Smart New Tab Virus Removal

Welcome to our Smart New Tab Virus removal instructions. This article intends to help you remove Smart New Tab Virus from your system and is designed to work for Chrome, Firefox and Internet Explorer and all Windows versions.

Smart New Tab has been identified as a probable computer virus by a number of online databases. To be more precise – as an Adware type of virus. You may or may not know about this subclass of malicious software but since it is our intent to not only help you remove it effectively but also to provide as much information about it as possible, we will discuss it in some depth. This is important so that you can avoid ending up in a similar position in the future. And what position that would be exactly – you might ask.

Smart New Tab Virus

Smart New Tab Virus – how does it work?

As a typical representative of the Adware family (the name deriving from the words Advertisements and Malware), you have undoubtedly come face to face with the seemingly never ending array of Ads. They may come in a variety of forms – pop-ups, pop-unders, banners or even whole pages filled with nothing but irritating ads. These ads could be quite intrusive at times and accompanied by flashing effects and sounds. If that was not bad enough already you should also be prepared for the possible Browser redirects associated with Smart New Tab Virus. And by Browser redirects we mean this sort of thing – you try to open a specific web address but in addition to it or even instead of it another websites opens up in a new tab or window. This and the annoying ads will not only become a nuisance quite quickly but may also represent some very real and immediate dangers to your online security.

  • You should avoid interacting with the Ads and the websites you might be redirected to at all costs. If you do interact – it is a pretty sure way to get infected with additional malware and more often than not even more dangerous than Smart New Tab Virus – Trojan Horses, Ransomware and Rootkits.
  • You may notice that the ads displayed on your screen would have one thing in common – they are specifically targeting things you were interested in. That might not seem like much of an issue at first, and understandably so as many companies like Google, Facebook and other use similar targeted ads. But if you think about it – it turns out Smart New Tab Virus has privileged access to your browser’s cookies and cache. That is quite alarming because it leads to even more questions, for instance are your stored user names and passwords exposed as well? Especially if you are using any type of online banking, you might be alarmed and rightfully so. We advise changing your passwords after you have dealt with the removal of Smart New Tab Virus.
  • Do not be fooled by various misleading messages generated by the Ads like missing plug-ins, audio or video codecs, “important” software updates and the like. They will be all accompanied by useful download links, but if you fall for this you will be downloading compromised executable files. Which is a sure-fire way to end up with nasty malware on your device. You should never download any software from unconfirmed or unofficial source locations.

A bit of an explanation before you dive into our removal instructions. The creators of Smart New Tab Virus and other similar applications have deliberately created and made sure to spread around a lot of slightly differing versions of their malicious software. All this with the specific purpose to make it harder for removal guides and blogs, just like our own to come up with universal solutions. As a result you might find that parts of our removal guide might seem irrelevant or not corresponding to your specific needs. If that is indeed the case do not be alarmed, simply skip the parts that you deem irrelevant and continue with the rest of the instructions. If you have any questions or would like help with anything – just ask us in the comments.

Threat Smart New Tab Virus
Classification Adware/Browser Hijacker
Security Alert
High. Unlike most malicious software of this type, Smart New Tab Virus is quite dangerous and potentially damaging.
Negative Effects Undesired Ads, Browser Redirects, Compromised Personal Information.

Smart New Tab Virus Removal

Step 1

Reveal Hidden Files. If you don’t know how to do this, ask us in the comments.

Step 2

Press Start Button => Control Panel => Uninstall a program.

Uninstall in Control Panel

Locate the virus and any other suspicious looking programs and uninstall them.

Sort the programs by Installed On.

Installed On

Delete recent suspicious entries.

 

Additional:

In the search field type => msconfig => hit Enter.

Type msconfig

Go to Startup and disable all entries with Unknown as Manufacturer.

Disable Unknown Manufacturer

Step 3

Start Button => Search=> Copy/Paste “notepad %windir%/system32/Drivers/etc/hosts” => Enter.

Hosts File

If you notice other IPs different from the localhost IPs – you might be in danger!

Localhost IPs

Ask for additional help in the comments.

Step 4

Smart New Tab Virus Removal from Chrome Browser Chrome

Click Chrome => More Tools => Extensions.

Extensions in Chrome

Locate the virus and remove it.

Smart New Tab Virus Removal from Firefox Browser Firefox

Click Bars in Firefox => Add-ons=> Extensions.

Extensions in Firefox

Locate the virus and delete it.

Malware Removal from Internet Explorer Internet Explorer

Press on IE Gear => Manage Add-ons =>

Extensions in IE

Find the virus and remove it.

Step 5

Right click on the Taskbar => Start Task Manager.

Start Windows Task Manager

Navigate to Processes.

Processes in Task Manager

Locate any suspicious processes associated with Smart New Tab Virus. Right click on the process = > Open File Location => End Process = > Delete the directories with the suspicious files.

Step 6

Start Button => Search => Type:

  • %AppData%
  • %LocalAppData%
  • %ProgramData%
  • %WinDir%
  • %Temp%

Type in Search

Hit Enter after each new search. Check each Folder and delete recent entries.

If you run into any trouble – ask us for help in the comments section!

SHARE
Previous articleCenter for Internet Security Shares Tips for Staying Safe on Cyber Monday
Next articleEasy Search Removal from Chrome/Firefox
Daniel Sadakov has a degree in Information Technology and specializes in web and mobile cyber security. He harbors a strong detestation for anything and everything malicious and has committed his resources and time to battling all manners of web and mobile threats. He has founded MobileSecurityZone.com , a website dedicated to covering the top tech stories and providing useful tips for the everyday user, in an effort to reach and help more people. In his off time he is an avid book reader, occasional PC gamer and affectionate football spectator. Daniel would hardly begrudge anyone who might call him a computer nerd, yet this might be just the thing one needs in case of a security issue.
  • bowlweevils

    In Step 3 for the “smart new tab virus removal” process, my Notepad search found these extra hosts:

    127.0.0.1 down.baidu2016.com

    127.0.0.1 123.sogou.com

    127.0.0.1 http://www.czzsyzgm.com

    127.0.0.1 http://www.czzsyzxl.com

    127.0.0.1 down.baidu2016.com

    127.0.0.1 123.sogou.com

    What do I do to get rid of them?

    I have already used AdwCleaner, Malwarebytes, and HitmanPro twice. Once last night (to remove the www-searching virus, where they found that virus and other malware that all got successfully removed. Then today the smartnewtab virus appeared in my Internet Explorer (but only there). These programs didn’t find it, or anything else that might be related to the content above.

    Nothing unusual appears in my “install/uninstall programs” process, either through Windows or the “Should I Remove It?” software, and I already went through Step 2 here before finding these in Step 3.

    Can you help me figure out what these are and get rid of them?

    Thanks

    • Hello! After looking at those IPs, you should definitely remove them from your Hosts file in our opinion. You can do that by simply deleting them as you would do any text from a notepad. Let us know if this solves your problem 🙂

      • bowlweevils

        When I delete them and save the file, they just appear again when I run the search.

        When I try to save the document in the location it opens from I get told that I don’t have permission from the administrator to save in that location and need to get permission from the administrator.

        I am the only person who has ever used this computer since it was purchased new, and don’t know why it is preventing me from saving the file in the proper location. How do I convince the computer that I am the administrator, or run the search and save process as the administrator?

        When I go to the control panel and look at the status of my User Account, it says I am the administrator. Why am I being asked to get permission from myself to save something, and why don’t I get prompted with any instructions on how to get permission from the administrator (me)?

        This seems like a flawed system.

        • Hello, it is strange but it is possible this is again a side effect of the virus. A couple of things that you can try to remedy this:
          1) Try doing this while in Safe mode. In theory that should do the trick.
          2) If not, try copying the contents of the hosts file to another one. Rename the new file to Hosts and try replacing the old one, that’s presumably corrupted.
          Let us know if any of these helped you.

          • bowlweevils

            I did something else.

            When trying to save to the drivers/etc location I noticed that there were no .txt files in the location already, so I switched to all files. That showed the hosts file and several others as blank sheets with no file extension. So I right-clicked on the hosts file and selected properties.

            That revealed that the change happened 12:39am Feb 4, which was while I had temporarily taken the firewall off as instructed by the Malwarebytes program to deal with a different browser hijack virus.

            Then I went to the security tab and gave the Users permission to modify the file in addition to the System and Administrators. I’m not sure if this was really necessary.

            After that I went to the Previous Versions tab and did a search which found a version at the initial date the computer was set in the Restore Point location. That had Open and Copy options available (but Restore was not), with Open leading to a “what program do you want to use?” mess, but Copy leading to my user account node (I think). Wherever it started at, though, I switched to the path to the C: drive and then through to the drivers/etc location and copied it to that. That restored the initial setting, and got rid of the other addresses.

            However, at some point tonight after doing various things to try to remove anything looking like a virus, or maybe the virus-host addresses did it, but I got a pop-up saying that my copy of Windows could not be validated as genuine. Now I am trying to figure out how to fix that. It would seem that entering my Windows validation number would do it, but that number was on a sticker on the bottom of my computer that is no longer legible after many years of being rubbed.

          • Hello,

            So I gather that your issue with Smart New Tab is resolved? Glad to hear. As for your new problem, I can think of some fixes for that, if you need any help-let us know.
            Cheers! 🙂

          • bowlweevils

            Smart New Tab was resolved thanks to your advice.

            Some help with the genuine issue would be nice. I’ve only looked a bit so far but most seem to involve a “slmgr -rearm” process that might make it impossible to apply any new updates to windows (7 for me)

          • Actually does the Win auto-updating work for you right now? If it does then I think that might actually fix your issue by itself.

          • bowlweevils

            Updating Windows seems to have worked for the “windows not genuine” problem. I had Windows set to notify me for updates instead of automatically doing it (or else it would shove Windows 10 at me). But when I looked, there were close to 60 recommended updates, so Windows was not doing a very good job of alerting me to updates.

            It took a long time to install them, and while that was happening I got angry pop-ups saying that the updates would not be installed because my Windows wasn’t genuine. But they were, and that issue hasn’t popped up again, but it’s only been a few hours.

            But right about the same time as last night, I got another IE browser hijack. It had a different name than yesterday but the screen was the same – a pop up saying I had to update Java.

            I went through the process again, and found an .opt file in the AppDataRoaming.oit folder with the time it happened and deleted it.

            Then when I got to the last step, the %Temp% search, two folders appeared instead of the usual one. The extra was labelled TempSweetIM maybe with some additional characters after it. The folder was empty, but the properties said it was created at about the same time. I deleted it, and did the search again, and it had reappeared.

            A google search for “tempsweetim” turned up only 9 hits, and 3 were in French, 1 German, and 1 Dutch (I can read all of these).

            These linked the folder to a sweetim exe or sweetim-somoto exe in AppDataLocalTemp folder. I had nothing but the extra temp folder though. Which wouldn’t go away.

            So I looked at the Previous Versions tab and found several from Feb 5 and one Feb 6 and one Feb 4 (IIRC), and one from the end of January. These were all located in \[email protected][name]Appdatalocal. Which is something that I did not know what it was, except that each version had a time stamp in the middle of it. And searching for localhost only brought up the “hosts” file that was still in the proper state.

            Left with this mysterious system which I was thinking might automatically restore itself from a previous version if the current one was deleted, but also had the Restore function active for me to use, I restored the earliest version from January, then did the %temp% search and deleted it again. That made the folder go away and not come back. Not yet at least.

            And the browser hijacker was also gone. But I’m not sure if it was deleting the .opt file or dealing with the sweetim folder (which didn’t appear yesterday, but had dates for 4 days in feb and 1 in january).

            And that has been my most complicated adventure in virus hunting ever.

          • An Adventure indeed. Glad we could be of help and you problems seems to be resolved. Stay safe.

            Cheers!

  • desani navakanth

    i could not find any thing you said in first 2 steps
    but i could find these in notepad

    127.0.0.1 down.baidu2016.com

    127.0.0.1 123.sogou.com

    127.0.0.1 http://www.czzsyzgm.com
    what do i do to remove these host files

    • Hello desani!

      You should definitely remove those. You can do that by simply selecting and deleting them from the hosts files. If you run into any trouble please let us know. There are some suspicious that Smart New Tab would not let some users save the changes made to the hosts file.

  • JBar

    Hi – question:

    I am having an issues with one “SmartNewTab” in particular. I think my case is a little different than that of the ones previously mentioned. I have only localhost IP’s yet my pc seems compromised with this Adware. What would you suggest I do about this? the only Adblocker I have up to date would be “AdBlock” and I downloaded it straight from CNET. Could this be the source of my problems?? I’m so tired of having to end all of my processes during time-consuming research for my university, all due to this sporadic pop-up. I’m almost to the point of screaming. Please help me!

    • Hello, JBar.

      I feel for you, this is definitely a very irritating Adware. Can you tell me whether you managed to complete some of the Steps in our guide. Also do you have Smart New Tab Ads appearing only on a particular browser?
      Give us some details about your case and we will do our utmost to help you out.

      • JBar

        Absolutely! And thanks for your punctuality.

        I was able to get up to Step 3 – Identifying IP’s and ensuring that no harmful host files were present. There weren’t any, only localhost files.

        I went to Step 4 and wasn’t quite sure if you were advising us to remove the “AdBlock” extension for the reason of it being under an unkown ID or if it was because it was an adblocker. As I’m looking at the details under my extension, the ID isn’t a strange name/series of numbers and characters, so I assume I’d be in the clear to keep it enabled… But who knows.

        I use Google Chrome as my main browser (mainly for it’s ergonomic simplicity), however if changing browsers would be an “easy way out”, I’d gladly switch to a different application.

        • Ok, I see why it might have seemed confusing. No, the Adblocker is probably not connected to your problem at all. Our picture is supposed to show where the Chrome extensions are, because there might or might not be an extension connected to SmartNewTab. Some affected users have it and some do not. If you don’t see it then no worries, there are other things that we can try out. I asked about your browser because if you are using more than one and experiencing problems then you might need to “exterminate” the application from all of them. If you are only using Chrome then I might offer you a solution but it will effectively reset your browser settings. So that is something that we don’t normally propose because you would lose all your bookmarks etc. Is this a concern for you?

          • JBar

            Understandable. Yes, I’d like to try that method out if you could assist. I would think that I could just copy and paste the links of bookmarks that I find are important and reset my browser settings… So no worries with that. I am willing to if this could solve my problems.

          • Ok, so since this is Google Chrome you will need to close the browser first. So you might want to copy/paste this to some place that you can easily read from. After you close Chrome down you need to go to where the browser settings and parameters are stored. It would normally be C(Or Letter the the partition where your OS have been installed) :/Users/Your User Name for this account/AppData/Local/Google/Chrome/User Data. Once there you should look for a folder named Default. Rename it to something else or simply delete it. I suggest renaming it just so you might revert back if you are not happy with the result. Upon starting Chrome again you should be with reset browser settings. We recommend continuing with the rest of the steps in our guide, just as a precaution. Let us know how that goes for you.

  • Cristina

    Hi,
    I tried looking for the virus in the programs but there’s nothing there. I also tried looking for anything manufactured by “unknown,” but there was also none. It’s as if there’s no trace of virus anywhere, but it still pops up all the time. What can I do?

    Thank you!

    • Hello Cristina,

      Don’t worry, continue on with the rest of our instructions. If you complete every step but Smart New Tab continues popping up – let us know. We will try to help you with some additional ideas.

      • Cristina

        I did all of it already, but there’s no trace of it. I even got a malware remover and it deleted all suspicious files. But then, just now, Smart New Tab popped up again.

        • Can you provide some additional information, like your Win version and what browser(s) is/are causing you troubles?
          Also did you try completing the steps in Safe Mode? Let us know.

          • Cristina

            I’m using Windows 7 and the browser is Chrome. The extensions on Chrome are only Google Docs. I haven’t tried them on Safe Mode, tho. How do I do that? And what shall I do while on Safe Mode?

          • Ok, so restart your computer and quickly tap the F8 Key while it is booting up. Choose Safe Mode With Networking. Repeat every step of our guide and once you have finished restart your computer again. See if it solved your problem and let us know. If not we can try resetting your browser settings, something that we don’t normally suggest but it might be helpful if you are prepared for the drawbacks.

          • Cristina

            Okay. I’ll try it on Safe Mode now and let you know. Thanks!

          • Cristina

            So I did everything again on Safe Mode. In the notepad localhost search, there were the same ones as in your example above. I deleted them. Other than that, nothing else.

          • You should retype the IPs you have deleted from the localhost file then. In our example the IPs are OK and every user would have them. Other than that are you still having problems with SmartNewTab?

          • Cristina

            Oh okay. As of now, it’s not popping up. I’ll let you know if I still have problems with it later on. Thank you!

          • You are welcome! Hope everything’s all right. Let us know if you have further issues.
            Regards!

  • Micha George-McFarlane

    I followed stages 1-5, I’ve used safe mode and everything has been deleted in these areas. When I followed stage 6 I found some files – but I’m not sure which files are ones that are normal and which are virus? I keep getting all different types of smart new tab and pop ups.

    • Hello Micha,

      Did you try following all the steps but in Windows Safe Mode? Also what type of browser are you having this issue on?

      • Micha George-McFarlane

        Yes I tried them in safe mode. I’m using Windows 10 and using Chrome. It’s not just smart new tab, there are lots of different tab pop ups with different names but I think they are from the same problem. I also have these empty pop up boxes that appear on my pages even though I have adblocker and adblocker plus both installed as extemsions. Stage 6 displayed some folders I recognised as the virus but to be honest I don’t know which folders re normal and which are a threat and should be deleted.

        • Alright,

          If you post a screenshot we will try to single out the truly malicious ones for you. Also you might want to consider resetting your Chrome Browsersettings. If you want help with this we can explain the process. Let us know how we can be of further service.

  • Pamela Jones Simpson

    Hi,

    My step 3 looks exactly like what was circled in red:

    # localhost name resolution is handled within DNS itself.
    # 127.0.0.1 localhost
    # ::1 localhost

    Can you tell me what I should do about this please?

    • Hello Pamela,

      You don’t need to do anything. This is a screenshot of a “healthy” hots file.