Jump to content
Due to inclement weather in Southwest Florida, our Clearwater support team is offline. Our other offices are available to assist you, however their responses may be delayed. We appreciate your patience and understanding during this time. ×

Google chrome keeps disabling some of my extensions


JY232
 Share

Recommended Posts

Google chrome keeps disabling some of my extensions, and I have to reinstall them almost everyday. Google FAQ says is possible that my computer is infected, so I tried to scan to see if there's any.

I have Malwarebytes installed and the scan didn't find anything malicious. However, when I run adwcleaner it found two potential items. They are registry value (Svchost netsvcs "WpSvc" & Svchost netsvcs "HpSvc"

Could they be malware in disguise? They still pop up in the scan after I quarantined them.

I've attached my log file.

Thank you for your advice.

 

mbst-grab-results.zip

Link to post
Share on other sites

Hello :welcome:    

Please let me know what name you prefer to go by.

My name is Maurice.   I will guide you.

>

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

>

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.

 

Let me know the result of this.    This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

Link to post
Share on other sites

At some good appropriate moment, do do a Windows RESTART.   This Windows session has been on for several days.

System has been up for:    2 days 6 hours 3 minutes 7 seconds

It is a good practice to do a daily Restart.    ( meaning a fresh Windows start  on each work-day )

Link to post
Share on other sites

Hello, Jason. Thank you. The Safety Scanner found & removed 1 trojan on the Desktop.

would suggest that you do this next scan. This is a known respected tool. It will scan for viruses as well as for potentially unwanted applications.   ( P U A  or  P U P ).

I would suggest a free scan with the ESET Online Scanner.  This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

  • Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

  • When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
  • Click The blue Save scan log to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

Press Continue when all done. You should click to off the offer for “periodic scanning”.

Please make sure you attach the log report.     

Link to post
Share on other sites

Hello Maurice,

 

Here's the scan result.

Also, Chrome seems to have stopped disabling of my extensions in the past couple of days. However, I've experienced random crashes of the Chrome browser, and after it crashes, some new random extensions are installed onto my chrome when I restart the browser.

 

Thank you

eset scan.txt

Link to post
Share on other sites

Thank you for the ESET report. These next steps are some housekeeping, as well as a custom script run. I have spotted where Chrome is mentioned as a "application restart" when Windows is started ( we will get that removed).

1st the housekeeping. We want to have the Microsoft Defender to be able to be on as a real-time antivirus monitor.

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows  Premium  😃.

Close Malwarebytes.

>

[  2  ]

We will use FRSTENGLISH.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  JY232  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows  DISM to check the system integruty. 

NOTE-2:  It will remove a refernce to Application Restart #1 as a Runonce to auto-start a chromium.exe ( which is likely to be at the source of the Chrome mis-behavior.).

It will attempt to have Microsoft Defender antivirus to be the real-time antivirus monitor, which typical settings, and to get its definitions updated.

It will clear the cache for Chrome and Edge browsers.

  •  
  • Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

  • If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
  • Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder

Fixlist.txt

 

Then, Start the Windows Explorer and then, go  to the Downloads   folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

You will see a green progress bar start. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

Link to post
Share on other sites

Your are welcome.  and Thank You. This run is good.  and the Windows System File Checker did make some corrections. The Microsoft Defender antivirus appears in good state & shape.

The Google Chrome cache was emptied.  How is the situation at this time as related to Chrome browser ?

Link to post
Share on other sites

Hello Maurice,

 

I restarted the computer, and there's no random extension installed when I ran Chrome.

However, after using the computer for a while, Chrome crashed suddenly and there's weird extension installed. Those randomly installed extensions were not in English. . Please see the attached.

 

1514497114_WeChatScreenshot_20211228092110.thumb.png.1110bbe25f1f66bbc1c6e873c4fc1a68.png

 

Link to post
Share on other sites

Good morning. Allow me to ask some basics about Chrome browser. Why does this one have so many profiles ? Are there several different users at your home ? This Chrome has the standard default profile + Guest profile + Profile 1 + Profile 2 + System Profile.

I would recommend you use only 1 profile.  Remove the others.  That is a first basic step.

As to weirdness on this Chrome extensions.  There is a range of things you may consider.

Switch to using Edge or some other web browser.

Resetting Chrome to its standard default along with having no extension  & later on just only installing the known trusted extensions.

https://support.google.com/chrome/answer/3296214

Link to post
Share on other sites

Hello Maurice,

I've deleted all other profiles. My other family members used my computer once in a while, so there's other profiles.

Switching to Edge clearly doesn't solve the problem because I'm sure my computer it's still infected with some sort of virus. I'm not sure if it's harmless though.

I've tried resetting Chrome, removing all the extension and install only the ones that's trusted and used, yet the problem still persists.

Everday when I wake up this happens. Here's what happen again: I open Chrome, and it tells me Chrome wasn't closed properly ( it crashed while I was sleeping). Then, there's a list of Chinese websites added to my bookmark tabs below the url bar. The default search engine is changed to a Chinese search engine (I always have Google as default engine). And, the two extensions is installed again without my permission. 

Thank you again for all the help. I know I'm properly asking too much here. 

Link to post
Share on other sites

You mention you suspect "a infection". I had you scan with ESET Online scanner, plus, also the Microsoft Safety Scanner antivirus..  What security scan apps have you run to check the system ?

As to Chrome browser, Chrome can be the very hardest to cleanup. To that end, of getting Chrome back to normal, follow all the tips on this post by AdvancedSetup

Resetting Google Chrome to clear unexpected issues
https://forums.malwarebytes.com/topic/258938-resetting-google-chrome-to-clear-unexpected-issues/

Let me know after that has been completed.   Later on, I will guide you to running a fresh report with Farbar FRST report tool.

.

For the EDGE browser search engine preference See Change your default search engine in Microsoft Edge

 

Edited by Maurice Naggar
Link to post
Share on other sites

  • 1 month later...
  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.