Malicious Chrome extension is next to impossible to manually remove
<i>and renaming the folder where extensions are stored—none of them worked.</i><p>Then where is it actually installed? Unless it&#x27;s doing something really rootkit-y (unlikely given that AFAIK Chrome&#x27;s extensions are just JS), monitoring file accesses would probably be sufficient to determine where it is and how to remove it. Unfortunately, I think this researcher just didn&#x27;t really try hard enough...<p><i>Removing the extension proved so difficult that he ultimately advised users to run the free version of Malwarebytes and let it automatically remove the add-on.</i><p>...of course, what better than to sneak in an advert for their product!<p><i>As Malwarebytes explained in late 2016, the forced install trick uses JavaScript to provide a dialog box that says visitors must install the extension before they can leave the page. Clicking cancel or closing the tab produces an unending series of variations on that message.</i><p>IMHO this is a sign that JS running on a page has been given too much power (and the reason I only let JS run on a whitelist.)<p>The other thing I find slightly off is that there&#x27;s been plenty of mention of how Chrome&#x27;s extension API is nowhere near as powerful as what the old Firefox extensions could do, and it&#x27;s a more walled garden, yet things like this are still reported.