Site icon MySpyBot

Remove virus popup from Chrome/Firefox/Edge/Safari

Get an effective fix for the browser redirect and popup problem paired with malicious activity of the Auto Refresh extension.
  1. What is
  2. Automated removal of virus
  3. popups and redirects removal for Android
  4. Restore web browser settings to their original defaults

What is is a dubious Internet domain that exhibits several characteristics setting it apart from regular websites. The most conspicuous quirk is that, unlike a benign page, it contains no content of its own. Instead, its role is to redirect the traffic to a series of NSFW sites, most of which are dating services the victims never opted into using. When a PC is infected, the user encounters new tabs being incessantly opened with URL in them. This drag mostly takes place whenever a web search query is entered in the address bar, although it may as well occur spontaneously in the middle of a web surfing session. The source of this foul play lurks in the web browser and manifests itself no matter if the person prefers Google Chrome, Mozilla Firefox, Internet Explorer, or Safari for their day-to-day online activities.

Every instance of rerouting via is a matter of seconds before it reaches the landing page. Speaking of which, there is a whole network of sites promoted this way – as previously mentioned, those are mainly adult resources the affected users don’t intend to visit. A few examples are,,,, and The latter two sites leverage a notorious trick involving fraudulent permission requests to display notifications. If the unsuspecting victim clicks the ‘Allow’ button on such dialogs, this will unleash a stream of obnoxious web push notifications that appear even when the malware-stricken browser isn’t open. The hyperlinks embedded in these popups promote services that range from legit ones to outright sketchy entities that may deposit dangerous code onto the visiting computers.

Threat details:
Name popup / redirect malware
Threat Category Adware, browser hijacker

Domains involved,,,,

Related malware
Auto Refresh, Page Refresh
Symptoms Browser redirects, fraudulent permission requests, unwanted popup ads, browser slowdown
Distribution techniques Malicious app bundles, search engine poisoning, booby-trapped extensions
Severity Medium
Damage Internet activity tracking, search redirects, unauthorized changes of browsing preferences, malicious ads
Removal Scan your PC with SpyHunter to detect all files related to popup virus. Free scan determines if your system is infected. To get rid of the threat, you need to purchase the full version of the anti-malware tool:

Other than the above-mentioned tricky requests to show potentially unsafe messages non-stop, the dating sites pushed by may conceal extra threats underneath the explicitly demonstrated embarrassing materials. They run the gamut from drive-by virus downloads to the theft of personally identifiable information (PII) through tracking cookies surreptitiously dropped into the browser. When running, these items collect the Internet navigation history, search queries, and personal credentials. This can, obviously, undermine one’s privacy, fuel spear-phishing attacks, and lead to account takeover. One more thing that makes victims frown is that the people around – family members or co-workers – may notice shameful content on the screen. This is an awkward situation in itself.

Coin mining malware is another common example of dodgy code backed by the malvertising campaign featuring It’s furtive by design, plus its presence may be eclipsed by the nasty redirects occurring iteratively. Once a cryptojacker is executed behind the scenes, it parasitizes the CPU resources to mine Bitcoin, Ethereum, Monero, or other forms of cryptocurrency. This tampering will drain the machine’s processing power and cause the system to slow down to a crawl. Not only will the exhausted hardware become incapable of performing routine tasks, but it may malfunction down the line, too. popup virus is typically distributed by means of contagious browser helper objects that look harmless and even useful but turn out to be wolves in sheep’s clothing. One such app is the fairly popular browser extension called Auto Refresh. Its purported purpose is to keep users signed into websites that tend to log users out after a specific period of inactivity. While this feature is handy as it saves time and makes things hassle-free, the add-on has recently started breaking bad. Its component called background.js has been repurposed to invoke a traffic reorganization scheme without due approval. When added to Chrome or another browser, Auto Refresh will keep causing popups and suchlike unwanted effects to resolve The malicious page, in turn, dispatches the intercepted session according to a predefined algorithm so that the user goes to the affiliated X-rated sites over and over. By the way, a similar extension that does pretty much the same is called Page Refresh. Users would be better off avoiding both of these entities. If the browser hijack is already underway, the following steps will help sort it out.

Automated removal of virus

Owing to an up-to-date database of malware signatures and intelligent behavioral detection, the recommended software can quickly locate the infection, eradicate it and remediate all harmful changes. So go ahead and do the following:

1. Download and install the antimalware tool. Open the solution and have it check your PC for PUPs and other types of malicious software by clicking the Start Computer Scan button

Download popup virus remover

2. Rest assured the scan report will list all items that may harm your operating system. Select the detected entries and click Fix Threats to get the troubleshooting completed.

Use Control Panel to get rid of the PUA

• Open up the Control Panel from your Start menu in Windows. Depending on the OS build, select Uninstall a program (Windows 10, 7 and Vista) or Add or Remove Programs (Windows 8)

• To facilitate the process of locating the threat, sort the programs list by date to get the latest ones displayed at the very top. Find an unfamiliar, suspicious entry under the Name column, click Uninstall and follow further directions to get the removal done popups and redirects removal for Android

Here’s a walkthrough to sort out the malware issue on an Android device, which might also be a target in this malvertising campaign. Keep in mind, though, that uninstall attempts in regular mode may be futile due to the mechanics of this persistent infection. Therefore, you need to perform the procedure in safe mode. Go ahead and do the following:

• Press and hold the Power button. Then, tap and hold the Power off option on the screen. Doing so will boot your device into safe mode

• Android will ask you to confirm that you’d like to enter safe mode. Tap OK on the dialog

• You will now see the Safe mode inscription at the bottom left of your screen. Go to Settings and choose Apps

• Scroll down the list of applications, focusing on the ones that were installed recently. Find the sketchy entry with a different name that could as well be the culprit

• Select the misbehaving app and tap Uninstall

• Confirm removal on the relevant dialog box and reboot your device. By default, Android will get you back into regular mode. You should now be good to go – the adware won’t be triggering any redirects or irritating popups anymore.

Restore web browser settings to their original defaults

In the circumstances of a complex browser hijack like this, executing a reset makes the most sense despite a few obvious downsides. Customizations such as saved passwords, bookmarked pages etc. will be gone, but so will all the changes made by the potentially unwanted program. The instructions below address the workflow for the web browsers most targeted by the popup virus.

Reset Google Chrome

• Open Chrome, expand the Customize and control Google Chrome menu and choose Settings

• Scroll down the settings screen and click Advanced down at the bottom

• Move on to the Reset and clean up sub-section and select the option that says Restore settings to their original defaults

• Finally, confirm the restoration by clicking Reset settings on the warning message

• Restart Chrome.

Reset Mozilla Firefox

• Open Firefox, type about:support in the URL area and press Enter. Alternatively, you can click on the Open menu icon in the top right-hand part of the browser window, then select the Help option and proceed to Troubleshooting Information

• On the Troubleshooting Information screen, spot the Refresh Firefox button and click on it

• Follow subsequent directions to reset Firefox to its original settings

• Restart the browser.

Reset Microsoft Edge

• Select Internet options under IE’s Tools (Alt+X)

• Proceed by clicking on Advanced tab, then select Reset

• To confirm the intended changes, click Reset on the Reset Internet Explorer Settings screen after ascertaining that the Delete personal settings checkbox is enabled

• Reboot the machine to fully implement the fix.

Reset Safari

• Go to the Safari menu and select Preferences

• When on the Preferences screen, select the Privacy tab and hit the Remove All Website Data button if you are up to erasing all website data stored on your Mac. Otherwise, you can use a site-specific removal option described below

• A dialog will appear, asking you to validate your choice. Click the Remove Now button if you are sure. Be advised this will log you out of online services and undo personalized web browser settings such as saved passwords, etc.

• Safari also allows deleting data for specific sites rather than all sites in general. To use this option, click the Details button under Privacy tab

• Select the websites for which you would like to erase data and click the Remove button

• Click the Done button to confirm and exit. You can also select the Remove All option to remove all data stored by the listed websites.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup.

Download popup virus removal tool

Rate article

No rating result yet
Exit mobile version