windows 7 - How to remove a rogue extension labelled "Installed by enterprise policy"

06
2014-04
  • Mr Pablo

    I found a rogue extension (likely malware?) that I cannot removed, as the delete icon is greyed out and the extension says "installed by enterprise policy".

    I have tried running Spybot Search and Destory, Malwarebytes Anit-Malware, ADWCleaner and HitmanPro - none of these removed it.

    I also looked in the program list in Control Panel, but there is nothing that pertains to thie extension.

    The extentsion is labelled "YTNoAeds".

    I also uninstalled Chrome and cleared the Extension folder in User-Data (inside AppData).

    Anyone got any ideas?

  • Answers
  • chipperyman573

    I took many of the suggested steps, and I removed everything I could find on my computer that made any reference to the Extension ID, including registry entries, files, etc. I used "Everything" search tool and scoured my drive for anything related to Chrome extensions or "ExtensionInstallForcelist." Thanks to all for the suggestions as I'm sure those steps are also necessaary, even after all that (including uninstall/re-install of Chrome) I STILL HAD THE EXTENSION LISTED IN CHROME! :(

    The thing that finally removed it from my list and "SOLVED" the problem for me was to DELETE the Chrome user profile. Go to Settings > Users > "Delete this user." Somehow the Chrome profile was holding on to the Policy info somewhere, though I couldn't tell exactly where. The image below shows the action I used in Chrome Settings.

    enter image description here

    Hope this helps someone save a few hours of headache!

  • FlameStream

    I just took care of this issue. I'm not sure if there are extra steps involved. I forgot the exact ID and directories involved, so I'll only provide general but specific steps to help you remove it.

    1. Navigate to chrome://extensions/
    2. Enable Developer mode
    3. Take note of the unwanted extension ID
    4. Close the browser
    5. Open the registry editor (regedit.exe)
    6. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Chrome\ExtensionInstallForcel‌​ist
      • Or HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chrome\ExtensionInstallForcel‌​ist
      • Alternatively HKEY_CURRENT_USER\Software\Policies\Chrome\ExtensionInstallForcelist
    7. Look for a registry value that contains the ID (likely 1)
    8. Take note of the value. It will contain a path on your computer pointing to an extension update file
    9. Delete the registry value
    10. Navigate to directory containing the above updater file
    11. Delete the directory
    12. Navigate to C:\Users\YOUR_NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions
    13. Delete the directory corresponding to the noted ID

    Basically, when looking for a weird extension that gets installed on a machine, I go look at the following key locations for the extension's ID:

    • Registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chrome\ExtensionInstallForcelist
    • Registry HKEY_CURRENT_USER\Software\Policies\Chrome\ExtensionInstallForcelist
    • Registry HKEY_LOCAL_MACHINE\SOFTWARE\(Wow6432Node)\Google\Chrome\Extensions
    • Registry HKEY_CURRENT_USER\Software\Google\Chrome\Extensions
    • File system C:\Users\YOUR_NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions

    If the above doesn't contain it, then a global search (registry and file system) usually reveals it.

  • user297338

    I got the same thing, I tried almost everything. Only thing that I got it to atleast be disabled is downloaded Avast! Browser Cleanup. This is not the regular Avast, it is specifically for disabling extentions. Hope this helps you or others that google this problem.

  • CCrawford

    You can see current policies in force by going to chrome://policy/

    As of Version 28, Chrome no longer uses the registry to manage group policy. It now uses the regular windows GPO capabilities (See here). Malware may add a .pol policy file to Windows that is forcing the extension to appear in the list even after you have deleted the offending folders per FlameStream's advice. (Or by reviewing the location of the extension reported in the chrome://policy/ list.)

    Look in C:\Windows\System32\GroupPolicy\User and C:\Windows\System32\GroupPolicy\Machine and any sub folders for .pol files. Review them with a text editor, and delete any .pol files that reference the extension unique identifier or contain the string "ExtensionInstallForceList".

  • Genaro

    Website-http://www.avast.com/int-30-60-is-trial Once you get there click the 30 day trial. click download once you have downloaded the program open it go to browser clean up once you have finished cleaning your browser you will have to manually disable the extension from google chrome extensions REMEMBER this is to disable the extension NOT to delete it once you have completed the instructions you will no longer have the extension enable

    USER - Windows can be used for other platform

    Thanks,have any questions fill free to ask


  • Related Question

    How to download Chrome extensions for installing in another computer?
  • Jader Dias

    A computer I use doesn't have access to chrome.google.com/extensions website. I wish I could download the plugin and then use the file to install it, but the only option I have is to install. The plugin is downloaded to a temporary folder with a random name, and I'm not able to identify it.


  • Related Answers
  • evan.bovie

    I've wondered how to do this too. I found this blog article that has the solution (I edited it to bring it up-to-date):

    1. Find the ID of the extension you’re interested in. When on the details page of the extension, it will be something like
      bfbmjmiodbnnpllbbbfblcplfjjepjdn
      after
      https://chrome.google.com/webstore/detail/
    2. Paste this into Firefox (not Chrome):
      https://clients2.google.com/service/update2/crx?response=redirect&x=id%3D~~~~%26uc
      and replacing ~~~~ with the extension ID.
    3. You’ll be prompted to save a CRX file. Drag this file to a Chrome window and proceed with installation
  • lspcity

    Or just use http://chrome-extension-downloader.com to download a chrome extension easily.

  • Tarun

    If you have access to the codebase for the .crx package, you can also install it directly in chrome by going to chrome://extensions/.

    Next click on "Load Unpacked Extensions" and select the root directory (of the code).

    The extension should work now.