3

For the past one month, there seems to have a stealth installer lingering in my computer that will automatically install malicious plugins to all my browsers. I'm not sure what installer is that and I can never seem to trace them too.

The plugins will show up in names that appear "useful", like Media Player, Video Player, BetterSurf, all sort of crap names. I've uninstalled their browser plugins numerous times, but a few days later, the stealth installer will install another one to my browsers in another name, say Media Player 2 or something.

enter image description here

So recently, after I have been disabling and removing the plugins in the browsers, they have heightened their "security". Now I cannot even uninstall or disable the plugins because, at least in Chrome, it says that the plugin is "installed by enterprise policy".

enter image description here

The most annoying part is it will throw up pop-up advertisements and embed advertisements on webpages:

enter image description here

It does not affect only Chrome, but all my other browsers including IE and Firefox.

enter image description here

I scanned my computer and AVG did find those installers. I removed all of them, but they are not really being removed. A few days later, they all came back again only in different names.

What the heck is this, and how did this come into my computer? Now, how can I remove it permanently, for real?

I'm running on Windows 7.

5
  • 1
    Did you try scanning your system with AdwCleaner?
    – and31415
    Jan 30 '14 at 10:35
  • Install trial version of some good protection suite and scan PC. I never quite trusted AVG myself. You can try Kaspersky if you ask my opinion. Feb 5 '14 at 0:24
  • Any more questions, or do you want to set something as solution? May 10 '18 at 8:28
  • @davidbaumann None of the answers so far really resolves my question yet. I'm a little hesitant to mark any answers as the solution just for the sake of doing so. I will mark one as solution as better answers come along.
    – xenon
    May 10 '18 at 10:05
3

If your system once has been compromised, there is no way to trust it before completely wiping it.
Also you should change passwords (PayPal, eBay...).

6
  • This is the right answer. You do have good backups, right...?
    – user55325
    Jan 30 '14 at 5:12
  • 1
    Nuke it from space, its the only way to be sure.
    – MDT Guy
    Jan 30 '14 at 5:17
  • So there is no way I can remove that, other than to format my computer?
    – xenon
    Jan 30 '14 at 5:39
  • 1
    Maybe there are ways to remove, but, will it give you the peace of mind and you know for sure it is gone and you can sleep at night peacefully? Really the easiest, and most 'peace of mind' is to format, and reinstall. - Backup all your data first tho.
    – Darius
    Jan 30 '14 at 5:44
  • 1
    Do you really nuke the system for every malware? There are far less severe measures that one ought to try before going for nuke.. Feb 5 '14 at 0:26
0

I struggled with the same problem.

I found the force extension under the following registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
0

Boot the system with linux and delete alle the files that you can find related to those installers.

Not the answer you're looking for? Browse other questions tagged or ask your own question.