Remove “New Tab Search” Hijacker From Your Browser (More Versions)

New Tab Search is a browser hijacker which haves an exceptional amount of different domains and versions. A previous article has already discussed many of these versions but it seems that the adware is constantly evolving as more and more different websites appear. This article is an update on this hijacker.

The adware hijacks your home page and shows a website called “New Tab Search” which has a search input field, several links below and a toolbar at the top, usually including some weather, sports or TV information. Each version promotes different product which name is usually written in the top right corner (for example, “Your Email Now“).

Despite its claims, this search does not not provide any additional value as it simply redirects your queries to Yahoo or other search provider. Therefore, the only functions of these parasite websites are to track your browsing activity and display unwanted advertisements

We strongly suggest you to remove this unwanted program as soon as possible in order to protect your private data. This way you will also regain the control of your browser settings which are currently taken over by the malware. Use our automatic removal tool or follow the manual removal guide. The automatic tool will also act as an antivirus in the future to protect you from any possible threats while the the manual method only removes the symptoms.


Recommended Method: Download Browser Hijacker Removal Tool

Version:   All Updated:   2 days ago Compatible OS:   All
This is the most suitable program for automatically removing the threat and repairing your PC.
Works with: Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP. Read instructions here
File name Size
mb3-setup.exe 56.5 MB

Click here to download alternative tool

What is New Tab Search browser hijacker?

New Tab Search adware is similar to other hijackers. It starts by infiltrating the Windows and placing its backup files in the system. It then modifies browser shortcuts and settings to make your browsers open malicious search websites every time you launch them. The websites are called “New Tab Search” to look less suspicious and avoid removal for as long as possible. This unwanted program also tends to come back even if you change the settings since it has its control files hidden deeply in the system.

This hijacker employs an unusual number of domains in order to make it harder for the infected victims to find help online and remove the threat. We have already counted close to 50 almost identical adware websites belonging to the same company but there might be even more since new ones appear every day.

Here is an alphabetized list of domains found during this update:

search.easyvideoconverteraccess.com
search.emailfaster.co
search.getsports.co
search.ma-cmf.com
search.mynewswire.co
search.nw-cmf.com
search.ph-cmf.com
search.searchfcs.com
search.searchglnn.com
search.searchmmap.com
search.searchtp.com
search.searchwos.com
search.searchwwf.com
search.theweathercenter.co
search.youremailnow.com
search.yourinstantfileconverter.com
search.yourinstantrecipes.com
search.yourinstanttelevision.com
search.yourvidconverter.com

Each of these websites looks almost identically. Only the toolbars at the top are slightly different as well as each of the pages is associated with a different product. Here is a list of the products (their names are usually displayed at the upper right corner). In rare cases the websites have a “Menu” button instead of a product name and it usually includes links like “Roblox”, “Skincraft” and “Minecraft”.

Easy Video Converter Access
Email Faster
Fast Career Search
Get Local News Now
Get Sports
Maps Driving Directions
My News Wire
The Weather Center
Trackerpackage (Track My Package)
Watch Online Streams
World Wide Forecasts
Your Email Now
Your Instant Converter
Your Instant Recipes
Your Instant Television
Your Video Converter Now

All these websites belong to the same company called “Polarity Technologies”. They generate revenue by displaying advertisements, redirecting your searches and including affiliate links. The company gets new installs for its products by bundling their software with another freeware. When you download a legitimate program from a downloads site you might also receive adware attached to the installation file. Quickly skipping through the setup wizard often results in other software installed in the background. While this is legal in many cases, it is unethical and is aimed at less experienced or incautious users.

Remove this hijacker as soon as possible in order to protect your privacy and regain access to your browser settings. Follow our manual guide or simply use the automatic removal and protection tool listed at the beginning of this page. We strongly recommend securing your computer as having this adware present shows that there is a vulnerability in the system or it is simply left unprotected.

Screenshots of some of the “New Tab Search” hijacker versions:

    


 Manual Removal Instructions:

NB: Make sure you are familiar with editing important Windows settings and files. In order to not only remove the symptoms but also any possible leftovers of the malware we recommend using the automatic tool provided above.

Bookmark this page, print it out or simply open on another device in order to access it after a browser or computer restart which will be required during the removal process.

The removal instructions can also be found on each of the website (“Uninstall” link at the bottom of the page), however, this removal guide will guarantee that you completely remove any remains of the virus.

Step 1:

Remove any suspicious programs that might contain the adware.

Start by opening the Programs and Features window using the following method:

Hold Windows () key and click R key while holding.

Enter the following in the field:

appwiz.cpl

Click OK.

You might have to wait a bit before the list of all programs is loaded as it displays a list of all programs installed on your PC.

We recommend sorting the programs by “Installed On” column (simply click on the column name in order to sort by this value).

Look for any recently installed suspicious programs that might contain the adware as a bundle or could be the adware itself. If you have never seen or used an app chances are that it is an unwanted software.

Here are some unwanted programs:

Search Protect
Babylon
Browser Protect
Convert That PDF
SaferBrowser
My Email XP
Easy Video Converter Access
Email Faster
Fast Career Search
Get Local News Now
Get Sports
Maps Driving Directions
My News Wire
The Weather Center
Trackerpackage (Track My Package)
Watch Online Streams
World Wide Forecasts
Your Email Now
Your Instant Converter
Your Instant Recipes
Your Instant Television
Your Video Converter Now

Uninstall all suspicious programs by right-clicking on them and choosing Uninstall…

Repeat this process until no more suspicious programs are left.

Step 2:

Delete registry values created by this adware.

Press and hold Windows () key and click R key.

Enter the following in the field:

regedit.exe

Click OK.

 

Search for virus entries by pressing keyboard buttons CTRL + F and entering the virus domain. You need to enter the virus name depending on the version you got installed. Here is an example:

mynewswire.co

Click Find Next.

Delete any registry entries associated with the virus.

Repeat the search until all entries are cleaned.

Step 3:

Clean up Windows temporary files.

You can safely remove all temporary files without posing any risk to your computer.

Hold Windows () key and click R key.

Enter the following in the field:

%Temp%

Click OK.

All temporary files will be listed in the directory.

Select all temporary files by simultaneously pressing CTRL + A and delete them.

Step 4:

Check for any recent changes in all the other important system files.

Hold Windows () key and click R key.

Enter the following in the field:

%AppData%

Click OK.

Do not delete anything here! Search for any recent changes (by “Date Modified”) in the files first. Only if you see that a file has just been changed scan it with virustotal.com. Remove only files marked as dangerous. Otherwise you might remove critical system files and Windows might stop working.

Repeat this step with the following three directories while being very careful:

%LocalAppData%
%ProgramData%
%WinDir%

Remember that these directories contain many important system files! Be very careful!

Step 5:

Delete the shortcuts for all browsers on your computer as they might have been changed by the virus.

Create them again in order to have clean browser start.

Alternatively, you can click Properties on each of the shortcuts and remove any additions made to the Target field by the virus.

Step 6:

IMPORTANT: Now you will have to reset browser settings for each browser individually that you have installed on your computer. Alternativelly, you could simply reinstall them.

Here is a list of known browser extensions (addons) that should be removed in order to stop the adware from reappearing:

Search Protect
Babylon
Browser Protect
Convert That PDF
SaferBrowser
My Email XP
Easy Video Converter Access
Email Faster
Fast Career Search
Get Local News Now
Get Sports
Maps Driving Directions
My News Wire
The Weather Center
Trackerpackage (Track My Package)
Watch Online Streams
World Wide Forecasts
Your Email Now
Your Instant Converter
Your Instant Recipes
Your Instant Television
Your Video Converter Now

 Google Chrome:

Launch the browser and select More Tools, then click Extensions.

Check for any suspicious extensions.

Click Remove From Chrome for each unwanted or suspicious toolbar or extension (the trashcan icon on the right).

Go to Settings.

Scroll to the very bottom of the settings page and click Show advanced settings…

Scroll to the very bottom again and click Reset settings.

Click Reset.

 Mozilla Firefox:

Launch the browser and go to Add-ons.

Search for any suspicious toolbars and add-ons and Remove them.

We recommend going to Options (input about:preferences in your address field and press Enter) and clicking Restore to Default near the Home Page field.

You can also completely refresh the browser settings by entering the following in the address (URL) field:

about:support

Press Enter.

Click Refresh Firefox… and then click Refresh Firefox again.

 Microsoft Edge:

Since Microsoft Edge is not a separate program and is a core component of Windows 10 you should backup your computer or at least create a Restore Point before continuing.

Navigate to the following folder (where %username is your computer user name):

C:\Users\%username\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe

Clear all contents of the folder. Click CTRL + A to select everything and delete the contents.

Click Start (Windows logo).

Search for Windows PowerShell.

Right-click on the result.

Choose Run as administrator.

Paste the following command:

Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register $($_.InstallLocation)\AppXManifest.xml -Verbose}

Press Enter.

The settings should now be reset to default.

 Internet Explorer:

Press and hold Windows () key and click R key.

Enter the following in the field:

cmd

Click OK.

Enter the following command in the appeared window:

RunDll32.exe InetCpl.cpl,ResetIEtoDefaults

Press Enter.

Check Delete personal settings.

Click Reset.

Alternatively you can run this command to delete all caches and settings:

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

After removing the virus

When you have finished removing the New Tab Search adware and reverting your browser settings make sure to protect your computer by installing a good antivirus suite that would identify the threats online and in programs you have downloaded. Also, never install suspicious programs. If you are installing a new software, make sure it has nothing bundled in it by following the install wizard as well as searching for user reviews online.


Share your experience with us by leaving a comment!

Leave a comment to tell us about your experience removing this threat!
We can also help you if you run into any problems during the process, just don't hesitate to ask!

Leave a Reply

Your email address will not be published. Required fields are marked *