Removing invisible extension “happysale” in google chrome

Question

The extension "happysale" is showing ads by "gifton" in Google Chrome and Mozilla Firefox, and I seem to be unable to remove it.

When I go to extensions in Chrome I can't see it, but when i go to the task manager in Chrome it's there, tagged as extension and I can manually shut it down, but that get's annoying over time.

I've checked the chrome-folder: "C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\Extensions", but it's empty except for an empty .json file.
I have also checked the registry, but I can't find it there either. Neither MalwareBytes nor my antivirus Mcafee find anything either. I have also resorted to using Malwarebytes anti-rootkit, but that also didn't give me anything.

I am at a loss as to what to do next.

Here is a copy of what stands in chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --extensions-on-chrome-urls --test-type --load-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\app" --load-component-extension="c:\Program Files\Google\Chrome\Application\Extensions\chrome\man" --flag-switches-begin --flag-switches-end

But in the directory Chrome\Application\Extensions is no folder for "chrome", and therefore no file/folder called "man".

Answer 1

This invisible extension could be loaded via a command-line argument. To confirm that this indeed the case, visit chrome://version and look at the line with label "Command Line:".

The "Command Line" SHOULD have the following pattern:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --flag-switches-begin --flag-switches-end

If you have ever visited chrome://flags, then there may be some extra flags between --flag-switches-begin and --flag-switches-end. These flags are usually innocent.

I think that some malware has changed your Google Chrome shortcut, to include additional flags that load the invisible extension. This change will show up at the Command Line at chrome://version:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --[name of flag not shown]=path\to\happysale-adware --flag-switches-begin --flag-switches-end

^{(I've intentionally hidden the actual flag name to prevent abuse by malware writers who come across this answer.)}

To resolve your problem, edit your Chrome shortcut:

1. Right-click on the Google Chrome icon.
2. Choose properties.
3. Click on the Shortcut tab.
4. Edit the Target textfield, and delete every flag, so it ends with chrome.exe, e.g. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe".

Answer 2

[SOLVED] None of them worked for me. Though what worked was a strategic maneuver with the mouse.

Follow these steps to find the Extension which is actually hidden in the chrome extensions page:
1. open the URL [chrome://extensions/]
2. Disable the topmost extension on this page(click on the checkox right beside Enable).
3. The moment you disable the topmost extension you'll see a hidden extension of "happysale"(in my case) flash once and gets hidden again.

4. Most important step, now all you have to do is get a mouse and try enabling/disabling the topmost extension until you get a clear idea of where the Delete icon for the target extension is.
5. Now just lock your target and shoot the Delete icon as soon as you disable the topmost visible extension. You need to be extremely fast and and a good FPS player to get it right in one go. You might even need to repeat it a few times to get it right.
6. If that seemed impossible for you, you can download "Auto Mouse Clicker v4.0" and create an script for automatic clicks to delete the adware in an easier way. It takes a while to learn how to set automatic clicks, but it's worth it, I took like 10 min to make a perfect move.
You have to set the position of the automatic clicks, so the first one will be on "enable/disable" and the second one will be on "delete". Set the delay of the clicks for 11 miliseconds. After that, save the file and create a keyboard shortcut to start the clicks

It's a rat chase, thats all it is.

Answer 3

You should probably take a look at this article about finding and removing malware extensions. It uses Process Explorer to find the process that's causing trouble and remove it manually.

Answer 4

You need to install an extension on chrome called Shield for Chrome.

Once installed, run it, and it will spot happysale and offer that you uninstall it.

Uninstall, shutdown and restart your machine. You should be good to go.