Good point but no I do not have that task. Interesting note though, the image above shows a trash can, the one I have does not and I cannot disable the Enable tick.
Good point but no I do not have that task. Interesting note though, the image above shows a trash can, the one I have does not and I cannot disable the Enable tick.
No trashcan is to be expected with a managed extension. Maybe version 1.0 installed the extension as a managed one or maybe some crapware bundled the extension & changed the normal install. But I doubt that you care why/how it is managed - you just want it gone
I'll see if I can locate version 1.0 and study it. If you stumble across a copy, let me know.
I would use Process Monitor to find how the extension is coming back, but please do not try that just yet. I don't want you to change anything on your system while Jacee is working with you. You should only follow one removal path at a time. I posted just to ask questions - not to suggest a course of action - yet
Hello Jaycee, in reply to the post #25, I do not have anything relating to Solid Savings but went through the motions suggested and instead, looking for something relating to instantsavingsapp. Steps 1, 2, & 3 I carried out without finding anything. I also carried out a search of the registry for the ID number relating to the App with nothing found.
I then searched the appdata folder of my username and found the ID number which was the name of the folder and in the folders quoted in the reply. I thought I was on a winner but no. In the end, I uninstalled Chrome, I went through everywhere I thought of which google/chrome on my computer and deleted all the folders relating to either/and google and/or chrome. I also found a google file in Homegroupuser/appdata/local/google and removed that google folder as well.
I used CCleaner and cleaned the registry and program caches recycle bin, the works. I then used adwCleaner but it could not find anything and as you know, the system then reboots. So, I have not reinstalled Chrome yet until perhaps someone comes up with a suggestion. WOW
Norton 360 couldn't even find it. I tried a lot of things. No luck. Seagasm speaks the truth. Disabling or deleting the extension is disabled with full details pasted below:
Instant Savings App 1.0
Instant Savings App shows you the latest deals and discounts while you surf the web! Permissions Visit website
ID: ckdjndgfgjaglgcnllemofeepjeeaofa
(This extension is managed and cannot be removed or disabled.)
Inspect views: background.html
I think its a new virus that is somehow stopping chrome from disabling the extension. The key is to find out how to bypass the block that is in chrome then remove it.
Special Note: The Enforcement is not in the Registry I searched all over regedit.
InstantSavingsApp is an add-on for Internet Explorer, Firefox and Chrome that is typically added when you install other free programs. When you install these free programs, they will also install Instant Savings App as well. Some of the programs that are known to bundle Instant Savings App include 1ClickDownload, Yontoo and FBPhotoZoom.
Once installed, whenever you will browse Expedia, Best Buy, Facebook or any other similar websites, Instant Savings App will show in the right top part of your browser, a box containing related keyword suggestions,ads and sponsored links.
InstantSavingsApp is an add-on for Internet Explorer, Firefox and Chrome that is typically added when you install other free programs. When you install these free programs, they will also install Instant Savings App as well. Some of the programs that are known to bundle Instant Savings App include 1ClickDownload, Yontoo and FBPhotoZoom.
Once installed, whenever you will browse Expedia, Best Buy, Facebook or any other similar websites, Instant Savings App will show in the right top part of your browser, a box containing related keyword suggestions,ads and sponsored links.
Thank you Jacee, yes, I have checked the other two browsers I use, Safari and FireFox. I have ad blocker extensions active in both. Nothing relating to Instant Savings App.
I did a search on both HKEY_Local_Machine\Software\Policies\ and there is no Google\Chrome. I also previously searched the registry for the ID number with no results. Now bear in mind I have removed Chrome as previously advised, but what the hell, I will reinstall it and see what happens!!! Standby.
Yea, its not through the registry. The closest I got to is the files in Google Chrome extension folder. There is a folder in the extensions folder with the id. I deleted it to restart chrome and whoa and behold its back there again with a new ID number.
I downloaded Malwarebytes the best adware removal program available and it still couldn't catch it
This guy is pretty good with his adware virus. Its a new one because I searched on google about this exact issue and its only been going on for the last couple of weeks. I think the best thing to do is report it to an adware removal company to have them find a fix. I'll let malwarebytes know tomorrow when I have the time.
OK, I have reinstalled Chrome, I have not signed in, went to settings/extentions and the Instant Savings App is there, along with Google Docs. Clicked on the Developer mode and found the ID: gpccbgnnmhlpdilognneiahbojndgchh, closed Chrome, ran Regedit and searched for the ID but not found, rebooted computer. That is as far as I have got.
I did a search on both HKEY_Local_Machine\Software\Policies\ and there is no Google\Chrome. I also previously searched the registry for the ID number with no results. Now bear in mind I have removed Chrome as previously advised, but what the hell, I will reinstall it and see what happens!!! Standby.
We have three members in this thread now with the same version of the Instant Savings App (version 1.0). Can anyone tell us what this app might have come bundled with?
When this extension comes back, does the Instant Savings App also appear in Window 7's list of Programs and Features?
Are any of you familiar with using Process Monitor? It should be able to tell you how the extension is getting back in.
edit:
There is nothing to install:
Download the zipped (compressed) file
Open the zipped (compressed) file (folder)
Copy the files somewhere
Run the exe
Agree to the EULA
When it starts for the first time, it automatically starts gathering data. Just let it keep doing that while you install Chrome. Once Chrome completes its install, check that the problem extension is present. If it is there, you can now stop Process Monitor's data gathering:
Stop it by pressing on this button:
In the stopped mode, there should be a red X thru that magnifying glass:
Go to Chrome > Settings > Extensions
Place a check by the Developer mode option.
Highlight and copy the extension ID letters to the Windows clipboard.
Go to Process Monitor.
Set up a filter for that ID as shown in this video:
Best viewed at 720p and in the full screen mode.
The video shows me using Procmon64.exe. You don't need to worry about that. When you start Procmon.exe on a 64bit OS, it extracts Procmon64.exe and runs that. I use Process Monitor so often, that I grabbed a copy of Procmon64.exe from my user temp folder and I start it directly.
Its not in the registry I searched the whole thing for the ID Number no luck. The only thing I was able to find was the hidden folder in your user directory (not in regedit).
1- Turn on hidden folders/files
2- search for chrome in your user directory.
3- Its in the extension folder inside chrome. There you will see a bunch of other folders each starting with an ID number with all the files in it. Problem is when you delete that folder and restart chrome the thing is back with a new ID number.
So basically, getting rid of the ID number is not the problem. Its what is behind that gives the ID Number. There should be an executable somewhere that is effected by this and behind it all.
I'm not that technical on windows and not too familiar with process monitor but I think you are on the right track to get this thing gone. Its got to be an executable doing all this imho.
Its not in the list of programs in windows 7 as far as add remove programs goes. Its a malicious virus for adware and God knows what else.
I'm currently on my mac that doesn't have this problem I will get back about it when I get on my windows machine later.
Its not in the registry I searched the whole thing for the ID Number no luck. The only thing I was able to find was the hidden folder in your user directory (not in regedit).
1- Turn on hidden folders/files
2- search for chrome in your user directory.
3- Its in the extension folder inside chrome. There you will see a bunch of other folders each starting with an ID number with all the files in it. Problem is when you delete that folder and restart chrome the thing is back with a new ID number.
So basically, getting rid of the ID number is not the problem. Its what is behind that gives the ID Number. There should be an executable somewhere that is effected by this and behind it all.
...and Process Monitor should be able to show you exactly what app is putting it back.
You can modify the steps in my post to filter on AppData\Local\Google\Chrome\User Data\Default\Extensions
just paste that in instead of the ID letters shown in the video.
