Ads by VNPApps: what it is and how to remove it

No. Notifications from getnewsoft.theonlinelive.net come from a permission stored in the browser, not from a program installed in Windows. Someone clicked Allow on a prompt from that site, usually without realising what it meant, and the site now sends ads through the browser's notification system.

Antivirus scans often find nothing because there is nothing to find on the disk. Removing getnewsoft.theonlinelive.net from the browser's list of allowed sites stops the messages for good. A scan is still useful if you clicked a notification and downloaded or ran something from the page it opened, because those downloads can be unwanted programs.

No. Notifications from getnewsoft.theonlinelive.net are adverts written to look like system messages. A website cannot scan your files, so it has no way to know whether your PC is infected; it shows the same warning to everyone who allowed its notifications. Real Windows Security messages name Windows Security in the bottom line, not a browser and a website.

If you want to be sure, open Windows Security from the Start menu and run a quick scan there. Then remove getnewsoft.theonlinelive.net from the browser's notification settings so the fake warnings stop arriving. Do not call any number or buy anything the notification or its page suggests.

Because that is its whole purpose. Ads by VNPApps is a push-notification spam site, and its operators are paid for every ad it displays and every click it gets. In this case the ads take the form of desktop notifications.

They are chosen by ad networks that accept almost any advertiser, which is why so many look like warnings or prizes. The ads are not a sign that your PC is broken or infected with something worse; they are a sign that something on it, or in the browser, has permission to advertise. Removing that permission or program stops them.

No. The site getnewsoft.theonlinelive.net exists to push visitors towards ads, and the pages it leads to include fake virus warnings, fake updates, prize scams and notification prompts. Visiting it once does not infect an up-to-date PC, but anything you click or download there is a gamble.

Do not enter personal details, do not allow notifications and do not call phone numbers it shows. If it opens by itself, close the tab and check the browser's extensions and notification permissions. Blocking the single domain helps little, because the operators register new names regularly.

Each notification shows the name of the browser and the site in its small print. In the cases we saw, the messages from getnewsoft.theonlinelive.net came through Chrome, Edge and Firefox. Permissions are stored per browser and per profile, so removing the site in one browser does not affect another.

If you use several Chrome or Edge profiles, check each one. If you sync the browser with an account, remove the permission while signed in, otherwise another computer may still hold it and keep receiving the same messages.

Look for notifications from getnewsoft.theonlinelive.net. That is the trace Ads by VNPApps leaves, and it shows up as desktop notifications. Ads that appear on every site, including ones that never carried ads before, point to something on your PC or in the browser rather than to the sites themselves.

A quick test is a private window, where extensions are off by default: if the ads disappear there, an extension is responsible. If they appear even with the browser closed, the source is a notification permission or a program in Windows.

The number belongs to scammers, not to Microsoft or an antivirus company. If you only talked, hang up and do not call back. If you let them connect to the PC, disconnect it from the internet, uninstall the remote access program they used, such as AnyDesk, TeamViewer, ScreenConnect or UltraViewer, and run a full and offline scan.

If you paid or gave bank details, call your bank at once on the number printed on your card. Change any passwords you typed while they were connected, and report the call.

Only for as long as it is on. Do not disturb in Windows 11 holds back notifications from all apps, including browsers, and releases them to the notification centre later. The site still has permission and the messages still arrive.

Use the browser's notification settings to remove the site instead: once its permission is gone, it cannot send anything, whatever Windows is set to. Keep Do not disturb for what it is meant for, such as meetings, presentations and quiet hours.

Many security products do not block adware or notification sites by default, because users often agreed to them, even through a misleading prompt. Notification spam installs nothing at all, so there is no file to detect.

In Windows 11 you can make Microsoft Defender block potentially unwanted apps: open Windows Security > App & browser control > Reputation-based protection settings and turn on Potentially unwanted app blocking. If notifications caused the pop-ups, no scanner will report them; the fix is in the browser's site settings.

No program removes Ads by VNPApps itself, because there is nothing on the PC to remove: the notifications come through a permission saved in the browser, and only the browser's settings take it away, as the steps above show.

What Fortect can do is check the rest of Windows. Its free scan looks for malware, unwanted programs and damaged system files, which is useful if you clicked the ads, downloaded something from the pages they opened, or are not sure what else changed on the PC.

If the scan finds nothing and the notifications stopped after you removed the permission, this problem is solved. Use Microsoft Defender as a second opinion whenever you have downloaded files from pages like these.