Removing invisible extension “happysale” in google chrome

Question

The extension "happysale" is showing ads by "gifton" in Google Chrome and Mozilla Firefox, and I seem to be unable to remove it.

When I go to extensions in Chrome I can't see it, but when i go to the task manager in Chrome it's there, tagged as extension and I can manually shut it down, but that get's annoying over time.

I've checked the chrome-folder: "C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\Extensions", but it's empty except for an empty .json file.
I have also checked the registry, but I can't find it there either. Neither MalwareBytes nor my antivirus Mcafee find anything either. I have also resorted to using Malwarebytes anti-rootkit, but that also didn't give me anything.

I am at a loss as to what to do next.

Here is a copy of what stands in chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --extensions-on-chrome-urls --test-type --load-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\app" --load-component-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\man" --flag-switches-begin --flag-switches-end

But in the directory Chrome\Application\Extensions is no folder for "chrome", and therefore no file/folder called "man".

Solution 1

This invisible extension could be loaded via a command-line argument. To confirm that this indeed the case, visit chrome://version and look at the line with label "Command Line:".

The "Command Line" SHOULD have the following pattern:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --flag-switches-begin --flag-switches-end

If you have ever visited chrome://flags, then there may be some extra flags between --flag-switches-begin and --flag-switches-end. These flags are usually innocent.

I think that some malware has changed your Google Chrome shortcut, to include additional flags that load the invisible extension. This change will show up at the Command Line at chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --[name of flag not shown]=path\to\happysale-adware --flag-switches-begin --flag-switches-end

^{(I've intentionally hidden the actual flag name to prevent abuse by malware writers who come across this answer.)}

To resolve your problem, edit your Chrome shortcut:

1. Right-click on the Google Chrome icon.
2. Choose properties.
3. Click on the Shortcut tab.
4. Edit the Target textfield, and delete every flag, so it ends with chrome.exe, e.g. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe".

Solution 2

[SOLVED] None of them worked for me. Though what worked was a strategic maneuver with the mouse.

Follow these steps to find the Extension which is actually hidden in the chrome extensions page:
1. open the URL [chrome://extensions/]
2. Disable the topmost extension on this page(click on the checkox right beside Enable).
3. The moment you disable the topmost extension you'll see a hidden extension of "happysale"(in my case) flash once and gets hidden again.

4. Most important step, now all you have to do is get a mouse and try enabling/disabling the topmost extension until you get a clear idea of where the Delete icon for the target extension is.
5. Now just lock your target and shoot the Delete icon as soon as you disable the topmost visible extension. You need to be extremely fast and and a good FPS player to get it right in one go. You might even need to repeat it a few times to get it right.
6. If that seemed impossible for you, you can download "Auto Mouse Clicker v4.0" and create an script for automatic clicks to delete the adware in an easier way. It takes a while to learn how to set automatic clicks, but it's worth it, I took like 10 min to make a perfect move.
You have to set the position of the automatic clicks, so the first one will be on "enable/disable" and the second one will be on "delete". Set the delay of the clicks for 11 miliseconds. After that, save the file and create a keyboard shortcut to start the clicks

It's a rat chase, thats all it is.

Comments

[Debra]

Might seem overly-obvious, but have you tried removing it via "Programs and Features"? All the info I can find indicate that it installs and removes separately and visibly.

[ElectricIcecream]

That was one of the first things I did, but there is no program or feature listed that has any connection to either "happysale" or "gifton". Just checked again, but nothing there.

[Debra]

Did you contact support at www.happysale.com? Search the drive for gifton instead?

[ElectricIcecream]

Just sent a mail to support, waiting for an answer now. And yes, the first thing I searched the drive for was in fact "gifton", then "happysale".

[jiggunjer]

I do have modified flags, but my target is just the chrome.exe, nothing odd to be soon in shortcut properties. So how to fix flags?

[Rob W]

@jiggunjer Double-check all shortcuts, environment variables and chrome://flags.

[jiggunjer]

Only have one shortcut on taskbar. Environment is clean too. chrome://flags is untouched. Why does chrome://version tell me about those flags...