![\"chrome\/edge](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/edge-rogue-extension-apps-1.jpg\")
<\/p>\nOf late, many users are facing a problem where a rogue browser extension named “Apps” appears in Chrome or Edge. Also, the user is unable to remove the extension. Attempting to remove the extension via the registry or deleting the extension folder doesn’t help, as the extension is automatically installed whenever the user opens\u00a0 Edge or Chrome.<\/p>\n
<\/p>\n
(You may also see the Managed by your organization<\/a> notice in Chrome and Microsoft Edge.)<\/em><\/p>\n The extension ID for the rogue extension may be one of the following:<\/p>\n And the extension shows up as “Apps” in Edge\/Chrome. A note that reads “This extension is not from any known source, and may have been added without your knowledge.” appears at the bottom of the extension. The option to delete the extension is missing.<\/p>\n The above extension is installed by a crypto-malware that adds the ExtensionInstallForcelist<\/strong> and ExtensionInstallAllowlist<\/strong> registry-based policies to allow \/ force install the specific extension silently without user input.\u00a0The files related to the malware extension are stored in one or both of the following locations:<\/p>\n FYI, here’s are the VirusTotal report for this (“macjkjgieeoakdlmmfefgmldohgddpkj”) malware:<\/p>\n To remove the Edge\/Chrome Apps extension, try the following:<\/p>\n Download Malwarebytes Antimalware from https:\/\/www.malwarebytes.com\/ and run a full scan.<\/p>\n The tasks Malwarebytes should have cleaned up the rogue tasks and the dropped malware files. Anyway, it’s a good idea to do the cleanup manually (in addition). Follow these steps:<\/p>\n Open the admin Command Prompt<\/a> and execute these commands one by one.<\/p>\n Tip:<\/strong> You may also save all those commands in a Batch file and run the Batch file as administrator.<\/em><\/p>\n The above commands should remove the rogue extension.<\/p>\n If the problem persists, do the following:<\/p>\n Download Farbar Recovery Scan Tool<\/a> (FRST64.exe) from BleepingComputer.<\/p>\n\n
Cause<\/h2>\n
%LocalAppData%\\MicroApp\\\r\n\r\n%LocalAppData%\\ServiceApp\\\r\n\r\nC:\\apps-helper\\\r\n\r\nC:\\app.crx\r\n<\/pre>\n
\n
Resolution<\/h2>\n
Step 1: Run Malwarebytes<\/h3>\n
MSEdgeUpdate<\/code> (and\/or ChromeUpdate<\/code>) you see in the screenshot are rogue tasks. Eliminate all malware it finds.<\/p>\n![\"chrome\/edge](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/edge-rogue-extension-apps-malwarebytes.png\")
<\/p>\n
\nStep 2: Cleanup the tasks, registry settings, and the extension folder<\/h3>\n
schtasks.exe \/delete \/tn \"\\MSEdgeUpdate\" \/f\r\nschtasks.exe \/delete \/tn \"\\ChromeUpdate\" \/f\r\nrd \/s \/q \"%LocalAppData%\\Microsoft\\Edge\\User Data\\Default\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj\"\r\nrd \/s \/q \"%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj\"\r\nrd \/s \/q \"%LocalAppData%\\Microsoft\\Edge\\User Data\\Default\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo\"\r\nrd \/s \/q \"%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo\"\r\nrd \/s \/q \"%LocalAppData%\\Microsoft\\Edge\\User Data\\Default\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde\"\r\nrd \/s \/q \"%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde\"\r\nrd \/s \/q \"%LocalAppData%\\Microsoft\\Edge\\User Data\\Default\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj\"\r\nrd \/s \/q \"%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj\"\r\nrd \/s \/q \"%LocalAppData%\\MicroApp\"\r\nrd \/s \/q \"%LocalAppData%\\ServiceApp\"\r\nrd \/s \/q \"c:\\apps-helper\"\r\ndel c:\\apps.crx \/a\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Edge\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj \/f\r\nreg delete HKLM\\SOFTWARE\\Microsoft\\Edge\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj \/f\r\nreg delete HKLM\\SOFTWARE\\Google\\Chrome\\Extensions\\macjkjgieeoakdlmmfefgmldohgddpkj \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Edge\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo \/f\r\nreg delete HKLM\\SOFTWARE\\Microsoft\\Edge\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo \/f\r\nreg delete HKLM\\SOFTWARE\\Google\\Chrome\\Extensions\\iglfjaeojcakllgbfalclepdncgidelo \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Edge\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde \/f\r\nreg delete HKLM\\SOFTWARE\\Microsoft\\Edge\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde \/f\r\nreg delete HKLM\\SOFTWARE\\Google\\Chrome\\Extensions\\adakfdcjddkdjolfgopncdandijkdlde \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Edge\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj \/f\r\nreg delete HKLM\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj \/f\r\nreg delete HKLM\\SOFTWARE\\Microsoft\\Edge\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj \/f\r\nreg delete HKLM\\SOFTWARE\\Google\\Chrome\\Extensions\\pejhfhcoekcajgokallhmklcjkkeemgj \/f\r\nreg delete HKCU\\SOFTWARE\\WOW6432Node\\Policies\\Microsoft\\Edge \/f\r\nreg delete HKLM\\SOFTWARE\\WOW6432Node\\Policies\\Microsoft\\Edge \/f\r\nreg delete HKCU\\SOFTWARE\\WOW6432Node\\Policies\\Google\\Chrome \/f\r\nreg delete HKLM\\SOFTWARE\\WOW6432Node\\Policies\\Google\\Chrome \/f\r\nreg delete HKCU\\SOFTWARE\\Policies\\Microsoft\\Edge \/f\r\nreg delete HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge \/f\r\nreg delete HKCU\\SOFTWARE\\Policies\\Google\\Chrome \/f\r\nreg delete HKLM\\SOFTWARE\\Policies\\Google\\Chrome \/f\r\n<\/pre>\n
![\"chrome\/edge](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/edge-rogue-extension-apps-removed.jpg\")
<\/p>\n
\nStep 3: Run the Farbar scanner.<\/h3>\n
![\"Farbar](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/frst-dashboard.png\")
<\/li>\n