phaZed
Well-Known Member
- Reaction score
- 3,149
- Location
- Richmond, VA
I'm hoping this helps some others to save some time if they run into the "Media Player 1.1" Browser extension, specifically in Google Chrome. This browser extension displays large full screen, half screen, and quarter screen ads for all sorts of vendors (including pornography). The extension also performs random redirects and seems to be sensitive to the context of your intended destination (eg. Going to Teamviewer.com would result in being redirected to a "fake" remote support software site to presumably install more malware). It also injects "keyword links" throughout your pages that pop-up an ad when hovered over.
- This extension employs the power of a GPO to re-install the plugin even after a full removal of the extension as well as chrome; a NEW fresh installation of Chrome still results in the installation of the Plugin and its effects.
Media Player 1.1 is installed using multiple methods such as:
1. Listed and installed as "Media Player" in Add/Remove Programs
2. Listed and installed as Other Programs that are vague and without a publisher
3. Extensions installed in IE, Firefox and Chrome
The extension, for me, was easy to remove in Internet Explorer and Firefox, however, Chrome was a different story. The extension lists "This extension is managed and cannot be removed or disabled." and "Intalled by enterprise policy" and is not able to be removed via Chrome. The plugin was listed only by "Avast! Browser Cleanup" which listed it as a malcontent - AdwCleaner, MBAM, and SAS failed to list/find it.
Worst of all, uninstalling chrome and reinstalling does not fix the issue, it immediately returns on the next start of chrome.
The problem lies in C:\Windows\System32\GroupPolicy\User and C:\Windows\System32\GroupPolicy\Machine and it's subfolders - look for any .pol files and use a text editor to look at them. Delete any .pol files that reference the extension unique identifier found in Google Chrome's Settings->Extensions-> Check Developer Mode or contain the string "ExtensionInstallForceList"
These .pol files were causing the constant re-install of the extension, that's it!
- This extension employs the power of a GPO to re-install the plugin even after a full removal of the extension as well as chrome; a NEW fresh installation of Chrome still results in the installation of the Plugin and its effects.
Media Player 1.1 is installed using multiple methods such as:
1. Listed and installed as "Media Player" in Add/Remove Programs
2. Listed and installed as Other Programs that are vague and without a publisher
3. Extensions installed in IE, Firefox and Chrome
The extension, for me, was easy to remove in Internet Explorer and Firefox, however, Chrome was a different story. The extension lists "This extension is managed and cannot be removed or disabled." and "Intalled by enterprise policy" and is not able to be removed via Chrome. The plugin was listed only by "Avast! Browser Cleanup" which listed it as a malcontent - AdwCleaner, MBAM, and SAS failed to list/find it.
Worst of all, uninstalling chrome and reinstalling does not fix the issue, it immediately returns on the next start of chrome.
The problem lies in C:\Windows\System32\GroupPolicy\User and C:\Windows\System32\GroupPolicy\Machine and it's subfolders - look for any .pol files and use a text editor to look at them. Delete any .pol files that reference the extension unique identifier found in Google Chrome's Settings->Extensions-> Check Developer Mode or contain the string "ExtensionInstallForceList"
These .pol files were causing the constant re-install of the extension, that's it!
