can just remove the files manually.
    Tell us later how it went after, and don’t hesitate to write again if you have any difficulties. 🙂

  • HowToRemove.Guide Team

    Check the updated part in the guide 🙂

    • Lily Johns

      I deleted it but it still won’t let me save 🙁
      It still says I don’t have permission. Sorry for troubling you.

      • HowToRemove.Guide Team


        So are you sure you have admin rights/privileges when opening the hosts file?

  • HowToRemove.Guide Team

    Try downloading the scanner from our ads and locating the virus this way.

  • HowToRemove.Guide Team

    Check Step 4, it is updated. Does the problem still persist after?

    • Lily Johns

      I actually was able to completely get rid of it by closing all of the advertisement on the pages that it showed up on, and after doing it twice, the capicornus virus completely disappeared. Thanks for the help 🙂

      • HowToRemove.Guide Team

        I’m glad everything worked out for you. Write to us if you ever need any help 🙂

  • HowToRemove.Guide Team

    The scanner is not ours, but we are indeed endorsing it. You can download it from one of the banners in the article above. Use the scanner to locate your problem files, sometimes the virus is especially hard to delete in full. Let us know how it goes.

  • I have done all the steps, found nothing.
    I download AND bought spyhunter. It removed over 200 threats.
    But I still have capricornus on my f***ing computer. I literally cannot find ANY trace of it on my computer but it’s still there on my browser (Chrome)
    Please help me.

    • HowToRemove.Guide Team

      My honest suggestion is: since you bought SpyHunter, the easiest way for you to remove it is to call the people on the number specified in the program. They are technicians who will make a custom removal for your computer and take care of it for you. This is what they were hired to do. If you are not feeling comfortable doing this, tell me and I’ll think of something else for you. I’m here to help 🙂

      • Thank you. I don’t really know how, but capricornus just stopped showing up. I guess it just took awhile or something.

        • HowToRemove.Guide Team

          That’s great. If you ever have a problem again, just ask here and I’ll do the best I can to help you 🙂

  • Aman Garg

    Hi, the host.txt files shows the following IP Addresses at the bottom down.baidu2016..com 123.sogou..com http://www.czzsyzgm..com http://www.czzsyzxl..com

    Have I been hacked? Also, I haven’t been able to remove Capricornus adware

    • HowToRemove.Guide Team

      Hello Aman,

      The virus wrote those line in the Hosts file itself. Delete all of these lines and save the Hosts file, then tell me if you still see Ads.

      Did you try everything else in the guide?

  • HowToRemove.Guide Team

    Hi Aman,

    Yes, Adwcleaner is pretty good for removing the viruses, but it doesn’t offer any real time protection. That’s why we recommend SpyHunter.

    Your computer should be clean now, but keeping it from getting hacked is entirely is up to you.

  • HowToRemove.Guide Team

    Hi Alhpie, if you can’t save the Hosts file you likely don’t have admin permission.

    To enable that open Notepad as admin (Search for the exe, right click on it and select open as admin). You then open Hosts frop the Notepad open menu.

  • HowToRemove.Guide Team

    Hi Alyxander,

    You can delete those lines yourself. As for Capricornus can you try resetting your browser’s profile? Which browser are you using?

  • HowToRemove.Guide Team

    H Darjo,

    I am sorry to hear about your poor experience with Spyhunter. We are actually recommending it ourselves, since it really is good. You’ll probably get refunded in a short order, but I advise you to instead send them a detailed report of your PC. The instructions are here: http://www.enigmasoftware.com/support/send-diagnostic-report-support-log/

    The techies there will look into your report and send you a personal fix within 48 hours. See if it works and then go for the refund option if you feel like it.

    That said it is possible that the virus was a one time deal – it changed your settings and it deleted itself afterwards. Some of these work like that, since they are essentially immune to such software.

    Can you try resetting the settings of your profile and/or browser? If you are using Chrome go to Option-> accounts and create a new account, then delete your current one.

    • Mmm…. And doing that do I lost my bookmarks (favorite lists)?

      • HowToRemove.Guide Team

        Hi Dario,

        Chrome and Firefox synchronization option (if you have it on) will restore your bookmarks when you log-in into your profile after the operation.

  • HowToRemove.Guide Team

    Hi again,

    Glad you managed to fix it, the Ads are really annoying.