Of late, many users are facing a problem where a rogue browser extension named “Apps” appears in Chrome or Edge. Also, the user is unable to remove the extension. Attempting to remove the extension via the registry or deleting the extension folder doesn’t help, as the extension is automatically installed whenever the user opens Edge or Chrome.
The extension ID for the rogue extension may be macjkjgieeoakdlmmfefgmldohgddpkj or iglfjaeojcakllgbfalclepdncgidelo, and it shows up as “Apps” in Edge/Chrome. A note that reads “This extension is not from any known source, and may have been added without your knowledge.” appears at the bottom of the extension. The option to delete the extension is missing.
The above extension is installed by a crypto-malware that adds the ExtensionInstallForcelist and ExtensionInstallAllowlist registry-based policies to allow / force install the specific extension silently without user input. The files related to the malware extension are stored in one or both of the following folders:
FYI, here’s are the VirusTotal report for this (“macjkjgieeoakdlmmfefgmldohgddpkj”) malware:
To remove the Edge/Chrome Apps extension, try the following:
Step 1: Run Malwarebytes
Download Malwarebytes Antimalware from https://www.malwarebytes.com/ and run a full scan.
ChromeUpdate) you see in the screenshot are rogue tasks. Eliminate all malware it finds.
Step 2: Cleanup the tasks, registry settings, and the extension folder
Malwarebytes should have cleaned up the rogue tasks and the dropped malware files. Anyway, it’s a good idea to do the cleanup manually (in addition). Follow these steps:
Open the admin Command Prompt and execute these commands one by one.
schtasks.exe /delete /tn "\MSEdgeUpdate" /f schtasks.exe /delete /tn "\ChromeUpdate" /f rd /s /q "%LocalAppData%\Microsoft\Edge\User Data\Default\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj" rd /s /q "%LocalAppData%\Google\Chrome\User Data\Default\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj" rd /s /q "%LocalAppData%\Microsoft\Edge\User Data\Default\Extensions\iglfjaeojcakllgbfalclepdncgidelo" rd /s /q "%LocalAppData%\Google\Chrome\User Data\Default\Extensions\iglfjaeojcakllgbfalclepdncgidelo" rd /s /q "%LocalAppData%\MicroApp" rd /s /q "%LocalAppData%\ServiceApp" reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Edge\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj /f reg delete HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj /f reg delete HKLM\SOFTWARE\Microsoft\Edge\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj /f reg delete HKLM\SOFTWARE\Google\Chrome\Extensions\macjkjgieeoakdlmmfefgmldohgddpkj /f reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Edge\Extensions\iglfjaeojcakllgbfalclepdncgidelo /f reg delete HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\iglfjaeojcakllgbfalclepdncgidelo /f reg delete HKLM\SOFTWARE\Microsoft\Edge\Extensions\iglfjaeojcakllgbfalclepdncgidelo /f reg delete HKLM\SOFTWARE\Google\Chrome\Extensions\iglfjaeojcakllgbfalclepdncgidelo /f reg delete HKCU\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f reg delete HKCU\SOFTWARE\WOW6432Node\Policies\Google\Chrome /f reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome /f reg delete HKCU\SOFTWARE\Policies\Microsoft\Edge /f reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f reg delete HKCU\SOFTWARE\Policies\Google\Chrome /f reg delete HKLM\SOFTWARE\Policies\Google\Chrome /f
Tip: You may also save all those commands in a Batch file and run the Batch file as administrator.
The above commands should remove the rogue extension.
Step 3: Run the Farbar scanner.
If the problem persists, do the following:
Download Farbar Recovery Scan Tool (FRST64.exe) from BleepingComputer.
- Run FRST64.exe and click “Scan”.
- Upload the two logs, FRST.txt and Addition.txt, to your OneDrive and share the link here so that a
FixList.txtcan be prepared.
(FRST64.exe doesn’t remove anything when you click “Scan.” It simply scans all the launch points, services, and drivers and lists them. After seeing the two logs, a FixList.txt need to be created to remove the malware entries.)
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
3 thoughts on “Fix: Unremovable “Apps” Extension in Edge or Chrome”
Actually thank you so much. I was panicking for ###### days when I got this virus downloaded virus total and then ran all the commands and it worked.I am actually so grateful.Thank you
Thanks a bunch! Nothing seemed to be working. I downloaded McAfee and had it run a full scan and detect and remove the virus… and although the effects of the virus appeared gone, the extension still remained. Anyway, your commands worked! In both chrome and Microsoft edge the extension is finally gone!
Thanks a lot! Really, I was desperate I didn’t know how to remove that extension.