How to Remove “Installed by enterprise policy” Extension from Chrome

“Installed by enterprise policy” Extension Removal

How to get rid of "Installed by Enterprise Policy" Extension

How to remove the “Installed by Enterprise Policy” Extension

What is an Extension Installed by Enterprise Policy

When you experience numerous ads or pop-ups showing under Chrome, there might be a malicious extension installed. You can always check the extension`s list in Chrome and look for suspicious ones. Usually such extensions are being installed by the “Installed by enterprise policy” text. This basically means that the user will be unable to uninstall or remove the extension from the list as it is being protected. The enterprise policy was created in order to help the developers. Although, many cyber criminals are using this policy to force install a malicious extension in Google Chrome. Since the enterprise policy prevents the extensions to be removed or disabled through Chrome’s Extensions page, the following process of removing becomes quite of a challenge.

Generally, users that have such extensions installed on their systems might see different pop-ups, banners, search suggestions, sponsored link advertisements displayed on popular pages. You might also see a little button referring you to similar products. The search results can also be altered, displaying information loaded with spam and third-party advertising.

Extension Installed by enterprise policy is usually bundled with other free software products and is being installed by default, when the user accepts the EULA, while performing an express/recommended installation of that software. The possible distribution of those extension varies, but is not limited to – installing third-party toolbars, free software products, downloading e-mail attachments, clicking on ads or banners etc..

If a user tries to remove such malicious extension from the list, one will receive a message like or similar to: “This extension is managed and cannot be removed or disabled“.

Removal Process:

There are two ways to remove these extensions. It is totally up to you to decide which way you want to go:

1. Automatic Removal Method (recommended for regular or novice users) using a Professional Malware Removal Software.

2. Manual Removal (recommended for PC Experts or Enthusiasts).

Automatic Malicious Extension Removal:

We recommend using SpyHunter Malware Security Suite.

You can download and install SpyHunter to detect the “Installed by Enterprice policy” Extension and remove it, by clicking the button below. Once installed, SpyHunter will automatically scan and detect all threats present on your system, but in order to use it as a removal tool, you need to purchase a subscription.

SpyHunter will automatically scan and detect all threats present on your system.

Learn more about SpyHunter (EULA). You can find Install Instructions here: (LINK) SpyHunter`s free diagnosis offers free scans and detection. You can remove the detected files, processes and registry entries manually, by yourself, or to purchase the full version to perform an automatic removal and also to receive free professional help for any malware related queries by their technical support department.

Manual Malicious Extension Removal:

!!! Please note: You can remove the extension manually. However, you should proceed at your own risk. Any of these interventions might render your system inoperable. Therefore this manual removal method is highly recommended for PC Experts or Enthusiasts. For regular users, MalwareKillers.com recommends using SpyHunter or any other reputable security application.

1. Remove a Malicious Extension through Control Panel:

First, you can try to go to Control panel and click on Programs and Features (Windows Vista/7/8/10) or Add/Remove Programs (Windows XP) and check the Uninstall Programs` List for any entry related to BlockUTTubbeAda Extension/YTBlockerApp Extension, BLoCkTheAdApp Extension, Deals Plugin Extension, TUbeItAdBlockApp Extension, BlockUTubeAde Extension, BloCKUTubeAd Extension, GetSavin Extension, DealPly, SupTab, DefaultTab, Youtube Downloader HD, Video Media Player 1.1, Fast Free Converter, DVDX Player 3.2, MixiDJ, Delta Toolbar, BrowserProtect, FLV Playeror any third-party add-ons, extensions and toolbars. If you find such, double-click on it and try to remove it. Although, please mind that this is an actual infection and you might not be able to remove it directly from the list.

*(Start -> Control Panel -> Programs and Features or Add/Remove Programs) or “Win + R” keys to open “Run” and type in “control”, then hit enter.

2. Remove a Malicious Extension from your browser:

Internet Explorer:

Go to Tools -> Internet options -> Advanced Tab and click the Reset button (make sure to select the Delete Personal Settings checkbox).

*please note that in order to save your favorites, you need to export them before resetting the browser as you will lose all personal settings.

After IE completes the operation, click the close button and then close IE in order for the changes to take effect.

Google Chrome:

Go to the following path (you can copy-paste it) and delete the entire folder “Chrome” with all the folders and files that are in it.

For Windows XP: %USERPROFILE%\Local Settings\Application Data\Google\

For Windows Vista/7/8/10: %USERPROFILE%\AppData\Local\Google\

Alternatively, you can navigate to these folders by following these steps:

For Windows XP:

1. Click on “Start” in the lower left portion of the screen.

2. Choose “Run”. 3. Type %USERPROFILE%\Local Settings\Application Data\Google\   and hit Enter.

For Windows Vista/7/8/10:

1. Click on the Windows logo in the lower left portion of the screen.

2. Type %USERPROFILE%\AppData\Local\Google\   and hit Enter

Mozilla Firefox:

1. At the top of the Firefox window (upper-left corner), click the Firefox button, go over to the Help sub-menu and select Troubleshooting Information.

2. Click the Reset Firefox button in the top-right corner of the Troubleshooting Information page.

3. To continue, click Reset Firefox in the confirmation window that opens.

4. Firefox will close and be reset. When it’s done, a window will list the information that was imported. Click Finish and Firefox will reopen.

3. Exclusive!!! Remove a Malicious Extension from Chrome using “the search and destroy” approach:

1. Take a note of the ID of the extension you wish to remove from Chrome`s extension list. After that, make sure to close Chrome.

2. Open Windows Explorer and select the Show hidden files option from Folder options or Folders and Drives.

3. Navigate to C:\Users\{Your Username}\ Appdata\Local\Google\Chrome\User Data\Default\Extensions.

4. Delete the folder that matches the ID of the extension.

If the above does not help, please proceed below:

5. The problem might occur because of policy modification in:

C:\Windows\System32\GroupPolicy\User

and/or

C:\Windows\System32\GroupPolicy\Machine

as well as their subsequent folders. Please search for any .pol files and use notepad to open them. Make sure to delete any .pol files that include the extension`s ID found in Google Chrome’s Settings -> Extensions -> Check Developer Mode or contain the string “ExtensionInstallForceList”.

6. Please locate the following registry key and remove extension`s associated values:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Google\Chrome\ExtensionInstallForcelist

You may find the malicious extension ID listed there as well as the actual file location (for example C:\programdata\[extensionID]). Remove the extension`s file directory and the value in the registry.

* It might be necessary to uninstall and then re-install Chrome.

**Another approach finding such malicous extensions would be to search your C:\Users\[Username]\Appdata subdirectories for *.crx files.

4. Delete any Folders or Files Related to the Malicious Extension by checking the following locations:

%ProgramFiles%

%AppData%

%ProgramData%

%LocalAppData%

Finally you should be able to get rid of the extension “Installed by enterprise policy”

Leave a Reply

BOT Check: * Time limit is exhausted. Please reload CAPTCHA.