4

The extension "happysale" is showing ads by "gifton" in Google Chrome and Mozilla Firefox, and I seem to be unable to remove it.

When I go to extensions in Chrome I can't see it, but when i go to the task manager in Chrome it's there, tagged as extension and I can manually shut it down, but that get's annoying over time.

I've checked the chrome-folder: "C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\Extensions", but it's empty except for an empty .json file.
I have also checked the registry, but I can't find it there either. Neither MalwareBytes nor my antivirus Mcafee find anything either. I have also resorted to using Malwarebytes anti-rootkit, but that also didn't give me anything.

I am at a loss as to what to do next.

Here is a copy of what stands in chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --extensions-on-chrome-urls --test-type --load-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\app" --load-component-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\man" --flag-switches-begin --flag-switches-end

But in the directory Chrome\Application\Extensions is no folder for "chrome", and therefore no file/folder called "man".

  • Might seem overly-obvious, but have you tried removing it via "Programs and Features"? All the info I can find indicate that it installs and removes separately and visibly. – Debra Dec 21 '14 at 15:10
  • That was one of the first things I did, but there is no program or feature listed that has any connection to either "happysale" or "gifton". Just checked again, but nothing there. – ElectricIcecream Dec 21 '14 at 15:19
  • Did you contact support at www.happysale.com? Search the drive for gifton instead? – Debra Dec 21 '14 at 15:23
  • Just sent a mail to support, waiting for an answer now. And yes, the first thing I searched the drive for was in fact "gifton", then "happysale". – ElectricIcecream Dec 21 '14 at 15:36
2

This invisible extension could be loaded via a command-line argument. To confirm that this indeed the case, visit chrome://version and look at the line with label "Command Line:".

The "Command Line" SHOULD have the following pattern:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --flag-switches-begin --flag-switches-end

If you have ever visited chrome://flags, then there may be some extra flags between --flag-switches-begin and --flag-switches-end. These flags are usually innocent.

I think that some malware has changed your Google Chrome shortcut, to include additional flags that load the invisible extension. This change will show up at the Command Line at chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --[name of flag not shown]=path\to\happysale-adware --flag-switches-begin --flag-switches-end

(I've intentionally hidden the actual flag name to prevent abuse by malware writers who come across this answer.)

To resolve your problem, edit your Chrome shortcut:

  1. Right-click on the Google Chrome icon.
  2. Choose properties.
  3. Click on the Shortcut tab.
  4. Edit the Target textfield, and delete every flag, so it ends with chrome.exe, e.g. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe".
  • I do have modified flags, but my target is just the chrome.exe, nothing odd to be soon in shortcut properties. So how to fix flags? – jiggunjer Jun 19 '15 at 8:30
  • @jiggunjer Double-check all shortcuts, environment variables and chrome://flags. – Rob W Jun 19 '15 at 8:37
  • Only have one shortcut on taskbar. Environment is clean too. chrome://flags is untouched. Why does chrome://version tell me about those flags... – jiggunjer Jun 19 '15 at 11:14
  • @jiggunjer If your shortcuts are fine, visit chrome://version, look for your profile directory at "Profile Path" (go to the parent directory, so not ...\User Data\Default but ...\User Data), and search for the unwanted flag to see if it shows up in any of the preference files. – Rob W Jun 20 '15 at 18:13
1

[SOLVED] None of them worked for me. Though what worked was a strategic maneuver with the mouse.

Follow these steps to find the Extension which is actually hidden in the chrome extensions page:
1. open the URL [chrome://extensions/]
2. Disable the topmost extension on this page(click on the checkox right beside Enable).
3. The moment you disable the topmost extension you'll see a hidden extension of "happysale"(in my case) flash once and gets hidden again.
Happysale Hidden Extension
4. Most important step, now all you have to do is get a mouse and try enabling/disabling the topmost extension until you get a clear idea of where the Delete icon for the target extension is.
5. Now just lock your target and shoot the Delete icon as soon as you disable the topmost visible extension. You need to be extremely fast and and a good FPS player to get it right in one go. You might even need to repeat it a few times to get it right.
6. If that seemed impossible for you, you can download "Auto Mouse Clicker v4.0" and create an script for automatic clicks to delete the adware in an easier way. It takes a while to learn how to set automatic clicks, but it's worth it, I took like 10 min to make a perfect move.
You have to set the position of the automatic clicks, so the first one will be on "enable/disable" and the second one will be on "delete". Set the delay of the clicks for 11 miliseconds. After that, save the file and create a keyboard shortcut to start the clicks

It's a rat chase, thats all it is.

Worked for me!

  • @Rafael thanks for point #6 and the screenshot. – darthpool Jul 28 '15 at 21:26
0

You should probably take a look at this article about finding and removing malware extensions. It uses Process Explorer to find the process that's causing trouble and remove it manually.

0

You need to install an extension on chrome called Shield for Chrome.

Once installed, run it, and it will spot happysale and offer that you uninstall it.

Uninstall, shutdown and restart your machine. You should be good to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.