Stop “New Tab Search” Browser Hijacker (More Versions, Second Update)

New Tab Search developers continue to create more versions of this browser hijacker and employ even more domains. We have already counted over 40 domains in previous articles here and here but it does not seem to slow down. Apart from names the websites seem to be quite identical and it is easy to identify that hey belong to the same adware family.

All websites have search field in the middle and a toolbar at the top which includes additional weather, news, maps and similar information. Rather than giving its own results, this fake search engine simply redirects to Yahoo or other search provider. Therefore, it acts as a parasite and is only designed to hijack browsers’ homepages and default searches and earn advertisement revenue from the generated traffic.

While the distribution methods of this adware are in most cases legal, they are not ethical since the users often do not suspect that this program is being installed as it is bundled with other freeware. Also, there is a risk that the creators follow your browsing activity through the unwanted extension. Therefore, we recommend removing it as soon as possible.

Simply uninstalling the extension might not help as the hijacker tends to come back. Therefore, we have a dedicated automatic removal tool which will completely eliminate the adware as well as protect your machine from any possible infections in the future. We also have a manual removal guide for more experienced users. However, even if you successfully remove the hijacker manually, you will still need to secure your PC afterwards.


Recommended Method: Download Browser Hijacker Removal Tool

Version:   All Updated:   2 days ago Compatible OS:   All
This is the most suitable program for automatically removing the threat and repairing your PC.
Works with: Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP. Read instructions here
File name Size
mb3-setup.exe 56.5 MB

Click here to download alternative tool

What is New Tab Search browser hijacker?

This browser hijacker infiltrates your system, changes browser settings and starts displaying unwanted homepage usually called “New Tab Search”. When trying to remove, the adware often comes back after a while since it has backup programs monitoring for any changes made by the user.

Like most of similar hijackers it is designed to generate traffic from infected browsers and earn money from displaying advertisements. It also redirects to third party search providers and gets a share of search advertisement revenue.

One of the main factors distinguishing this adware from others is the number of domains it uses. While others usually limit themselves to several domains at most, we have already recorded well over 50 domains used by “New Tab Search”. They all follow the same pattern search.domainname.com. Here is a list of the most recent ones:

search.directionsandmap.com
search.searchbuscar.com
search.searchcpn.com
search.searcheasyma.com
search.searcheazel.com
search.searchfindactivec.com
search.searchfpdfc.com
search.searchfreedm.com
search.searchlivesp.com
search.searchwatchos.com
search.searchwatchytsn.com
search.searchwssp.com

Each of these websites is associated with a different “product”. Otherwise the websites look almost identical and usually contain a toolbar at the top and search field in the middle. The toolbar has some additional information: local weather, news and sports. Sometimes a logo might be included and you can find a popular link list, a banner or a video at the bottom of the page. Here is a list of product names which you can usually find displayed at the top right corner:

Directions and Maps
Easy Maps Access
Find Active Coupons
Free Driver Maps
Free PDF Converter
Live Sports Player
Watch Online Streams
Watch Streaming Sports
Watch Your TV Shows Now
iCoupon Clipper

While the websites look like search engines they actually do not have such functionality and simply redirect your queries to other providers (usually Yahoo.com). This means that “New Tab Search” is simply a parasite which tries to get advantage of your browsing activity. Also, it poses a risk of leaking your private browsing data since all your queries go through suspicious website and the creators can record your history of visited websites.

People usually get this unwanted program while installing other freeware. Since “New Tab Search” is bundled with various programs, inattentive users might accidentally click “Accept” on setup steps suggesting to install additional software. As soon as this happens, the adware infiltrates your system and makes changes so it could not be easily traced and removed.

Remove this hijacker in order to restore normal browsing experience. Having adware running in the background slows down your system, impairs browsing and poses a risk of losing personal data. Therefore, use our automatic removal and protection tool in order to get rid of this unwanted program and protect your computer from any threats in the future. We have also prepared a manual removal guide. However, you will still need to secure your computer if you decide to eliminate the threat source only.

Screenshots of this adware:

    


 Manual Removal Instructions:

NB: Make sure you are familiar with editing important Windows settings and files. In order to not only remove the symptoms but also any possible leftovers of the malware we recommend using the automatic tool provided above.

Bookmark this page, print it out or simply open on another device in order to access it after a browser or computer restart which will be required during the removal process.

The removal instructions can also be found on each of the website (“Uninstall” link at the bottom of the page), however, this removal guide will guarantee that you completely remove any remains of the virus.

Step 1:

Remove any suspicious programs that might contain the adware.

Start by opening the Programs and Features window using the following method:

Hold Windows () key and click R key while holding.

Enter the following in the field:

appwiz.cpl

Click OK.

You might have to wait a bit before the list of all programs is loaded as it displays a list of all programs installed on your PC.

We recommend sorting the programs by “Installed On” column (simply click on the column name in order to sort by this value).

Look for any recently installed suspicious programs that might contain the adware as a bundle or could be the adware itself. If you have never seen or used an app chances are that it is an unwanted software.

Here are some unwanted programs:

Search Protect
Babylon
Browser Protect
Convert That PDF
SaferBrowser
My Email XP
Directions and Maps
Easy Maps Access
Find Active Coupons
Free Driver Maps
Free PDF Converter
Live Sports Player
Watch Online Streams
Watch Streaming Sports
Watch Your TV Shows Now
iCoupon Clipper

Uninstall all suspicious programs by right-clicking on them and choosing Uninstall…

Repeat this process until no more suspicious programs are left.

Step 2:

Delete registry values created by this adware.

Press and hold Windows () key and click R key.

Enter the following in the field:

regedit.exe

Click OK.

 

Search for virus entries by pressing keyboard buttons CTRL + F and entering the virus domain. You need to enter the virus name depending on the version you got installed. Here is an example:

mynewswire.co

Click Find Next.

Delete any registry entries associated with the virus.

Repeat the search until all entries are cleaned.

Step 3:

Clean up Windows temporary files.

You can safely remove all temporary files without posing any risk to your computer.

Hold Windows () key and click R key.

Enter the following in the field:

%Temp%

Click OK.

All temporary files will be listed in the directory.

Select all temporary files by simultaneously pressing CTRL + A and delete them.

Step 4:

Check for any recent changes in all the other important system files.

Hold Windows () key and click R key.

Enter the following in the field:

%AppData%

Click OK.

Do not delete anything here! Search for any recent changes (by “Date Modified”) in the files first. Only if you see that a file has just been changed scan it with virustotal.com. Remove only files marked as dangerous. Otherwise you might remove critical system files and Windows might stop working.

Repeat this step with the following three directories while being very careful:

%LocalAppData%
%ProgramData%
%WinDir%

Remember that these directories contain many important system files! Be very careful!

Step 5:

Delete the shortcuts for all browsers on your computer as they might have been changed by the virus.

Create them again in order to have clean browser start.

Alternatively, you can click Properties on each of the shortcuts and remove any additions made to the Target field by the virus.

Step 6:

IMPORTANT: Now you will have to reset browser settings for each browser individually that you have installed on your computer. Alternativelly, you could simply reinstall them.

Here is a list of known browser extensions (addons) that should be removed in order to stop the adware from reappearing:

Search Protect
Babylon
Browser Protect
Convert That PDF
SaferBrowser
My Email XP
Directions and Maps
Easy Maps Access
Find Active Coupons
Free Driver Maps
Free PDF Converter
Live Sports Player
Watch Online Streams
Watch Streaming Sports
Watch Your TV Shows Now
iCoupon Clipper

 Google Chrome:

Launch the browser and select More Tools, then click Extensions.

Check for any suspicious extensions.

Click Remove From Chrome for each unwanted or suspicious toolbar or extension (the trashcan icon on the right).

Go to Settings.

Scroll to the very bottom of the settings page and click Show advanced settings…

Scroll to the very bottom again and click Reset settings.

Click Reset.

 Mozilla Firefox:

Launch the browser and go to Add-ons.

Search for any suspicious toolbars and add-ons and Remove them.

We recommend going to Options (input about:preferences in your address field and press Enter) and clicking Restore to Default near the Home Page field.

You can also completely refresh the browser settings by entering the following in the address (URL) field:

about:support

Press Enter.

Click Refresh Firefox… and then click Refresh Firefox again.

 Microsoft Edge:

Since Microsoft Edge is not a separate program and is a core component of Windows 10 you should backup your computer or at least create a Restore Point before continuing.

Navigate to the following folder (where %username is your computer user name):

C:\Users\%username\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe

Clear all contents of the folder. Click CTRL + A to select everything and delete the contents.

Click Start (Windows logo).

Search for Windows PowerShell.

Right-click on the result.

Choose Run as administrator.

Paste the following command:

Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register $($_.InstallLocation)\AppXManifest.xml -Verbose}

Press Enter.

The settings should now be reset to default.

 Internet Explorer:

Press and hold Windows () key and click R key.

Enter the following in the field:

cmd

Click OK.

Enter the following command in the appeared window:

RunDll32.exe InetCpl.cpl,ResetIEtoDefaults

Press Enter.

Check Delete personal settings.

Click Reset.

Alternatively you can run this command to delete all caches and settings:

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

After removing the virus

When you have finished removing the New Tab Search adware and reverting your browser settings make sure to protect your computer by installing a good antivirus suite that would identify the threats online and in programs you have downloaded. Also, never install suspicious programs. If you are installing a new software, make sure it has nothing bundled in it by following the install wizard as well as searching for user reviews online.


Share your experience with us by leaving a comment!

Leave a comment to tell us about your experience removing this threat!
We can also help you if you run into any problems during the process, just don't hesitate to ask!

Leave a Reply

Your email address will not be published. Required fields are marked *