Instant Savings App

Seagasm · 06 Jan 2014

I did a search of the registry for ExtensionInstallForcelist and found nothing relating to this.

Slartybart · 06 Jan 2014

In Regedit navigate to:
HKEY_Local_Machine\Software\Policies\Google\Chrome

and post a screen shot.

You noted in this post that it is indeed a managed extension, so it should be there.

Jacee pointed you towards a soltution in this post which described finding the extension ID, could you search the registry for the ID you found?

Seagasm · 07 Jan 2014

I did a search on both HKEY_Local_Machine\Software\Policies\ and there is no Google\Chrome. I also previously searched the registry for the ID number with no results. Now bear in mind I have removed Chrome as previously advised, but what the hell, I will reinstall it and see what happens!!! Standby.

Win7user305 · 07 Jan 2014

Yea, its not through the registry. The closest I got to is the files in Google Chrome extension folder. There is a folder in the extensions folder with the id. I deleted it to restart chrome and whoa and behold its back there again with a new ID number.

I downloaded Malwarebytes the best adware removal program available and it still couldn't catch it

This guy is pretty good with his adware virus. Its a new one because I searched on google about this exact issue and its only been going on for the last couple of weeks. I think the best thing to do is report it to an adware removal company to have them find a fix. I'll let malwarebytes know tomorrow when I have the time.

Seagasm · 07 Jan 2014

OK, I have reinstalled Chrome, I have not signed in, went to settings/extentions and the Instant Savings App is there, along with Google Docs. Clicked on the Developer mode and found the ID: gpccbgnnmhlpdilognneiahbojndgchh, closed Chrome, ran Regedit and searched for the ID but not found, rebooted computer. That is as far as I have got.

Slartybart · 07 Jan 2014

Maybe it's just a semantics thing, but are you searching the registry or opening each key?

I'm looking for
expand HKEY_Local_Machine
expand the subkey Software
expand the subkey Policies
expand the subkey Google
expand the subkey Chrome

Why? Becasue I have fat fingers and make a few typos.

Do you still get "This extension is managed and cannot be removed or disabled."?

UsernameIssues · 07 Jan 2014

Seagasm said:

I did a search on both HKEY_Local_Machine\Software\Policies\ and there is no Google\Chrome. I also previously searched the registry for the ID number with no results. Now bear in mind I have removed Chrome as previously advised, but what the hell, I will reinstall it and see what happens!!! Standby.

Just to make sure that we are on the same page...
...please download the full chrome installer from here:
Download Google Chrome 31.0.1650.63 - FileHippo.com

We have three members in this thread now with the same version of the Instant Savings App (version 1.0). Can anyone tell us what this app might have come bundled with?

When this extension comes back, does the Instant Savings App also appear in Window 7's list of Programs and Features?

Are any of you familiar with using Process Monitor? It should be able to tell you how the extension is getting back in.

edit:
There is nothing to install:
Download the zipped (compressed) file
Open the zipped (compressed) file (folder)
Copy the files somewhere
Run the exe
Agree to the EULA

When it starts for the first time, it automatically starts gathering data. Just let it keep doing that while you install Chrome. Once Chrome completes its install, check that the problem extension is present. If it is there, you can now stop Process Monitor's data gathering:

Stop it by pressing on this button:

In the stopped mode, there should be a red X thru that magnifying glass:

Go to Chrome > Settings > Extensions
Place a check by the Developer mode option.
Highlight and copy the extension ID letters to the Windows clipboard.

Go to Process Monitor.
Set up a filter for that ID as shown in this video:

Best viewed at 720p and in the full screen mode.

The video shows me using Procmon64.exe. You don't need to worry about that. When you start Procmon.exe on a 64bit OS, it extracts Procmon64.exe and runs that. I use Process Monitor so often, that I grabbed a copy of Procmon64.exe from my user temp folder and I start it directly.

Win7user305 · 07 Jan 2014

Its not in the registry I searched the whole thing for the ID Number no luck. The only thing I was able to find was the hidden folder in your user directory (not in regedit).

1- Turn on hidden folders/files
2- search for chrome in your user directory.
3- Its in the extension folder inside chrome. There you will see a bunch of other folders each starting with an ID number with all the files in it. Problem is when you delete that folder and restart chrome the thing is back with a new ID number.

So basically, getting rid of the ID number is not the problem. Its what is behind that gives the ID Number. There should be an executable somewhere that is effected by this and behind it all.

Win7user305 · 07 Jan 2014

Usernameissues,

I'm not that technical on windows and not too familiar with process monitor but I think you are on the right track to get this thing gone. Its got to be an executable doing all this imho.

Its not in the list of programs in windows 7 as far as add remove programs goes. Its a malicious virus for adware and God knows what else.

I'm currently on my mac that doesn't have this problem I will get back about it when I get on my windows machine later.

UsernameIssues · 07 Jan 2014

Win7user305 said:

Its not in the registry I searched the whole thing for the ID Number no luck. The only thing I was able to find was the hidden folder in your user directory (not in regedit).

1- Turn on hidden folders/files
2- search for chrome in your user directory.
3- Its in the extension folder inside chrome. There you will see a bunch of other folders each starting with an ID number with all the files in it. Problem is when you delete that folder and restart chrome the thing is back with a new ID number.

So basically, getting rid of the ID number is not the problem. Its what is behind that gives the ID Number. There should be an executable somewhere that is effected by this and behind it all.

...and Process Monitor should be able to show you exactly what app is putting it back.

You can modify the steps in my post to filter on
AppData\Local\Google\Chrome\User Data\Default\Extensions
just paste that in instead of the ID letters shown in the video.