Remove “Installed by enterprise policy” extension from Chrome

If you are seeing pop-up ads with Google Chrome, and in your extension list there is an extension with the “Installed by enterprise policy” text, then your browser is infected with an adware program. The “Installed by enterprise policy” was created by Google to help the developers, however cyber criminals are using this type of policy to install malicious extension onto Google Chrome. The reason why they are doing this is that because the “Installed by enterprise policy” extensions are managed and cannot be removed or disabled via Chrome’s Extensions page.
[Image: Installed by enterprise policy extension in Google Chrome]
The “Installed by enterprise policy” extension are usually adware programs that displays pop-up ads, advertisement banners and sponsored links within Google Chrome.
Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed the malicious “Installed by enterprise policy” extension without your knowledge.”

The “Installed by enterprise policy” adware infection is designed specifically to make money. It generates web traffic, collects sales leads for other dubious sites, and will display advertisements and sponsored links within your web browser.
The “Installed by enterprise policy” extension it’s technically not a virus, but it does exhibit plenty of malicious traits, such as rootkit capabilities to hook deep into the operating system, browser hijacking, and in general just interfering with the user experience. The industry generally refers to it as a “PUP,” or potentially unwanted program.

The “Installed by enterprise policy” Chrome extension is typically added when you install another free software (video recording/streaming, download-managers or PDF creators) that had bundled into their installation an adware program. When you install these free programs, they will also install the malicious “Installed by enterprise policy” Chrome extension as well. Some of the programs that are known to bundle the “Installed by enterprise policy” extensions include “Youtube Downloader HD”, “Fast Free Converter”, “Video Media Player 1.1″ and “DVDX Player 3.2″.
When installed, the “Installed by enterprise policy” Chrome extension display pop-up advertisements, in-text ads and and as you browse Internet, it will show coupons and other deals available on different websites.
[Image: Installed by enterprise policy extension malware]
If a Chrome user will try to remove the malicious extension, he will see on the Chrome’s extension page the following message next to the unwanted extension, and underneath there will be a message that will say: “This extension is managed and cannot be removed or disabled“.
Cyber criminals are using the “Installed by enterprise policy” because the malicious extension that are installed with this policy cannot be remove by Chrome users by simply clicking the Trash Can icon.
[Image: Installed by enterprise policy in Google Chrome]
You should always pay attention when installing software because often, a software installer includes optional installs, such as this “Installed by enterprise policy” extension. Be very careful what you agree to install.
Always opt for the custom installation and deselect anything that is not familiar, especially optional software that you never wanted to download and install in the first place. It goes without saying that you should not install software that you don’t trust.

How to remove “Installed by enterprise policy” Chrome extension (Virus Removal Guide)

This page is a comprehensive guide, which will remove “Installed by enterprise policy” extension from Google Chrome, and any other adware program that may have been installed during the the setup process.
Please perform all the steps in the correct order. If you have any questions or doubt at any point, STOP and ask for our assistance.
OPTION 1: Manually remove the “Installed by enterprise policy” extension from your registry and computer
OPTION 2:Restore Windows to an earlier time to remove the “Installed by enterprise policy” from Windows 8, Windows 7, Windows Vista and Windows XP

OPTION 1: Manually remove the “Installed by enterprise policy” extension from your registry and computer

STEP 1: Uninstall the program that has installed the “Installed by enterprise policy” extension on Google Chrome

In this first step, we will try to identify and remove any malicious program that might be installed on your computer.

  1. To uninstall the program that has installed the “Installed by enterprise policy” extension on Google Chrome program, click the Start button, then click on the Control Panel menu option.
    [Image: Control Panel in Windows Start Menu]
    If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for “control panel” .Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control Panel from there.
    [Image: Control Panel in Windows 8]
  2. When the Control Panel window opens click on the Uninstall a program option under Programs category. This option is shown by the arrow in the image below. If you are using the Classic View of the Control Panel, then you would double-click on the Programs and Features icon instead.
    [Image: Uninstall a program]
  3. When the Programs and Features or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and uninstall AlllCheapPeruiCe 5.2, YoubeAdBlocker 1.2, TheBlooccker 1.3, Video Player, Plus-HD 1.3, BetterSurf, CouponMeApp, TubeAdblOCkER, BLoCkTheADApp 3.2, WatchItAdBlocake, Media Player 1.1, Savings Bull, Start Savin, Websteroids, ScorpionSaver, HD-Plus 3.5 and any other recently installed unknown program from your computer.
    To check the most recently installed programs, you can click on the “Installed On” column to sort your program by the installation date. Scroll though the list, and uninstall any unwanted or unknown programs
    [Image: Uninstall the program responsible for the Installed by enterprise policy extension]
    Depending on what program has installed the “Installed by enterprise policy” adware infection, the above program may have a different name or not be installed on your computer. If you cannot find any unwanted or unknown programs on your machine, then you can proceed with the next step.

If you are having issues while trying to uninstall the “Installed by enterprise policy” program, you can use Revo Uninstaller to completely remove this unwanted program from your machine.

STEP 2: Find the name of the “Installed by enterprise policy” malicious extension and write down its ID

  1. Click the Chrome menu Chrome menu  button on the browser toolbar, select Tools and then click on Extensions.
    Google Chrome Extensions
  2. In the Extensions tab, to find the ID of the “Installed by enterprise policy” malicious extension, enable the “Developer mode” by putting a check-mark in its box as seen below.
    Next, you we will need to write down the ID and the name of the “Installed by enterprise policy” malicious extension, then we can close Google Chrome.
    [Image: Installed by enterprise policy Chrome extension ID]
    In our case the malicious extension name is: YoutubeAdBlocker 1.2 and it’s ID is: hfgknhajhghfgnmdbfickicmhnkcce, however in your case the name and ID of the “Installed by enterprise policy” might be different.

STEP 3: Delete the malicious registry key that keeps re-installing the “Installed by enterprise policy” extension in Google Chrome

  1. If you are using Windows 7, Windows Vista or Windows XP, click on the Start button, then in the search box, type: regedit.exe and click on Regedit as seen below.
    If you are using Windows 8, drag your mouse to the right edge of your screen, then type in the the search box: regedit.exe and click on Regedit.
    [Image: Open the Windows Registry Editor]
    Alternatively, you can press the Windows Key + R to open the Run box, then type regedit.exe to open the Windows Registry Editor.
    NOTE: Depending on your version of Windows, and how it’s configured, you may see a User Account Control dialog box where you’ll need to confirm that you want to open Registry Editor.
  2. The Registry Editor window should now open, and we will need to click on Edit and select Find next from the drop down menu.
    [Image: Click on Edit then select Find next]
  3. In the Find next box type the ID of the “Installed by enterprise policy” malicious extension that you have written down in the previous stage, then click on Find next.
    [Image: Type the ID of the malicious extension]
    After the search will be performed, the Registry Editor should show you a registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist as seen below.
    Right-click on the registry key (usually represented by a number), and from the menu select Delete.
    [Image: Remove the Installed by enterprise policy registry key]
  4. A confirmation window should now pop-up and you will need to click on Yes to confirm that you want to delete this malicious registry key.
    [Image: Confirm that you want to delete the malicious registry key]
    Now, we can close the Windows Registry Editor.

STEP 4: Remove the “Installed by enterprise policy” malicious folder from your computer

  1. Open Google Chrome, type in the omnibox (Address Bar) to chrome://policy/, then in the Policies window click on Show Value.
    [Image: Click on  Show value to see the malicious folder]
    As you can see below there’s a path on your computer pointing to an extension update file. It is very important find the folder with the ID of the unwanted extension and delete it. Otherwise, it can reinstall itself.
    [Image: Installed by enterprise policy malicious folder]
    In our case the “Installed by enterprise policy” malicious folder is located in C:/ProgramData/YoutubeAdblocker, however the path may be different in your case.
  2. The Program Data folder is usually hidden, so to see the malicious folder we will need to enable the Show hidden files, folders and drives option.
    To view the hidden files and folders, click on the Start button, and click on Computer. Next ,click Organize and choose Folder and Search Options.
    If you are using Windows 8 from the Control Panel, type “folder” in the search box and select Folder Options.
    Folder and Search Option
    Click the View tab, select Show hidden files, folders and drives, then click on Apply and then OK.
    Show hidden files, folders and drives
  3. Browse to the “Installed by enterprise policy” malicious folder that we’ve previously found with the chrome://policy/ command. In our case is C:/ProgramData/YoutubeAdblocker, however your path may be different.
    After you have found the “Installed by enterprise policy” malicious folder, right click on it, and then select Delete to remove the folder.
    [Image: Delete Installed by enterprise policy malicious folder]
  4. Unwanted extension’s files are stored in Chrome’s default extensions folder as well. You need to delete the directory corresponding to the noted ID.If you are using Windows Vista, Windows 7 or Windows 8, browse to : %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions (e.g C:\Users\Your-Username\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\Extensions). Or if you are using Windows XP, browser to: %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension.
    Then, search the folder which has the ID which of the “Installed by enterprise policy” malicious extension, then right-click on it and select Delete.
    [Image:Remove Installed by enterprise policy malicious extension folder]
    In our case the “Installed by enterprise policy” malicious Chrome extension was hfgknhajhghfgnmdbfickicmhnkcce, however in your case is most likely different.
  5. Finally, we will need to browse to %windir%\system32\GroupPolicy\ (e.g. C:\Windows\system32\GroupPolicy), and from there delete the Machine and User folders.
    [Image: Delete Machine and User folders]

STEP 5: Scan your computer for malware with Malwarebytes Anti-Malware and HitmanPro

Remove “Installed by enterprise policy malicious folder” virus with Malwarebytes Anti-Malware Free

Malwarebytes Anti-Malware Free uses industry-leading technology to detect and remove all traces of malware, including worms, Trojans, rootkits, rogues, dialers, spyware, and more.
It is important to note that Malwarebytes Anti-Malware works well and should run alongside antivirus software without conflicts.

  1. You can download Malwarebytes Anti-Malware Free from the below link, then double click on it to install this program.
    MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
  2. When the installation begins, keep following the prompts in order to continue with the setup process.
    [Image: Malwarebytes Anti-Malware final installation screen]
  3. On the Scanner tab,select Perform quick scan and then click on the Scan button to start scanning your computer.
    [Image: Malwarebytes Anti-Malware Quick Scan]
  4. Malwarebytes’ Anti-Malware will now start scanning your computer for “Installed by enterprise policy” malicious files as shown below.
    [Image: Malwarebytes Anti-Malware scanning for Installed by enterprise policy malicious folder virus
  5. When the Malwarebytes scan will be completed,click on Show Result.
    [Image: Malwarebytes Anti-Malware scan results]
  6. You will now be presented with a screen showing you the malware infections that Malwarebytes’ Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.
    [Image:Malwarebytes removing virus]

Double-check for the “Installed by enterprise policy” infection with HitmanPro

HitmanPro is a second opinion scanner, designed to rescue your computer from malware (viruses, trojans, rootkits, etc.) that have infected your computer despite all the security measures you have taken (such as anti virus software, firewalls, etc.). HitmanPro is designed to work alongside existing security programs without any conflicts. It scans the computer quickly (less than 5 minutes) and does not slow down the computer.

  1. You can download HitmanPro from the below link, then double-click on it to start this program.
    HITMANPRO DOWNLOAD LINK (This link will open a new web page from where you can download HitmanPro)
  2. HitmanPro will start and you’ll need to follow the prompts (by clicking on the Next button) to start a system scan with this program.
    HitmanPro scanner
    HitmanPro installation
  3. HitmanPro will start scanning your computer for “Installed by enterprise policy” malicious files as seen in the image below.
    HitmanPro scan Installed by enterprise policy virus
  4. Once the scan is complete,you’ll see a screen which will display all the infected files that this utility has detected, and you’ll need to click on Next to remove this malicious files.
    HitmanPro scan results
  5. Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer.
    HitmanPro 30 days activation button

OPTION 2: Restore Windows to an earlier time to remove the “Installed by enterprise policy” from Windows 8, Windows 7, Windows Vista and Windows XP

System Restore uses restore points to return your system files and settings to an earlier point in time without affecting personal files. Restore points are created automatically every week, and just before significant system events, such as the installation of a program or device driver. Before you start System Restore, save any open files and close all programs.

Use System Restore to remove the “Installed by enterprise policy” extension from Windows 7, Windows Vista or Windows XP.

  1. To restore Windows 7, Windows Vista or Windows XP to an previous restore point, you can follow the this video:
  2. When the System Restore has completed its task, download Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

Use System Restore to remove the “Installed by enterprise policy” extension from Windows 8

  1. To restore Windows 8 to an previous restore point, you can follow the this video:
  2. When the System Restore has completed its task, download Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

Your computer should now be free of the “Installed by enterprise policy” malicious. If you are still experiencing problems while trying to remove “Installed by enterprise policy” extension from Google Chrome, please start a new thread in our Malware Removal Assistance forum.


If we have managed to help you with your computer issues, then it's your duty to let other people know that this article will help them!
You can share this article on Facebook,Twitter or Google Plus by using the below buttons.


FC Barcelona fan, Starbucks addicted and super geek.
I am the creator and owner of
My area of expertise includes malware removal and computer forensics. I'm active in the various online anti-malware communities where I do researches for new malware threats as they are released.
I live in Bucharest (Romania), where I run my own local computer repair shop.
I repair both hardware and other operating systems related issues, however most of my business is malware related problems.

Follow me on Google Plus

You can follow me on Google Plus, and I will try to keep you informed with the latest computer infections and malware threats!


All our malware removal guides and utilities are completely free of charge.
We do not request any kind of money in exchange for our services, however if you like to support us with our hardware maintenance costs, you can make a small donation. Any amount is appreciated, and will support our fight against malware.
  • Janet


  • Angel

    You are a lifesaver! You have no idea how thankful I am for your help! Thank you so much!

  • Chris


  • BCGardiner

    Thank you, this was exactly what I was looking for, much obliged!

  • Peanut

    Thank you for a fantastic step by step page!

  • MauricioSanabria

    thank you very much my friend, it worked perfectly, greetings from Colombia

  • Amanda

    thank you so much that was driving me crazy, AdBlOcKnWaatch 3.0 is gone and so are the anying pop-ups I can surf free again.

  • Selma

    YOU’RE AN ANGEL! you f*cking saved my life and my computer’s. I salute you all the way from Sweden and I can’t even start to express my gratitude. you rock man, most definitely. THANK YOU SO MUCH!

  • MidnightHowl31227

    Heavens, that was a long process.
    And according to the Malware thing so are a tonne of other things that we’re messing with my laptop.
    Thank you saving the place where I spend most of my life.

  • THANKS!!!!!!

    Brilliant directions, thank you soooo much!!!! I was loosing the will to live – or at least to surf :)

  • Destiny Polk

    Thank you!!! It worked so well. And I’m not that great with computers, nice directions.

  • Marcus

    This has made me complete. I can,t tell you how much this helped

  • Tanya Hehir

    Thank you!!! Your article was the only one that even remotely addressed this issue and walked me though the whole process – I was going crazy with the Google Chrome pop ups!

  • On the verge of tears

    Thank goodness! You’re a lifesaver <3

  • IHateAllTubeNoAds

    None of the extensions in the extensions folder match what I have on Google Chrome. Do you have any way to fix this problem?

    • Stelian Pilici

      Lets try to delete your Chrome profile:
      1. Exit Google Chrome completely.
      2. Enter the keyboard shortcut Windows key +E to open Windows Explorer.
      3. In the Windows Explorer window that appears enter the following in the address bar.
      Windows XP: %USERPROFILE%Local SettingsApplication DataGoogleChromeUser Data
      Windows Vista/ Windows 7/ Windows 8: %LOCALAPPDATA%GoogleChromeUser Data
      4. Locate the folder called “Default” in the directory window that opens and rename it as “Backup default.”
      5. Try opening Google Chrome again. A new “Default” folder is automatically created as you start using the browser.

      If you wish, you can transfer information from your old user profile to your new one. However, this action is not recommended, since a part of your old profile may be corrupt. With that in mind, to transfer your old bookmarks, copy the “Bookmarks.bak” file from the “Backup default” folder to your new “Default” folder. Once moved, rename the file from “Bookmarks.bak” to “Bookmarks” to complete the migration. All other browser data will remain in the “Backup default” folder, but you won’t be able to transfer it to your new profile.

  • Shalise

    Thank you thank you thank you!! I was on the verge of buying a new laptop but I finally removed that extension.

  • ss

    you guys are awesome. thanks for this awesome thing man.

  • Paul

    Thank you so much!

  • Jessica Gonzalez

    Thank you so much I finally got rid of that nasty bug. Looks like it got installed on my computer New years day. I am not sure what it came with though.

  • Bill

    Thanks! I’ m grateful. I got rid of it. Keep on

  • mary

    Thanks!!! I followed several instructions before but couldn´t get rid off this nasty thing. Very clear instructions, easy to follow.

  • Karen

    Thank you!! There was NO registry key and NO installed program I could remove, and even Anti-Malware Bytes (my go-to Swiss army knife) found nothing, so I was out of options. Step 4 was a lifesaver!! I will be happy to donate to keep you in server credits :-)

  • Kubeshni

    You are brilliant, thank you!!!


    YOU ARE THE BEST. I have had a extension called tubeadiblocker for A MONTH!!

  • Finally!

    Thanks a mil! I have been trying to get rid of this in almost two weeks now. Great!

  • Mos

    Thanks for this comprehensive manual. Finally I got rid of it!

  • MallardTDrake

    This is a great article. You directions are thorough and easy to follow. My computer feels clean again. I am bookmarking your site. Thanks.

  • Pal

    Thank you so much :) It worked

  • MsTruthseeker2009 .

    Thank You very much sir I am sooo greatful!!

  • Mike Hunt


  • Parth

    Thanks Admin

  • Hira Fahad

    Thanks a lot to write this absolutely descriptive and effective guide! My problem is resolved :)

  • MrRoyal

    Thank you From France ! :)

  • Adam

    Been looking for something like this for ages!!! You absolute diamond!

  • WoodrowShigeru

    Finally, I got rid of the damn thing! Thanks, sir. That’s a very informative and comprehensive guide.

  • Vadivelan A

    Thank you very much friend…

  • Phil M.

    Absolute LEGEND!!!
    I used step 4. At first it remained, but after about 10 minutes it disappeared….(it took me all of 5 minutes)
    Huge thanks, and I shall donate first thing!

  • Domo5100

    Thanks, But you can remove it by uninstalling the base virus and then re installing chrome

  • Kelsey

    Thanks so much! I’ve been dealing with a bunch of malware issues for a while, and this process fixed everything!

  • Steve

    Thank you, thank you, thank you. I’ve spent days trawling through various unhelpful and often rude forums. You’ve laid out the steps clearly, and while i was initially anxious about downloading anything else, each of these steps worked for me. If at any stage I could not complete a step (possibly because i’d already deleted a file) I simply moved on to the next stage – and i’m finally malware free!!

  • Zohaib

    Thanks Man :)

  • Lastgallifreyn

    OMG Thank you so very much. I’ve spent ages searching for ways to do this and this actually helped me get rid of my mal-ware. Your Amazing :D

  • Charlie Johnson

    Thank you very much for your hardwork and dedication to ensuring I have a proper removal of this stupid ass program!!! You are the best :D

  • Cameron

    You sir, deserve a like over 9000.

  • Ron

    Manual step worked for me. Thanks so much!

  • Matches Malone

    Thank you so much!

  • Stelian Pilici

    Go to HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChromeExtensionInstallForcelist and check there if you can find the malicious registry key.
    If not, then you can move to the next step.

  • Shijin

    thank you very much.. :) life saver

  • Very happy man

    Thanks so much! No more annoying ads for me!

  • Soap

    Thanks dude
    It worked without installing Hitman pro
    Jazakallah khair :D

  • Krish

    I’ve been struggling with adware for sometime. It’s all gone now. Thanks mate!!

  • JonBohrer

    Wow. Don’t know how you do it, but you do and I thank you for that! Donated and shared! Thanks again!

  • Jessie

    At first, right after I did it, the extension was still there, but then it went away. THANK YOU SO MUCH!

  • juan

    Exxcellent, it is out of my computer. Thank you very much!!!

  • Vasco

    You are the best.
    Thanks a lot for this tutorial.

  • Olivia

    After looking ALL OVER, THIS is what helped me. Thank you so much!

  • Sam

    Nevermind, it’s gone now!

  • Sam

    The extension is still there, even after I followed all the steps (besides downloading the malware detector and Hitman). Is that supposed to happen?

  • tameer

    seems it has worked .. thanks so much .. I’ll be back

  • Summer

    Thank you so so much! you really and truly saved my life. I am telling all my friends! And now my father doesn’t think I’m incompetent!

  • Nessa

    Everything worked amazingly. Thank you so much. :)

  • Idoya

    Oh my God!!! Thank you very much!!!

  • Q

    Thank you this was excellent

  • Jen Lamont

    Thank you very much…It worked. There was no HKey_Local_Machine….Google/Chrome folder in step 3, but there was a …Google/Update. I deleted it as you suggested in one of the comments and continued with the rest of the procedure. The PDDF Viewer 1.1 installed by enterprise policy is finally gone!

  • Nirav

    You are just awesome dude.. thank you soo much

  • Lisa McCaffrey

    OMFG I CAN’T THANK YOU ENOUGH! These pop-ups have been driving me insane! Thank you, thank you, thank you! My computer is now fixed. I am very happy

  • Jose Matampale

    Hey, if I restore windows to an earlier time, would it delete any of my existing files (pictures,videos,etc)? Thanks

    • Stelian Pilici

      Your documents will not be affected if you use System Restore. :)

  • kootiekoty

    Hi, I have tried to do Step 3, but when I search for the file in the registry, it doesn’t take me anywhere. I tried searching for the file’s place manually (LOCAL–>SOFTWARE–>POLICIES–>GOOGLE) but there is no Chrome option for Google, only “Update”
    Do you know where this file is? Any help would be appreciated, thank you.

    • Stelian Pilici

      Delete the Update folder and go ahead with the other steps…. In some cases this infection may no install both folders.

  • Smallislander

    Wow ! THanks. Every now & then I think about buying a Windows computer. My Windows friends say ‘no’, and I see why. When will Windows change to a modern, safe, operating system? I admire the ability to use older ‘heritage’ software, but … My Mac, well not perfect, just isn’t as easy to be infected. I’ve had a Mac since 2002 & never this kind of problem, ever. My consolations to everyone who has similar problems. Computer use should be fun!

  • Daniel

    If i restore my system will i loose my anti virus software that i downloaded today?

  • Alex

    You literally saved the day! Thank you so much. I had this thing stuck in my google chrome that was constantly adding these unnecessary searches. Now it’s gone! THANK YOU!

  • Roger

    Thank you Stelian. I am a bit of a rookie at this and up to this point was uncomfortable editing in the registry. Your detailed, clear and thorough walk through gave me the courage to try it. Yes, it worked for me – I was able to remove an installed enterprise policy (DoctoTXT) pesky adware nuisance in Google Chrome on the first try ! I have gladly sent a donation to support your costs. I will recommend you to my friends.

  • Maxy

    I have tried every single one of these steps that apply to Google Chrome or searching the files on my computer and none of them work! The folders in the regedit that I’m supposed to locate don’t exist, and when I click “Find New” and search the ID, the search ends with nothing showing up. I’m going crazy with all these ads! Can anyone help?

    • Stelian Pilici

      Hello Maxy,
      Did you try OPTION 2?
      Also, if your issue it’s not solved by any of these options to start a thread in our Malware Removal Assistance forum..
      It’s free, and our staff should be able to remove this adware (with some advanced tools) fairly easily from your machine.

    • Dottie

      Hi Maxy,
      Try untick the ‘Match whole string only’ before search.

  • windclm

    Thanks dude! Media Player 1.1 busted! xD

  • Kira

    Chrome is almost strangely quiet now :D I was at my wit’s end, thanks so much for this guide!

  • Martin Leal Juarez

    amigo soy de mexico me ayudo esta informacion muchas gracias de verdad me salvaste

  • chill

    Thanks so much for writing this out, it save me $150 from having to take it to a professional,Very easy to understand. Again thank you!

  • marvin

    Hi, Thank you for taking time to write this.

    However I faced a problem whereby under STEP 4 PART 4, google >>> chrome >>> user data, I don’t have a file named user data. Any advice?

    • Stelian Pilici

      That’s ok. Did you remove the Machine folder?
      Is the malicious extension still there?

  • Ryan

    Thank You so much. I almost quit using chrome because of this unremovable extension and with how much time I spend on the internet it would have be a miserable experience.

  • Becky

    Hey! I searched for the media player ID in the registry…nothing came back! What of I do now? Thanks!!!

    • Stelian Pilici

      Go to HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChromeExtensionInstallForcelist and check there if you can find the malicious registry key.
      If not, then you can move to the next step.
      Please be very careful when performing each step as it involves manual action so it’s very easy to overpass something…. :)

      • Steve

        Hi Stelian, i would be very grateful if you could help me.

        I got as far as step 3 part 3, but it did not find a match for me.

        Tried doing what you suggested to becky, but when i got as far as HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogle there was no ChromeExtensionInstallForcelis option, only an “Update” option, the adware was’nt in there.

        Had no luck in there also…
        Is there any other options left for me to try? or should i just send it to the shop for professional help?

        • Stelian Pilici

          Hello Becky,
          A fast solution would be to restore your computer to an earlier time as seen in the below video.

          However, I would strongly recommend that you register on our forums and start a thread in our Malware Removal Assistance forum:
          We offer free support, and our staff should remove this fairly easily with some advanced tools.

          • Steve

            Hi, i did as you suggested and restored the computer to an earlier time.

            The extension is now gone and the pop ups/ads/links have all stopped, so far so good.

            My anti virus identified it as “adware generic_r.hf” and is now not detecting it since the restoration.

            Thanks a million Stelian.

  • Frankline Noah

    You saved my remaining hair follicles and probably a few hours of what precious life I have remaining!

  • Anders

    Waow dude! Thanks! Easy explained guide! :) Thanks a lot from a happy guy in Sweden!

  • Jordan Neufeld

    Thank you very much! I had a problem with Websave and Youtube Adblockers of 3 different versions. I also had Media Player and Video Player malware too. Then, I followed your instructions, and not only did it get rid of the malware, it also got rid of the browser hijakers (i believe thats what they’re called) that I accidentally installed once. Really great tips, and I didn’t need to download anything. Thanks!

  • Jordan

    Thank you very much!