I wanted to point out how to fix the problem. This issue is Chrome's fault.
The fact that the Ask.com toolbar is locked down is not malware magic - it's documented behavior of Google Chrome. While other solutions might work piecemeal for certain specific malware, the underlying fix is to remove them from Chrome.
Google created a Group Policy for Chrome that allows IT administrators to force install of an extension:
ExtensionInstallForcelist
Configure the list of force-installed apps and extensions
Data type: List of strings
Windows registry location: Software\Policies\Chromium\ExtensionInstallForcelist
Mac/Linux preference name: ExtensionInstallForcelist
Supported on:
- Chromium (Linux, Mac, Windows) since version 9
- Chromium OS (Chromium OS) since version 11
Supported features:
Dynamic Policy Refresh: Yes, Per Profile: Yes
Description:
Specifies a list of apps and extensions that are installed silently, without user interaction, and which cannot be uninstalled by the user. All permissions requested by the apps/extensions are granted implicitly, without user interaction, including any additional permissions requested by future versions of the app/extension. Furthermore, permissions are granted for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These two APIs are not available to apps/extensions that are not force-installed.)
This policy takes precedence over a potentially conflicting ExtensionsInstallBlacklist policy. If an app or extension that previously had been force-installed is removed from this list, it is automatically uninstalled by Chromium.
For Windows instances that are not joined to an Active Directory domain, forced installation is limited to apps and extensions listed in the Chrome Web Store.
Note that the source code of any extension may be altered by users via Developer Tools (potentially rendering the extension dysfunctional). If this is a concern, the DeveloperToolsDisabled policy should be set.
Each list item of the policy is a string that contains an extension ID and an "update" URL separated by a semicolon (;). The extension ID is the 32-letter string found e.g. on chrome://extensions when in developer mode. The "update" URL should point to an Update Manifest XML document as described at https://developer.chrome.com/extensions/autoupdate. Note that the "update" URL set in this policy is only used for the initial installation; subsequent updates of the extension employ the update URL indicated in the extension's manifest.
For example, gbchcmhmhahfdphkhkmpfmihenigjmpp;https://clients2.google.com/service/update2/crx installs the Chrome Remote Desktop app from the standard Chrome Web Store "update" URL. For more information about hosting extensions, see: https://developer.chrome.com/extensions/hosting.
If this policy is left not set, no apps or extensions are installed automatically and the user can uninstall any app or extension in Chromium.
This policy should not exist. The browser belongs to the user - it is not IT's playground to install things.
Any extension installed using this group policy is malware. In order to remove it you need to delete the ExtensionInstallForecelist registry key from:
HKEY_LOCAL_MACHINE/Software/Policies/Google/Chrome/ExtensionInstallForcelist
Once the entire list of forced extensions has been deleted, it is time to prevent anyone from pushing any group policy into Chrome. You do this by denying everyone access to write to the Chrome policy node.
Navigate to the HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome
node in RegEdit, right-click, and select Permissions:
Click Add, enter Everyone as the trustee to add, and click OK:
Select the Everyone trustee, and click Advanced. Select the Everyone trustee, and click Edit:
From there you want to Deny:
- Set value: deny
- Create subkey: Deny
and click OK all the way up.
Now Oracle can no longer force the Ask.com toolbar.
The above steps will work for any forced extension; no matter which company installed it.