Ads Removal

Newpoptab Virus Removal From Chrome/Firefox (Feb. 2017 Update)

Parasite may reinstall itself multiple times if you don't delete its core files. We recommend downloading SpyHunter to scan for malicious programs installed with it. This may save you hours and cut down your time to about 15 minutes. 

Download SpyHunter Anti-Malware

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

This article aims to help users remove Newpoptab Virus from Chrome, Firefox, Internet Explorer and Safari, as well as their respective system. Virus

Newpoptab Virus is a computer virus of the Adware class. This type of software has been specifically designed to create false advertisements and to then swarm the affected users with them. These advertisements or ads for short are in most cases fake. They might come in different forms like pop-up windows, whole pages ridden with ads or even toolbars. But careful not to click on highlighted texts or numbers while browsing, they might be hyperlinks created by Newpoptab Virus. In some cases your entire browser might get replaced or at the very least foreign toolbars might appear without your permission.

Some tips

We already mentioned that most of the displayed advertisements are probably fake. While we acknowledge that a small portion of them might legitimate you should avoid that notion and operate under the assumption that nothing good is going to happen if you click on the ads. It is important to understand that the ads in themselves cannot hurt you but if go on and start interacting with them then you are exposing yourself to many more dangers.

In any way do not fill out any banking or personal information if you turn up on such a website despite our warnings. Beware of phishing sites – websites that are specifically mimicking legitimate sites in order to deceive end users and steal their banking information. You should look very carefully at the URLs, they will almost identical to the real thing but it should be possible for you to notice the difference. Of course it is best to stay far away from such websites and remove Newpoptab Virus as soon as possible.

Another thing to avoid is the files that this malicious software might offer you to download and install. No matter in what form are they disguised you should not be fooled – they are almost always infected with some form of malware. It might not be adware even but more harmful stuff like Trojans or Ransomware.

Our final advice is to avoid and even completely ignore all messages and notifications related to Newpoptab Virus and do your best to quickly remove this application from your computer.

Name  Newpoptab
Type  Adware
Danger Level Medium.
Symptoms Increased loading times, reduced system performance, unwanted Ads.
Distribution Method The so called bundle software installations, e-mail attachments, compromised executable files.
Detection Tool Malware and Adware are notoriously difficult to track down, since they actively try to deceive you. Use this professional parasite scanner to make sure you find all files related to the infection.Sponsored


Remove Newpoptab Virus


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).


This is the most important step. Do not skip it if you want to remove Newpoptab successfully!

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 


Hold together the Start Key and R. Type appwiz.cpl –> OK.


You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:


Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.


Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.



  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).


Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Newpoptab from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Newpoptab from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove.
chrome-logo-transparent-backgroundRemove Newpoptab from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.


To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

If you want to avoid the risk, we recommend downloading SpyHunter
a professional malware removal tool.

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide didn’t help you, download the anti-virus program we recommended or ask us in the comments for guidance!


    • Move on, even if you don’t see it in extensions. Different versions of the virus can possibly have an extension, or not. In your case Newpoptab hasn’t created one.
      Virus creators often tweak their viruses after removal guides are out so it’s more difficult to get rid of the thing. Don’t let it phase you. If you run into any trouble, leave another comment 🙂

  • Okay. I use malwarebytes and it is showing clean. I’ve erased Chrome and reinstalled it. Followed all of the steps listed above, and find no evidence that any part of poptab is still being found.

    Yet Chrome is CONTINUALLY being hijacked by newpoptab and having Malwarebytes intercept it, and despite numerous scans, still saying my system is clean.

  • Hi, I’m unsure of where the newpoptab virus is coming from on my computer, I’ve gone through all those steps, I’ve no extensions, I have some odd things in my task manager in startup but I can’t open a file source for them and they’re disabled, they’re are no suspicious programs in my control panel, no other IPs other than my own, the only thing is on the last step I search newpoptab and found 2 for internet explorer and it won’t let me delete one of them because it says “unable to delete all specific values” This is so frustrating 🙁

    • Hello Bethany-Louise, if you have trouble with the manual removal you might want to try the software suggested by us. The scanner function is completely free and at the very least it will point you out in the right direction. Let us know afterwards.

        • As you should be, we are always preaching extreme caution, especially with freeware. But yes, in that instance it is completely safe. It is a professional paid program, but the scanner function is free so you can use it to check your computer for threats.

          • Okay thankyou, and another quick question, if I’ve deleted stuff off the registry, does that mean its gone off my laptop completely? or are there more steps I have to take

          • We have tried to make the removal guide as complete and as thorough as possible, if you have followed all steps then you should be ok. Of course there are exceptions and no instructions are sure to work in all specific cases, that’s why it is probably a good idea to scan your computer and see where you are at. Afterwards let us know and we will of course try to help you.

          • I sorted it another way, I contacted my virus protection provider and they connected to my computer and controlled it from their end and found the problem, Somethings called bubbledock & selection tools & things associated with NosiBay were causing it. So they deleted it and everythings better now 🙂

          • Glad to hear it all worked out for you. Just a friendly reminder for you and all readers in a similar situation. Only provide remote access to your computer if you are absolutely sure you have contacted legitimate service. There are numerous instances of Tech Support scams, including fake phone numbers etc. So be very cautious if you are going to do something like this.

    • Hello,
      You can easily click on one of the banners in the article above. It leads to a download page for a professional program, the scanner function is completely free though.
      Let us know how we can help you if you have further inquiries.

    • First off, merry Christmas! 🙂
      Can you post the IPs here. Sometimes they are perfectly fine and not something malicious, but I can’t be sure until I see them.

  • The first one is safe. Keep it. All of the other ones are part of the virus and should be deleted from your hosts file. Tell me afterwards if this fixed your problem 🙂

      • You just erase the lines from the file. Mcafee is safe. On all of the others you just press backspace and exit the file.
        Don’t hesitate to write to us again if you run into trouble 🙂

          • Are you the administrator on this PC? You need to have admin rights. Try to copy the file somewhere else, edit it, then replace it in the etc folder.
            Did that work?

  • Hello Matt and Happy New Year! 🙂
    This really is hard to beat. I just looked at your Processes and everything looks clean. The problem here is that after we bring out removal guides, whoever made Newpoptab saw our instructions and tweaked it so they don’t always work. And they did 2 or 3 different things. So there are several versions of the virus circulating around and we can’t know which one you have.
    I suggest you click on one of our ads for the software and download it from there. The scanner can help you track down the infected files and you can remove them manually. 🙂

  • You seem to know what you are doing, so I suggest this: download the scanner from one of our ads. The removal part of the program is paid – don’t use it, I think you can manage on your own just fine. Use the scanner to track down the infected files you missed and tell me later how it went. If it doesn’t work, I’ll think of something else.
    Cheers 🙂

  • i am on my wits end with this malware. i have followed the example of several website to no avail. i have unistalled several app that installed with newpoptab cleared registy uninstalled my browsers i brought kasperkey virus software and did a full scan of my pc and still failed to pick it up at all! i have followed all the steps on this website also still no luck. i wanted to try the scanner that you guys refer to but where is the malware scanner /ads link on this page?! i cannot see it anywhere on your website! there are no ads or banners anywhere…

    • Do you have adblock? It is probably blocking the advertisements. There should be an ad immediately at the beginning of the article. If you don’t, please tell me, because then there is probably something very wrong with our ads and I want to find out.
      If you manage to download the scanner, use it to find the infected files. If it doesn’t work, come back and I’ll try to help you in another way.
      Cheers 🙂

  • When the scanner finds a threat, click on the little plus on the left of the infected file and it will show you the location it location. Many of the files found are in the same place, so don’t be scared of the number. You don’t have to delete 600 files manually, a 100 of them can be in the same place. The picture is an example. The little green boxes mean it’s in the registries (when you type regedit in the search field, you can actually see the icon is almost the same). I recommend that you scan your system and try to use the results together with our guide. Go where the guide says and look around for the things your scan log found.
    If you have more questions, really don’t hesitate to ask. I really just want to help you 🙂

  • Hey Wesley,

    It is quite possible that if any trace of the virus remains it will replicate itself after a reboot, just as in your case. Our advice is to Follow each step of our removal guide once again, this time armed with the additional information provided by the software that you have used. Let us know if we can be of any further assistance.

  • Try the following: Go to Chrome’s Settings —> On Startup —> “Open a specific page or set of pages”, the Set Pages link next to it —> delete all entries related to the virus. Did this help?

  • You don’t need to search for these in regedit. Just delete the two lines in the hosts file (the text file you found them), save and close it. That’s all you need to do, then move on with the guide.

    • Hello mel,

      Delete these entries: down.baidu2016. com 123.sogou. com

      Are there more below? From your picture it is not quite clear. Let us know.

  • I have tried to delete this virus so many times. I have tried everything on this website. I uninstalled and installed chrome again and again. Every time I open a new website on chrome the newpoptab advertisement opens up. I downloaded the SpyHunter and followed the path and deleted them but they always come back. I have run out of options. Please help me.

    • Hello Judith,
      We are going to do our best to assist you. Can you please describe what exactly you were able to accomplish of the steps above and in what order? Because that matters as well. Looking forward to your reply.

  • Hi Jen,

    Basically the SpyHunter file location will tell you where exactly the virus files are. If you can see the location there you can go to the same location on your computer manually – usually it is somewhere on your C drive. Just look at the location and start opening the folders from the leftmost to the rightmost folder – C/Windows/System32/XX/XX etc

    If you can’t find a location, but spyhunter tells you it is there the folder is probably hidden. You need to reveal hidden files and folders, we’ve explained how this is done over here ->

  • I don’t know what I’m doing wrong… There’s nothing in my browser extensions, nothing after .exe in the browser properties, nothing in the control panel, or the task manager. But I’m still getting newpoptab redirects. Please help, I’m going insane.

    • Hello, Julie. Have you chacked the Hosts file for any suspicious IP addresses. If you haven’t done that, go ahead and have it checked. After that, come back here and tell us if there were any shady IP’s in the Hosts file.

Leave a Comment