Remove SmartNewTab Virus

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.


This page aims to help you remove Smartnewtab Virus. These Smartnewtab Virus removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

Important information. Read it.

Smartnewtab Virus is a computer program strongly resembling the behavior of the type of malicious software known as Browser Hijacker. In this article we will try to explain what an Browser Hijacker software really is and how you ended up with it in the first place, along with extensive removal instructions of course.

Remove Smartnewtab Virus

Remove Smartnewtab Virus

Smartnewtab Virus – how does it work?

As we said you will be dealing with Browser Hijacker. This type of viruses are characteristically going to put you through a lot of advertisements – pop-ups, pop-unders, banner or even whole pages filled with Ads (short for advertisements). You can also expect a heavy dose of browser redirects. What we mean by that? When you try to open a certain web address in addition to it or instead of it another websites opens up in a new tab or in a new windows. You should stay clear off of both the ads and the websites you have been redirected to as any interaction with them increases greatly the chance that more malware is headed your way.

Smartnewtab Virus – how were you infected?

Malware spreading is an advanced practice and over time a plethora of different approaches have been developed and tried. We will list the most popular ones along with some tips on how to avoid them.

  • Any time you receive a new e-mail in your inbox with an attachment in it you should be wary. Even if it is from a supposedly legitimate sender, maybe even a well-known company or your gas/phone/electricity provider. You should always check the files before downloading them (most mail clients have built-in scanners) and once again before actually opening them.
  • If you are downloading from web-sharing websites or you are a fan of p2p (torrents) then you should be always careful what files are actually being downloaded onto your computer. If possible check the trust-level of the uploader first, although that is far from being a reliable barometer, and always scan the files before opening them. Especially in the case of .exe files, you just don’t know if that is not a malicious application disguised as something else.
  • Software bundles. The most likely scenario in which you ended up with Smartnewtab Virus. In other words the inclusion of additional programs inside the installer of a program or any type of software actually, that you decided to install. Mostly the program would be a free one and the only way for you to prevent this if you select advanced installation options and carefully review and untick anything that might be different from your initial selection.

Before starting with Step 1 of our removal guide take the time to read this as it will spare you some questions that might pop-up during the removal process. The important thing to understand and remember is there are different “versions” of Smartnewtab Virus floating around the web space. There are different reasons for this, though it is mainly to make it harder for removal guides and blogs to prepare a universal removal solution. It is true that our task has been made especially hard as a result but we have done our best to comply complete and extensive removal instructions. You may find some parts to be redundant or completely irrelevant to your particular problem, if that is indeed the case do not be immediately alarmed by skip these parts and continue with the rest. If you have questions or tips, use the comments section. We are always open to feedback from our readers.

SUMMARY:

Name Smartnewtab
Type Browser Hijacker
Danger Level High
Symptoms Pop-up Ads, Browser redirects, slowed down performance.
Distribution Method E-mails, torrents, file sharing websites, software bundles.
Detection Tool

 

Remove SmartNewTab Virus


 

Step1

Reboot in Safe Mode (use this guide if you don’t know how to do it).

This was the first preparation.

Step2

WARNING!
To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Reveal All Hidden Files and Folders.

  • Do not skip this – Smartnewtab Virus may have hidden some of its files.

Hold together the Start Key and R. Type appwiz.cpl –> OK.

appwiz

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstall, choose NO:

virus-removal1

Type msconfig in the search field and hit enter. A window will pop-up:

msconfig_opt

Startup —> Uncheck entries that have “Unknown” as Manufacturer.

Step3

Hold the Start Key and R copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

 

Step4

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

browser-hijacker-taskbar-properties

Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512 Remove the Malware from Internet Explorer:

Open IE, click IE GEAR —–> Manage Add-ons.

pic 3

Find the malware —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Smartnewtab Virus from Firefox:

Open Firefox, click mozilla menu ——-> Add-ons —-> Extensions.

pic 6

Find the Browser Hijacker/malware —> Remove.


chrome-logo-transparent-backgroundRemove Smartnewtab Virus from Chrome:

Close Chrome. Navigate to:

C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.

  • At this point the malware is gone from Chrome, but complete the entire guide or it may reappear on a system reboot.

Step5

Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are a virus. Google them or ask us in the comments.

BIG WARNING! READ CAREFULLY BEFORE PROCEEDING!

This is the most important and difficult part. If you delete the wrong file, it may damage your system irreversibly. If you can not do this,
>> Download SpyHunter - a professional parasite scanner and remover.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Right click on each of the virus processes separately and select Open File LocationEnd the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a virus, copy the folders somewhere, then delete the directories you were sent to.

malware-start-taskbar

Step6

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

Remember to leave us a comment if you run into any trouble!

Was this guide helpful?

  • HowToRemove.Guide Team

    Hello Oana,

    You should delete all lines that contain these URLs – they were added by the virus. Don’t forget to save the changes to the Hosts file after you do it!

    Please let me know if it worked or if you are having any problems.

     
  • HowToRemove.Guide Team

    Hello Fiona,

    Yes, you should be safe now.

    Please let me know if the virus resurfaces. These things constantly change.

     
  • HowToRemove.Guide Team

    Hi again,

    Yes, if you have a restore point before the computer was infected you can use it to get rid of the virus. It works most of the time.

    Did you manage to remove SmartNewTabs?

     
    • Fiona

      There hasn’t been any pop-ups or redirects ever since I first commented so I think it’s gone. I’ll do a system restore just in case. Thanks for all the help!

       
      • HowToRemove.Guide Team

        Glad we could help 🙂

         
  • Trung0246

    what are these?
    http://prntscr.com/a010w2

     
    • HowToRemove.Guide Team

      Hi,

      Nothing good I am afraid – these are domains for the pop-up tabs. Delete all of these lines, then save and close the file.

      Let me know if you have any problems or the viruses remains after you finish with the guide.

       
      • Trung0246

        Um, i need to save it as file .txt ?

         
      • Trung0246

        Um should i save file as .txt ?

         
        • HowToRemove.Guide Team

          Hello,

          Yes, you should save and overwrite this file as a .txt Hosts file.

          If you have any problems with that let me know.

           
  • HowToRemove.Guide Team

    Hi Leonardo,

    Did you turn on Safe Mode first? Also you specifically open the file as administrator – locate in on your computer, right click on it, select properties and set it to work as an administrator from there.

    Did that help?

     
  • Victor Leon Contreras

    I did everything and i contiune having smartnewtab popups. I have even uninstalled Chrome and installed Firefox and in Firefox I still have this Smartnewtab. I don’t know what else i can do

     
    • HowToRemove.Guide Team

      Hi Victor,

      If you reinstalled your browser and still get the Ads this means you likely missed something within the guide. Are you sure you did all the steps in the order prescribed?

      Let me know when you re-do them or if you are absolutely sure you havn’t missed anything.

       
  • HowToRemove.Guide Team

    Hi again,

    It is really hard for me to blind-guess the reason if you’ve done everything already.
    What you can do is download SpyHunter from one of the banners on this page. The system scan is free to use, so please do it and tell me the result.

     
  • HowToRemove.Guide Team

    Glad I could help!

     
  • vinod kumar

    Hi bro,

    I am also a victim of this.I will try the given method. I just want to know, why these guys inject the virus into the downloads? Will they get paid for that? I m very curious about this, please give me if you have answer

    Thanks,
    Vinod

     
    • HowToRemove.Guide Team

      Hi Vinod,

      These people earn money every time someone clicks on the Ads or buys something. It may time for some people to realize they’ve been infected and that’s what they rely on.

       
  • Cupshigh

    I have these:

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

     
    • HowToRemove.Guide Team

      Hello there, you need to delete all those lines from the file, then save it.

       
  • HowToRemove.Guide Team

    Hi, what you need to do is simply delete those lines from the file, then save it. If you don’t get permission to do that first run Notepad as an admin (search for notepad in windows search,, right click on exe-> run as admin) and then open the Hosts file from the inside menu of Notepad: File->Open. Navigate manually to the file.

     
  • HowToRemove.Guide Team

    Then skip safe mode and proceed with the guide. If any one step does not apply, go ahead with the next. The creators of these things often attempt to switch things to make removal guides redundant.

     
  • HowToRemove.Guide Team

    Great catch – I’ll use this in the guide. Thank you 🙂

     
  • HowToRemove.Guide Team

    Hello,

    You can try a little trick. Save the file to another location, for example your desktop. Then use this newly saved file to replace the one in the original location. Let us know if that helps.

     
  • Shradheya Kumar

    I encountered these IP other than local host . please help me out . I have successfully removed some of the contents just tell me how to reset edge browser .

    127.0.0.1 union.baidu2019.com127.0.0.1 http://www.czzsyzxl.com127.0.0.1 http://www.czzsyzgm.com127.0.0.1 123.sogou.com127.0.0.1 down.baidu2016..com

     
    • HowToRemove.Guide Team

      Hello,

      You definitely have to delete these entries from your hosts file.

       
  • HowToRemove.Guide Team

    Hi Ashwin,

    I am going to need a little more details. Which part of the guide didn’t work for you? Did you do everything from there?

     
  • HowToRemove.Guide Team

    Hi there, sorry for the delay.

    If you are absolutely sure you’ve tried everything, then it is a good idea to give some anti-malware program a try.

    Grab SpyHunter and run a system scan. Even if you don’t want to buy the software it can pin-point you to the folder hosting the virus files.

     
  • HowToRemove.Guide Team

    Hi Akshat,

    You should delete those lines from the file.

    If you experience any problems with permission rights do the following:

    Search for Notepad in Windows search -> right click on the executable and select Run as Administrator.
    From inside Notepad click on the File-> Open menu and navigate to the hosts file

    You should now be able to save the file properly.

     
  • HowToRemove.Guide Team

    Hi Pawar, in which steps did you find presence of the virus?

     
  • HowToRemove.Guide Team

    Hi Vishesh, what language is your windows installed in? Do you see the chinese letters only at the end of the file?

     
  • HowToRemove.Guide Team

    Hi Naman, delete all of these from your file. Let me know how it goes.

     
  • HowToRemove.Guide Team

    Hi Sourav, all of these are legit. Your problem lies elsewhere.

     
  • HowToRemove.Guide Team

    Hi anurag, you should delete all of these lines from the file.

     
  • HowToRemove.Guide Team

    The file should be there. Did you reveal hidden files?

     
  • HowToRemove.Guide Team

    Hi there, you should delete these lines from the file. If you don’t get access permission try searching for Notepad first -> right click run as admin and open the Hosts file from the inside Open menu.

     
  • HowToRemove.Guide Team

    Hi,

    I don’t find these entries to be malicious but if you have any doubts you can always just copy/paste the contents of your hosts file into another .txt file (make a back-up of sorts) and delete them from hosts. If you are not happy with the result just paste them back.

     
  • HowToRemove.Guide Team

    Hi,

    What browser are you using? Do you have problems with a single one or with a number of them?

     
    • Vatsal Vashishtha

      I’m using google chrome and opera. Every time I’m on any website even on youtube videos i clicked smartnewtab appears every single time.

       
      • HowToRemove.Guide Team

        Hi Vatsal, did you go though the steps of the guide already?

         
        • Vatsal Vashishtha

          Yes i did!

           
          • HowToRemove.Guide Team

            Can you tell me in which steps did you spot the presence of the virus?

             
  • msd dhar

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

    127.0.0.1 union.baidu2019..com

     
    • HowToRemove.Guide Team

      Our team found out that these are actually local hosts and they are legit, so don’t worry about them.

       
  • msd dhar

    though i removed, they still appear what to do

     
  • Parvathy K

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

    127.0.0.1 union.baidu2019..com

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

    127.0.0.1 union.baidu2019..com

     
    • HowToRemove.Guide Team

      Hi Parvathy,
      these IPs are legit. We researched them and they are harmless. Contact us if you have other questions.

       
  • David

    Hi. I’ve got some of those Suspisous looking local hosts on step 3… HELP!

     
    • HowToRemove.Guide Team

      Hi David,
      can you post us a screenshot or Copy/Paste some of them here so w can check them ?

       
      • David

        127.0.0.1 down.baidu2016.com

        127.0.0.1 123.sogou.com

        127.0.0.1 http://www.czzsyzgm.com

        127.0.0.1 http://www.czzsyzxl.com

        should i just delete them from the notepad file?

         
        • HowToRemove.Guide Team

          Hi David, there is no need to delete entries starting with 127.0.0.1. Do you have anything else in there?

           
  • Bishwarup Neogy

    I have something suspicious in the local hosts file @step 3

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

     
    • HowToRemove.Guide Team

      Hi Bishwarup,
      you should definitely delete these IPs.

       
  • HowToRemove.Guide Team

    Hi Mikka,
    yes. You have to complete every step in Safe Mode.

     
  • megat ahmad mustaqim

    is jamben folder one of the virus??

     
    • HowToRemove.Guide Team

      Hi megat,
      do you remember installing program with that name ? Or do you use it by chance?

       
      • megat ahmad mustaqim

        i dont remember…..

         
      • megat ahmad mustaqim

        i dont remember, sorry…

         
  • HowToRemove.Guide Team

    Hi Mickey,
    you should delete that IP. Do you have more like this one? If you have, post them in the comments again to check them.

     
  • HowToRemove.Guide Team

    Them that is it. Did you menage to complete the whole guide ?

     
    • Mickey Holm

      I did, and so far, I’ve gotten rid of the virus 😀

       
      • HowToRemove.Guide Team

        Congratulations Mickey ! Remember if you find anything suspicious, we are here to help 🙂

         
        • Mickey Holm

          Thanks so mvch guys, im forever greatful 🙂

           
          • HowToRemove.Guide Team

            You are most welcome Mickey. Remember we are here to help 🙂

             
  • HowToRemove.Guide Team

    You are most welcome Mikka. Remember if you have any suspicious activities on your system we are here to help 🙂

     
  • HowToRemove.Guide Team

    Hi Coats,
    did you execute the steps in Safe mode?

     
  • HowToRemove.Guide Team

    Hi Coats,
    did you execute every step in Safe Mode ?

     
    • Coats

      Yes. :C

       
      • HowToRemove.Guide Team

        Hi again,
        at this point i suggest to you to download our software from one of the banners above and use the free scan feature. The scammer will locate any infected file where you can delete it manually. Keep us posted if you need further assistance.