Newpoptab Virus Removal From Chrome/Firefox

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

This article aims to help users remove Newpoptab Virus from Chrome, Firefox, Internet Explorer and Safari, as well as their respective system. Virus

Newpoptab Virus is a computer virus of the Adware class. This type of software has been specifically designed to create false advertisements and to then swarm the affected users with them. These advertisements or ads for short are in most cases fake. They might come in different forms like pop-up windows, whole pages ridden with ads or even toolbars. But careful not to click on highlighted texts or numbers while browsing, they might be hyperlinks created by Newpoptab Virus. In some cases your entire browser might get replaced or at the very least foreign toolbars might appear without your permission.

Some tips

We already mentioned that most of the displayed advertisements are probably fake. While we acknowledge that a small portion of them might legitimate you should avoid that notion and operate under the assumption that nothing good is going to happen if you click on the ads. It is important to understand that the ads in themselves cannot hurt you but if go on and start interacting with them then you are exposing yourself to many more dangers.

In any way do not fill out any banking or personal information if you turn up on such a website despite our warnings. Beware of phishing sites – websites that are specifically mimicking legitimate sites in order to deceive end users and steal their banking information. You should look very carefully at the URLs, they will almost identical to the real thing but it should be possible for you to notice the difference. Of course it is best to stay far away from such websites and remove Newpoptab Virus as soon as possible.

Another thing to avoid is the files that this malicious software might offer you to download and install. No matter in what form are they disguised you should not be fooled – they are almost always infected with some form of malware. It might not be adware even but more harmful stuff like Trojans or Ransomware.

Our final advice is to avoid and even completely ignore all messages and notifications related to Newpoptab Virus and do your best to quickly remove this application from your computer.

Name  Newpoptab
Type  Adware
Danger Level Medium.
Symptoms Increased loading times, reduced system performance, unwanted Ads.
Distribution Method The so called bundle software installations, e-mail attachments, compromised executable files.
Detection Tool Malware and Adware are notoriously difficult to track down, since they actively try to deceive you. Use this professional parasite scanner to make sure you find all files related to the infection.Sponsored

1: Enter Safe Mode.
2: Remove Newpoptab Virus from Chrome, Firefox, Internet Explorer and Safari.
3: Remove the virus from browser shortcuts.
4: Uninstall the virus from your AddRemove Programs.
5: Permanently remove Newpoptab Virus from Task Manager’s processes.
6: Remove the virus from Regedit and Msconfig.

Remove Newpoptab Virus

Things readers are interested in:


UPDATE! You can visit this article for an updated version of the guide: Remove Pop-Up Ads from Chrome/Firefox (Adware Virus)

Things readers are interested in:

The first thing to do is a reboot in Safe Mode. If you already know how to do it, just skip this and proceed to Step 2. If you do not know how to do it, continue reading:

For Windows 98, XP, Millenium and 7: 

Restart your computer. To be sure you don’t miss the time when you need to press it, just spam F8 as soon as the PC starts booting. Then choose Safe Mode With Networking.

For W8 and 8.1:

Click the Start button, then Control Panel —> System and Security —> Administrative Tools —> System Configuration.Administrator permission required


Then check the Safe Boot option and click OK.  Click  Restart in the pop-up.

For W10:

  1. Open the Start menu.
  2. Click the power button icon in the right corner of the Start menu to show the power options menu.
  3. Press and hold down the SHIFT key on the keyboard and click the Restart option while still holding down the SHIFT key.

W10 will perform the reboot. Next do the following:

Click the Troubleshoot icon, then Advanced options —> Startup Settings. Click Restart.
After the reboot click on Enter Safe Mode With Networking (Fifth Option).


To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Unfortunately Newpoptab Virus is quite capable of spreading to all web browsers located on a user’s computer. And by all accounts it has done just that as soon as it infiltrated your system defenses. In order to prevent the virus from replicating itself you will have to be thorough and completely purge it from all infected web browsers. Do not leave anything behind, even if it’s an old and rarely used web browser. Rinse and repeat steps 2 and 3 from our removal guide until you’ve gotten it all.

ie9-10_512x512  Remove the Malware from Internet Explorer:

Open IE, then click  IE GEAR —–> Manage Add-ons.

pic 3

Find Newpoptab Virus . Remove it by pressing Disable.

If your Home Page is different from the usual, click IE GEAR —–> Internet Options>edit the URL box with your preferred search engine, and click Apply.

firefox-512 Remove Newpoptab Virus from Firefox:

Open Firefoxclick on mozilla menu (top right) ——-> Add-onsHit Extensions next.

Newpoptab Virus in Firefox

Newpoptab Virus  should be somewhere around here –  Remove it.

chrome-logo-transparent-backgroundRemove Newpoptab Virus from Chrome:

 Start Chrome, click chrome menu icon —–>More Tools —–> Extensions. There,  find the malware and  select  chrome-trash-icon(Remove).

Newpoptab in Google Chrome

 Click chrome menu icon again, and proceed to Settings —> Search, the fourth tab, select Manage Search Engines.  Remove everything but the search engines you normally use.

safari Remove the malware from Safari:

Open Safari, and click Safari —–>Preferences —–> Extensions—–>Uninstall the malware.


Right click on the browser’s shortcut, then click Properties.

NOTE: We are showing Google Chrome, but the method is the same for Chrome, Firefox, Internet Explorer, Safari, and Microsoft Edge.


Once you’ve reached Properties —–> Shortcut (on the band at the top), then in the Target type field, REMOVE EVERYTHING AFTER .exe.


Hold the Start Key and R together. Write appwiz.cpl in the field, then click OK.


You are now in the Control Panel. Search around for Newpoptab Virus and suspicious-looking programs. Uninstall it/them. Also, be extremely careful. Viruses often spend one last ditch effort to trick you into installing more of their kind. If you see a screen like this when you click Uninstallchoose NO:


Hold the Start Key and R againbut this time copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A .txt file will open – don’t type or change it. If you are hacked and someone has access to your PC, there will be a bunch of other IPs connected to you at the bottom. This is what a hosts file looks like:

hosts_opt (1)

If there are a bunch of strange IPs connecting to you below “Localhost” you may be hacked, and it’s best to ask us in the comments for directions.


If you are receiving messages about being locked by the admin when you try to delete extensions in your browsers, go in C:\Windows\System32\GroupPolicy\Machine. There should be a file registry.pol. Delete that file.


Open the Task Manager by right clicking on the Taskbar and choosing Start Task Manager.


Once it opens, choose the Processes Tab. Look at all of the processes in front of you and try to determine which ones are a virus. Google them or ask us in the comments and we will provide the best assistance we can.


You are almost there, free of the threat posed by Newpoptab Virus! That was the good news. The bad one is that in order to get there you will need to complete the final part of our removal guide. It is both extremely important as well as pretty complicated and dangerous if you mess anything up. You will be dabbling with system files so even a small mistake on your part might very well lead to some very significant negative effects for your device, to put it bluntly you might completely mess it up. We are always advocating on the side of caution and if you are not 100% sure you know what you are doing or you simply wouldn’t want to take such risks we urge you to stop here. Instead download and use a professional scanner and remover to get rid of Newpoptab Virus. This is a completely automated risk free operation and you will also be able to protect yourself in the future as well as the built-in scanner will allow you to check regularly for any possible threats.

Our editor’s pick goes to SpyHunter:

This is the most important and difficult part. If you delete the wrong file, it may damage your system irreversibly. If you can not do this,
>> Download SpyHunter - a professional parasite scanner and remover.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

You can find a review here.


Right click on each of the virus processes separately and select Open File Location. Also, End the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a virus, copy the folders somewhere, then delete the directories you were sent to.


Take a look at the following things:

Type msconfig in the search field and hit enter: you will be transported to a Pop Up window. 


Go in the Startup tab and Uncheck entries that have “Unknown” as Manufacturer.

Type Regedit in the windows search field and press Enter.

Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If you can’t find them this way, look in these directories, and delete/uninstall the registries manually:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious, but bear in mind they are always different.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

Remember to leave us a comment if you run into any trouble!

Did we help you? Please, consider helping us by spreading the word!


Was this guide helpful?

  • HowToRemove.Guide Team

    What browser are you using?

  • KingCheese

    Hey I’m using firefox but I don’t see it in extensions. Only adblock. Please help! This is really annoying.

    • HowToRemove.Guide Team

      Move on, even if you don’t see it in extensions. Different versions of the virus can possibly have an extension, or not. In your case Newpoptab hasn’t created one.
      Virus creators often tweak their viruses after removal guides are out so it’s more difficult to get rid of the thing. Don’t let it phase you. If you run into any trouble, leave another comment 🙂

  • Valkyrie_Ice

    Okay. I use malwarebytes and it is showing clean. I’ve erased Chrome and reinstalled it. Followed all of the steps listed above, and find no evidence that any part of poptab is still being found.

    Yet Chrome is CONTINUALLY being hijacked by newpoptab and having Malwarebytes intercept it, and despite numerous scans, still saying my system is clean.

    • HowToRemove.Guide Team

      In this case I’d recommend using the software we suggest in the article. The scan function is completely free. Let me know how this goes for you.

      • Dolph L

        What is the name of said software?

        • HowToRemove.Guide Team

          It is called Spyhunter.

  • HowToRemove.Guide Team

    Hello Luca, try moving on with the rest of the removal instructions and let us know how it goes.

  • bethany-louise

    Hi, I’m unsure of where the newpoptab virus is coming from on my computer, I’ve gone through all those steps, I’ve no extensions, I have some odd things in my task manager in startup but I can’t open a file source for them and they’re disabled, they’re are no suspicious programs in my control panel, no other IPs other than my own, the only thing is on the last step I search newpoptab and found 2 for internet explorer and it won’t let me delete one of them because it says “unable to delete all specific values” This is so frustrating 🙁

    • HowToRemove.Guide Team

      Hello Bethany-Louise, if you have trouble with the manual removal you might want to try the software suggested by us. The scanner function is completely free and at the very least it will point you out in the right direction. Let us know afterwards.

      • bethany-louise

        Are you sure its safe to use, I’m not questioning you, I’m so paranoid about installing free software now haha

        • HowToRemove.Guide Team

          As you should be, we are always preaching extreme caution, especially with freeware. But yes, in that instance it is completely safe. It is a professional paid program, but the scanner function is free so you can use it to check your computer for threats.

          • bethany-louise

            Okay thankyou, and another quick question, if I’ve deleted stuff off the registry, does that mean its gone off my laptop completely? or are there more steps I have to take

          • HowToRemove.Guide Team

            We have tried to make the removal guide as complete and as thorough as possible, if you have followed all steps then you should be ok. Of course there are exceptions and no instructions are sure to work in all specific cases, that’s why it is probably a good idea to scan your computer and see where you are at. Afterwards let us know and we will of course try to help you.

          • bethany-louise

            I sorted it another way, I contacted my virus protection provider and they connected to my computer and controlled it from their end and found the problem, Somethings called bubbledock & selection tools & things associated with NosiBay were causing it. So they deleted it and everythings better now 🙂

          • HowToRemove.Guide Team

            Glad to hear it all worked out for you. Just a friendly reminder for you and all readers in a similar situation. Only provide remote access to your computer if you are absolutely sure you have contacted legitimate service. There are numerous instances of Tech Support scams, including fake phone numbers etc. So be very cautious if you are going to do something like this.

  • Which “professional scanner and remover” do you recommend?

    • HowToRemove.Guide Team

      You can just click on one of the banners in the article above.

  • game freak

    it helps but you could have given links to scanners that would help

    • HowToRemove.Guide Team

      You can easily click on one of the banners in the article above. It leads to a download page for a professional program, the scanner function is completely free though.
      Let us know how we can help you if you have further inquiries.

  • Timothy Subito

    in step 4, i have other ips under my local host. im using mozilla firefox.
    how do i go about this?

    • HowToRemove.Guide Team

      First off, merry Christmas! 🙂
      Can you post the IPs here. Sometimes they are perfectly fine and not something malicious, but I can’t be sure until I see them.

  • HowToRemove.Guide Team

    The first one is safe. Keep it. All of the other ones are part of the virus and should be deleted from your hosts file. Tell me afterwards if this fixed your problem 🙂

    • Martine Amos C Antonio

      how do i delete it

      • HowToRemove.Guide Team

        You just erase the lines from the file. Mcafee is safe. On all of the others you just press backspace and exit the file.
        Don’t hesitate to write to us again if you run into trouble 🙂

        • Martine Amos C Antonio

          it wont save me the file. it doesnt let me edit the permissions for system 32 either

          • HowToRemove.Guide Team

            Are you the administrator on this PC? You need to have admin rights. Try to copy the file somewhere else, edit it, then replace it in the etc folder.
            Did that work?

  • HowToRemove.Guide Team

    Hello Yash,
    These are part of the virus. Delete them from the hosts file.

  • HowToRemove.Guide Team

    Hello Matt and Happy New Year! 🙂
    This really is hard to beat. I just looked at your Processes and everything looks clean. The problem here is that after we bring out removal guides, whoever made Newpoptab saw our instructions and tweaked it so they don’t always work. And they did 2 or 3 different things. So there are several versions of the virus circulating around and we can’t know which one you have.
    I suggest you click on one of our ads for the software and download it from there. The scanner can help you track down the infected files and you can remove them manually. 🙂

  • HowToRemove.Guide Team

    You seem to know what you are doing, so I suggest this: download the scanner from one of our ads. The removal part of the program is paid – don’t use it, I think you can manage on your own just fine. Use the scanner to track down the infected files you missed and tell me later how it went. If it doesn’t work, I’ll think of something else.
    Cheers 🙂

  • Wesley Joseph

    i am on my wits end with this malware. i have followed the example of several website to no avail. i have unistalled several app that installed with newpoptab cleared registy uninstalled my browsers i brought kasperkey virus software and did a full scan of my pc and still failed to pick it up at all! i have followed all the steps on this website also still no luck. i wanted to try the scanner that you guys refer to but where is the malware scanner /ads link on this page?! i cannot see it anywhere on your website! there are no ads or banners anywhere…

    • HowToRemove.Guide Team

      Do you have adblock? It is probably blocking the advertisements. There should be an ad immediately at the beginning of the article. If you don’t, please tell me, because then there is probably something very wrong with our ads and I want to find out.
      If you manage to download the scanner, use it to find the infected files. If it doesn’t work, come back and I’ll try to help you in another way.
      Cheers 🙂

  • HowToRemove.Guide Team

    When the scanner finds a threat, click on the little plus on the left of the infected file and it will show you the location it location. Many of the files found are in the same place, so don’t be scared of the number. You don’t have to delete 600 files manually, a 100 of them can be in the same place. The picture is an example. The little green boxes mean it’s in the registries (when you type regedit in the search field, you can actually see the icon is almost the same). I recommend that you scan your system and try to use the results together with our guide. Go where the guide says and look around for the things your scan log found.
    If you have more questions, really don’t hesitate to ask. I really just want to help you 🙂

  • HowToRemove.Guide Team

    Hey Wesley,

    It is quite possible that if any trace of the virus remains it will replicate itself after a reboot, just as in your case. Our advice is to Follow each step of our removal guide once again, this time armed with the additional information provided by the software that you have used. Let us know if we can be of any further assistance.

  • HowToRemove.Guide Team

    Check out step 4, I just updated it. Did that help?

  • HowToRemove.Guide Team

    I’m glad everything worked out for you. Come back here if you ever need any more help 🙂

  • HowToRemove.Guide Team

    Try the following: Go to Chrome’s Settings —> On Startup —> “Open a specific page or set of pages”, the Set Pages link next to it —> delete all entries related to the virus. Did this help?

  • HowToRemove.Guide Team

    You don’t need to search for these in regedit. Just delete the two lines in the hosts file (the text file you found them), save and close it. That’s all you need to do, then move on with the guide.

  • HowToRemove.Guide Team

    You should definitely delete it. Is this the only one suspicious in your local host file?

  • mel

    what should i do?? please help

    • HowToRemove.Guide Team

      Hello mel,

      Delete these entries: down.baidu2016. com 123.sogou. com

      Are there more below? From your picture it is not quite clear. Let us know.

  • Judith

    I have tried to delete this virus so many times. I have tried everything on this website. I uninstalled and installed chrome again and again. Every time I open a new website on chrome the newpoptab advertisement opens up. I downloaded the SpyHunter and followed the path and deleted them but they always come back. I have run out of options. Please help me.

    • HowToRemove.Guide Team

      Hello Judith,
      We are going to do our best to assist you. Can you please describe what exactly you were able to accomplish of the steps above and in what order? Because that matters as well. Looking forward to your reply.

  • HowToRemove.Guide Team

    Hi Jen,

    Basically the SpyHunter file location will tell you where exactly the virus files are. If you can see the location there you can go to the same location on your computer manually – usually it is somewhere on your C drive. Just look at the location and start opening the folders from the leftmost to the rightmost folder – C/Windows/System32/XX/XX etc

    If you can’t find a location, but spyhunter tells you it is there the folder is probably hidden. You need to reveal hidden files and folders, we’ve explained how this is done over here ->

  • Taron Babayan

    what should i do?

  • Julie

    I don’t know what I’m doing wrong… There’s nothing in my browser extensions, nothing after .exe in the browser properties, nothing in the control panel, or the task manager. But I’m still getting newpoptab redirects. Please help, I’m going insane.

    • HowToRemove.Guide Team

      Hello, Julie. Have you chacked the Hosts file for any suspicious IP addresses. If you haven’t done that, go ahead and have it checked. After that, come back here and tell us if there were any shady IP’s in the Hosts file.