How to remove a rogue extension labelled "Installed by enterprise policy"

Question

I found a rogue extension (likely malware?) that I cannot removed, as the delete icon is greyed out and the extension says "installed by enterprise policy".

I have tried running Spybot Search and Destory, Malwarebytes Anit-Malware, ADWCleaner and HitmanPro - none of these removed it.

I also looked in the program list in Control Panel, but there is nothing that pertains to thie extension.

The extentsion is labelled "YTNoAeds".

I also uninstalled Chrome and cleared the Extension folder in User-Data (inside AppData).

Anyone got any ideas?

Solution 1

I took many of the suggested steps, and I removed everything I could find on my computer that made any reference to the Extension ID, including registry entries, files, etc. I used "Everything" search tool and scoured my drive for anything related to Chrome extensions or "ExtensionInstallForcelist." Thanks to all for the suggestions as I'm sure those steps are also necessaary, even after all that (including uninstall/re-install of Chrome) I STILL HAD THE EXTENSION LISTED IN CHROME! :(

The thing that finally removed it from my list and "SOLVED" the problem for me was to DELETE the Chrome user profile. Go to Settings > Users > "Delete this user." Somehow the Chrome profile was holding on to the Policy info somewhere, though I couldn't tell exactly where. The image below shows the action I used in Chrome Settings.

Hope this helps someone save a few hours of headache!

Solution 2

I just took care of this issue. I'm not sure if there are extra steps involved. I forgot the exact ID and directories involved, so I'll only provide general but specific steps to help you remove it.

1. Navigate to chrome://extensions/
2. Enable Developer mode
3. Take note of the unwanted extension ID
4. Close the browser
5. Open the registry editor (regedit.exe)
6. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Chrome\ExtensionInstallForcel‌​ist
   • Or HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chrome\ExtensionInstallForcel‌​ist
   • Alternatively HKEY_CURRENT_USER\Software\Policies\Chrome\ExtensionInstallForcelist
7. Look for a registry value that contains the ID (likely 1)
8. Take note of the value. It will contain a path on your computer pointing to an extension update file
9. Delete the registry value
10. Navigate to directory containing the above updater file
11. Delete the directory
12. Navigate to C:\Users\YOUR_NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions
13. Delete the directory corresponding to the noted ID

Basically, when looking for a weird extension that gets installed on a machine, I go look at the following key locations for the extension's ID:

• Registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chrome\ExtensionInstallForcelist
• Registry HKEY_CURRENT_USER\Software\Policies\Chrome\ExtensionInstallForcelist
• Registry HKEY_LOCAL_MACHINE\SOFTWARE\(Wow6432Node)\Google\Chrome\Extensions
• Registry HKEY_CURRENT_USER\Software\Google\Chrome\Extensions
• File system C:\Users\YOUR_NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions

If the above doesn't contain it, then a global search (registry and file system) usually reveals it.

Solution 3

You can see current policies in force by going to chrome://policy/

As of Version 28, Chrome no longer uses the registry to manage group policy. It now uses the regular windows GPO capabilities (See here). Malware may add a .pol policy file to Windows that is forcing the extension to appear in the list even after you have deleted the offending folders per FlameStream's advice. (Or by reviewing the location of the extension reported in the chrome://policy/ list.)

Look in C:\Windows\System32\GroupPolicy\User and C:\Windows\System32\GroupPolicy\Machine and any sub folders for .pol files. Review them with a text editor, and delete any .pol files that reference the extension unique identifier or contain the string "ExtensionInstallForceList".

Solution 4

I got the same thing, I tried almost everything. Only thing that I got it to atleast be disabled is downloaded Avast! Browser Cleanup. This is not the regular Avast, it is specifically for disabling extentions. Hope this helps you or others that google this problem.

View more solutions

Comments

[Ƭᴇcʜιᴇ007]

possible duplicate of How can I permanently remove a seemingly stealthy ad-ware installer?

[Nathan C]

Sounds to me like there's still a program installed that's just reinstalling the extension. Use Process Explorer to find something that's out of place.

[Mr Pablo]

I dont see a ExtensionInstallForcelist,but do see the ID in ExtensionInstallBlacklist...

[FlameStream]

Peculiar. I suspect that if you ran any cleaning application, then it might be the work of it as an attempt to disable the extension. I suggest doing a full registry search for the extension ID instead. If you found the string in another location, please reply back. Also, it might not be a bad idea to do a full file system search for that string too. I have a feeling that you may find related files directly in `C:\Users\YOUR_NAME\AppData\Local` (Not only Google Chrome's directory).

[FlameStream]

Reviewing my answer, it seems that I wrote the wrong key location. Have you tried HKEY_LOCAL_MACHINE\SOFTWARE(Wow6432Node)\Policies\Chrome‌​\ExtensionInstallFor‌​celist instead of HKEY_CURRENT_USER\software\Policies\Chrome\ExtensionInstallF‌​orcelist?

[Mr Pablo]

I found HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\Extension‌​InstallForcelist but it was empty.

[Snowburnt]

@MrPablo Worked perfectly for me, it was in the HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForceli‌​st. I'd suggest following FlameStream's second recommendation, search the registry and file system for the ID and delete the directory (probably in the C:\ProgramData directory)

[Mr Pablo]

I am not saying he is lying, simply that I do not have the same results as him.