Search

Home

Malware

Tutorials

Tools&Resources

About

Contact

HowtoremoveChromeextensionInstalledbyenterprisepolicy
GPO
Manyadwareorpotentiallyunwantedprograms(PUP)installextensionsinsideyourChrome
browserusingenterprisepolicysoyoucannotremovethemthroughChromeextensionssettings
(chrome://extensions/.).Morespecifically,theseextensionsaremanagedandinstalledby
enterprisepolicyGPOsotheycannotbeuninstalledeasilyusingChromesettings.

Featured
HowtoBlockPornSitesonall
Webbrowsers&Network
Devices.
BestFreeAntivirusProgramsfor
Homeuse.

Probablytheseextensionsareinstalledonyourcomputerafteryoudownloadandinstallother
freesoftwarefromtheInternet.

QuickMalwareScanandRemoval
GuideforPC's.

Note:Youmustalwayspayattentionwhenyouinstallsoftwareonyourcomputer.

Howtoinstallandcleanyour
computerwithMalwarebytes
AntiMalwareVersion2.0(FREE)
FullMalwareScan&Removal
GuidetoCleanHeavyInfected
Computers

IfyouwanttoremoveanyextensioninstalledbyEnterprisepolicyfollowthestepbelow:

HowtoremoveChromeextensionsinstalledbyenterprise
policyGPO
Step1.UninstalltheunwantedextensionfromyourControlpanel.
1.Todothis,goto:
Windows8/7/Vista:Start>ControlPanel.
WindowsXP:Start>Settings>ControlPanel

2.Doubleclicktoopen
AddorRemoveProgramsifyouhaveWindowsXP
ProgramsandFeaturesifyouhaveWindows8,7orVista.

3.Intheprogramlist,findandremove/Uninstallanyunknownorunwantedapplication.e.g.
(MediaPlayer,MediaServer1.1,VideoPlayer,BlOuckTheAdAppp,etc.)

Step2:FindfromChrometheIDoftheunwantedextension&thenDeletethe
MaliciousRegistryKey.
1.OpenGoogleChromeandgotochromemenu

2.ChooseExtensionsfromtheleftpane.

andchoose"Settings".

3.AtExtensionswindowenable(check)theDeveloperModeoption.

4.NotetheIDdisplayedundertheextensionthatyouwanttoremoveandleavethechrome
extensionswindowopen.

Preventtheunwantedextensiontobeinstalled(loaded)automaticallyfrom
Windowsregistry.
*Notice:SomeextensionsthathavebeeninstalledbyEnterprisepolicydontputadditional
entriesinWindowsregistry.So,followthissteponlyasaprecaution.
5.OpenRegistryEditor.
TodothatopentheRuncommand*andinthesearch(run)box,typeregeditandpress
Enter.
*HowtoopentheRuncommand:
WindowsXP:
ClickontheStartbuttonandchooseRun.

Windows7,Vista
ClickontheStartbuttonandclickonthesearchbox.

Windows8:
RightclickonthebottomleftcornerandselectRun.

6.InsideRegistryEditor,clickonEditmenuandchooseFind.


7.IntheFindWhatbox,type:ExtensionInstallForcelist

8.NowlookattherightpaneonExtensionInstallForcelistkeyfoundanddeleteanyvalue
thatitsDatavaluematchestheExtensionIDfoundfromChromeExtensionswindow.

9.PresstheF3buttononyourkeyboardtofindthenextExtensionInstallForcelistkeyon
yourregistryandrepeatthesameprocedure(deletetheextravaluesontherightpane).*
*Note:InaWindowsXPbasedcomputertheExtensionInstallForcelistkeyisfound3
(three)timesintheselocationsintheregistry:
1.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GroupPolicyObjects\
{9A8EC6CBDD834E3E9829
71ED9CEAC021}Machine\Software\Policies\Google\Chrome\ExtensionInstallForcelist
2.HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
3.HKEY_USERS\S1521606747145746137067854245398
1003\Software\Microsoft\Windows\CurrentVersion\GroupPolicyObjects\{9A8EC6CBDD83
4E3E9829
71ED9CEAC021}Machine\Software\Policies\Google\Chrome\ExtensionInstallForcelist
10.Repeatthissteptofindanddeleteallregistrykeysforanyotherextensionthatishas
installedbyenterprisepolicyinChrome.(e.g.YouTubeAdBlocker,MediaPlayer,etc.)
11.CloseRegistryEditor.

Step3.Locate&DeleteMaliciousFolder(s)usedinChromePolicies.
1.OpenGoogleChromeandattheURLAddressBartype:chrome://policy&pressEnter.

2.AtPolicieswindowpresstheShowValuebutton.*
*Note:Ifyoucannotfindanypoliciesherecontinuetothenextstep.

3.NowCopythepathofthemaliciousfolderextension.
e.g.C:/ProgramData/dgoiddfiaigjfjblblmidmpgokkegkld

4.OpenWindowsExplorerandPastethecopiedpathintheaddressbar.

5.PressEntertonavigatetothatpath:

6.Clickwithyourmouseattheparentfolder:e.g.C:\ProgramData

7.Finallydeletethemaliciousfolder(e.g.dgoiddfiaigjfjblblmidmpgokkegkld)fromthere.

8.RepeatthisstepforanyotherpolicyvaluefoundinChromePoliciesandthencontinuetothe
nextstep.

Step4:DeleteRegistry.Polfile.
Notice:Youmustenablethehiddenfilesviewtoperformthistask.Todothat,goto:
1.Start>ControlPanel>FolderOptions.Clickthe"View"tab.
2.Click"Showhiddenfiles,folders,anddrives"&
3.Uncheckthe"Hideprotectedoperatingsystemfiles"
4.Press"OK"
HowtoEnableHiddenfilesViewinWindows7
HowtoEnableHiddenfilesViewinWindows8

1.OpenWindowsExplorer&navigatetothefollowingpath:
C:\Windows\System32\GroupPolicy

2.InC:\Windows\System32\GroupPolicyfolderyouwillfindthetwo(2)followingfolders:
1.Machine

2.User

3.Openbothfolders(Machine&User)anddeleteanyfilenamedRegistry.polinthem.

Step5.DeleteChromeExtensionsInstalledbyEnterprisePolicywithCCleaner.
1.DownloadandrunCCleaner.
2.AtCCleanermainwindow,choose"Tools"ontheleftpane.

3.In"Tools"section,choose"Startup".

4.Choosethe"Chrometab.

5.RightclickattheunwantedextensioninthelistandchooseOpenContainingFolder

6.Notethefoldernamewheretheunwantedextensionisrunningfrom:

7.PresstheUpbuttontonavigatetotheparentfolder.
C:\DocumentsandSettings\<USERNAME>\LocalSettings\ApplicationData\Google\Chrome\User
Data\Default\Extensions

Windows8,7&VistaUsers:Clickattheparentfolder:
C:\Users\\<USERNAME>\AppData\Local\Google\Chrome\UserData\Default\Extensions\

8.Deletetheunwantedfolder.

9.ThenatCCleanerselectanddeletetheunwantedextensionfromthelist.

10.FinallylookatScheduledTaskstabanddeletefromthereanyunwantedorsuspicious
entryfound.*
*Personally,IprefertodeletefromScheduledTasksanytask(entry)thatexecutesany
applicationfromtheusersDownloadsfolderorfromtheC:\Users\
<USERNAME>\AppData\folder.
e.g.
YesTaskAmiUpdXpAmonetizLtd
C:\Users\Admin\AppData\Local\SwvUpdater\Updater.exe
YesTaskFacebookUpdateTaskUserS1521227340880918967619001418304126
1000CoreFacebookInc.
C:\Users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe/c/nocrashserver
YesTaskFacebookUpdateTaskUserS1521227340880918967619001418304126
1000UAFacebookInc.

C:\Users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe/ua/installsource
scheduler
YesTask{338F2208C86843CC9A3979727B6B23E2}MicrosoftCorporation
C:\Windows\system32\pcalua.exea"C:\Users\Admin\Downloads\psetup(1).exe"d
C:\Users\Admin\Downloads
YesTask{474AEF970C094D258135CDA13E8C1338}MicrosoftCorporation
C:\Windows\system32\pcalua.exea
"C:\Users\Admin\Downloads\Shockwave_Installer_Slim(9).exe"d
C:\Users\Admin\Downloads
YesTask{C05DDE9DC14041E5B35F33181D34FAFA}MicrosoftCorporation
C:\Windows\system32\pcalua.exeaC:\Users\Admin\Downloads\WindowsPhone.exed
C:\Users\Admin\Downloads

11.CloseCCleaner.

Step6:CleanremainingAdwareusingAdwCleaner.
1.DownloadandsaveAdwCleanerutilitytoyourdesktop.

2.CloseallopenprogramsandDoubleClicktoopenAdwCleanerfromyourdesktop.
3.PressScan.

4.Whenthescaniscompleted,pressCleantoremovealltheunwantedmaliciousentries.

4.PressOKatAdwCleanerInformationandpressOKagaintorestartyour
computer.

5.Whenyourcomputerrestarts,close"AdwCleaner"information(readme)windowand
continuetothenextstep.

Step7.Removepotentiallyunwantedprograms(PUPs)withJunkwareRemoval
Tool.
1.DownloadandrunJRTJunkwareRemovalTool.

2.PressanykeytostartscanningyourcomputerwithJRTJunkwareRemovalTool.

3.BepatientuntilJRTscansandcleansyoursystem.

4.CloseJRTlogfileandandthenrebootyourcomputer.

Step8.Cleanyourcomputerfromremainingmaliciousthreats.
DownloadandinstalloneofthemostreliableFREEantimalwareprogramstodaytocleanyour
computerfromremainingmaliciousthreats.Ifyouwanttostayconstantlyprotectedfrom
malwarethreats,existingandfutureones,werecommendthatyouinstallMalwarebytesAnti
MalwarePRO:
MalwarebytesProtection
RemovesSpyware,Adware&Malware.
StartYourFreeDownloadNow!
1.Run"MalwarebytesAntiMalware"andallowtheprogramtoupdatetoit'slatestversion
andmaliciousdatabaseifneeded.
2.Whenthe"MalwarebytesAntiMalware"mainwindowappearsonyourscreen,choosethe
"Performquickscan"optionandthenpress"Scan"buttonandlettheprogramscanyour
systemforthreats.

3.Whenthescanningiscompleted,pressOKtoclosetheinformationmessageandthenpress
the"Showresults"buttontoviewandremovethemaliciousthreatsfound.

4.Atthe"ShowResults"windowcheckusingyourmouse'sleftbuttonalltheinfected
objectsandthenchoosethe"RemoveSelected"optionandlettheprogramremovethe
selectedthreats.

5.Whentheremovalofinfectedobjectsprocessiscomplete,"Restartyoursystemtoremove
allactivethreatsproperly"

6.Continuetothenextstep.

Advice:Toensureyourcomputeriscleanandsafe,performaFULLSCANwith
MalwarebytesAntiMalwareinWindowsSafemode.*
*TogetintoWindowsSafemode,presstheF8keyasyourcomputerisbootingup,beforethe
appearanceoftheWindowslogo.WhentheWindowsAdvancedOptionsMenuappearson
yourscreen,useyourkeyboardarrowskeystomovetotheSafeModeoptionandthenpress
ENTER.

Step9.Cleanunwantedfilesandentries.
UseCCleanerprogramandproceedtocleanyoursystemfromtemporaryinternetfilesand
invalidregistryentries.*
*IfyoudontknowhowtoinstallanduseCCleaner,readtheseinstructions.

Step10.Restartyourcomputerforchangestotakeeffectandperformafull
scanwithyourantivirusprogram.
Ifyouwanttostayconstantlyprotectedfrommalwarethreats,existingandfutureones,we
recommendthatyouinstallMalwarebytesAntiMalwarePRObyclickingbelow(wedoearna
commisionfromsalesgeneratedfromthislink,butatnoadditionalcosttoyou.Wehave
experiencewiththissoftwareandwerecommenditbecauseitishelpfulanduseful):
FullhouseholdPCProtectionProtectupto3PCswithNEWMalwarebytesAntiMalwarePremium!

Ifthisarticlewasusefulforyou,pleaseconsidersupportingusbymakingadonation.Even$1
canamakeahugedifferenceforusinourefforttocontinuetohelpotherswhilekeeping
thissitefree:

HowtoFixWindows8ActivationError
0x8007007bor0x8007232b

LeaveaReply

YourName*

Howtoremoveduplicateemails&
contactsinOutlook

YourEmail*
PostComment

About Contact PrivacyPolicy Termsofservice Malware Tutorials

wintips.orgWindowsTips&Howtos2016
Logodesign:abimation.eu

ByKonstantinosTsoukalas