This thread was archived. Please ask a new question if you need help.
How do I remove an extension that keeps reinstalling itself?
Last week, I downloaded Mumble, a voice chat program. I was playing World of Warcraft at the time, and needed to download Mumble on the fly, so I was insufficiently careful and downloaded an extension, Websteroids, at the same time. Websteroids highlights words in text documents which, when scrolled over, lead to advertisements. The claim of the Websteroids website is that it turns a webpage into a meteoroids game.
I have repeatedly disabled and removed it from my extensions list, uninstalled and reinstalled Firefox, deleted files with the Websteroids name on it, uninstalled it and Mumble, and any other files/programs that I could find from that date. I've run my antivirus program (AVG), spybot s&d, and lavasoft ad aware and followed the advice from their scans. Nevertheless, Websteriods keeps reinstalling itself without warning. I have restarted Mozilla in safe mode and I've also deleted anything I could find from the publisher, Creative Island Media, LLC. The next step that I can think of is a system restore. Before I do that, is there any other less drastic step that might work?
Hi kg-227, unless Firefox is itself infected, uninstalling/reinstalling shouldn't make a difference.
There are cases in which third party software is dropped into the Firefox program folder and doesn't get cleaned out automatically. This is by design so you don't lose plugins, but could be exploited. To address that situation, you can rename the Firefox folder and then reinstall.
Download the installer for your preferred language from this page:
After exiting Firefox, rename the program folder to something like OldFox.
On 64-bit Windows, it's:
C:\Program Files (x86)\Mozilla Firefox
On 32-bit Windows, it's:
C:\Program Files\Mozilla Firefox
Then run the installer. It should find your existing personal data automatically.Read this answer in context 👍 1
All Replies (14)
Renaming the folder OldFox and reinstalling firefox seems to have done the trick. I will wait a few hours, to see if websteriods comes back. If not, I will mark my problem as solved together on jscher200's post. Thank you.
Hi mikewills, if it does turn out to defeat the thing, could you do a directory compare between the OldFox and Mozilla Firefox folders to see what's different?
There might be a built-in way to do that in Windows, but I generally use a free program from http://winmerge.org/ (you can run it without restarting Windows, but I think it only appears on the right-click menu after a restart).
Edit: changed doesn't to does. Duh.
Modified by jscher2000
We should also remember that an app may get installed by another. For example, Yontoo plugin keeps reinstalling a lot of junk apps such as Find22, Babylon bar, a Yontoo plugin itself... It is probably also used by Websteroids people. I have checked Control Panel for the list of installed programs and voilà: Yontoo was there! I had no problem in uninstalling it. But, well, I will check the Web for potential risks of its reinstalling itself.
I just got this virus today and it's easy to remove if you know what to do Go to uninstall a program on your computer
once there Uninstall 2 programs 1 called "Websteroids" and the other called "Updater"
Then go to "C:\ProgramData" and delete a folder called "updater"
If you are on a 64-bit OS go to "C:\Program Files (x86)\Mozilla Firefox" and look for any files there with the name "Websteroids" in them and delete them
For 32-bit OS go to "C:\Program Files\Mozilla Firefox" and look for any files there with the name "Websteroids" in them and delete them
Then just to be safe go to computer and use the search bar there to search for "Websteroids" and "Websteroids"
All this must be done in a set time frame so the program can't re-download it self Sorry but I don't know the time frame but I did all this in 15 minutes which a long time
Chek Updater.exe in your programdata folder and delete it.
Just delete Anything realated to Creative Iseland media llc, programs such a Updater.exe or Dimmer tube or Scorpion which usualy sitting in firefox adds-on/extentions. Your PC will speed up. Sorry for my russian english. ))
you cant delete the updater.exe when its still running, what you need to do is:
1. open the msconfig, on the startup tab, uncheck any updater and websteroids you can find, then restart the PC.
2.now you can uninstall updater and websteroids, if its still there, just go to progammData and delete both folder.
Modified by Nobody23
Hi, Im new to this support group thing, I downloaded Skype and a whole bunch of stuff got installed as well, Websteroids being one of them, Im using Windows Vista and Firefox (latest vesrion) and as has been said Ive done multiple things listed above, such as disabling/removing the addon, uninstalled the programs on installed on 12/4/2013 (day Skype was installed), but I cant find ANYTHING related to websteroids in my program files and yet it still keeps appearing in my Toolbars, and keeps showing its ugly little face everytime I open Firefox. And now when I run a completely unrelated program (a game for example) it slows down CONSIDERABLY.
Im tempted to take an axe to this computer and use the warrenty to get a new one. Id rather not. Please help.
Hi Crimsion, there are lots of suggestions by different posters in this thread. If you go through both pages, hopefully you will find the right solution to clear it out completely.
It wouldn't hurt to run some supplemental security scans. This support article lists programs that have helped other Firefox users: Troubleshoot Firefox issues caused by malware.
I've just done what Nobody23 suggested and it seems to have done the trick. Thanks!!
I got this same problem by downloading a pattern that I paid for!! It seized up my computer but I saw in one of these forums that someone suggested trying malwarebytes.com It is a "bug" program that seeks out this stuff. I tried the free scan and it found 30 bugs. I bought it for 28 bucks,installed it,ran it and finally after deleting all the bugs,that websteroids is running is gone and the icon too. I had uninstalled it 3 times before,but this worked. I was so happy. I am not a computer whiz, so I was thrilled that I could get this resolved. THank you whoever the person is that suggested it.
Removal is easy actually, first do this:
Then use AdwCleaner and Malwarebytes.
Hello, I did video guide how to remove websteroids add-on manually https://www.youtube.com/watch?v=m_HI9AzGKCo&feature=c4-overview&list=UUgz4a6NA3G5M5QkUOSwZpYQ Additional info about registry keys and folders is in description to the video. I hope it will be helpful for somebody.
Modified by PCFixHelp
A lot of these "fixes" do not work. It is too simple. The "sick author" from the program writers (authors) is a bit too clever to allow this uninstall process. In fact there is an uninstall program that comes as part of the trojan. You run this and get taken to a web page that laughs in your face.
The core program that is running this program is call updater.exe.
Hit CTRL, ALT, DEL and have a look at the running processes. You will find a program called updater.exe running in C:\Programdata\. Not Skype updater.exe. This trojan will "stick", normal updaters carry out their process for a few minutes and then drop out of the task processes.
Even if you delete this process and the associated program and folder it will come back because it is buried in the registry (the good old Microsoft registry!! - when will they change this, it's so old, 1980's..... We are in the 21st century for goodness sake!) and will keep running/restart every time you reboot.
One of the most aggressive anti virus programs available, AVG, cannot find it and disable it, so what can actually a $20-30 anti malware program do? Not much.
I spent several hours on a clients computer working out how this trojan had buried itself and finally worked out the traces. Well for this client and his particular PC that is.
There is no real easy fix. You can delete the Websteroid files you find and the folders they are in but they will just keep coming back. You can remove it from the task manager, extensions in Firefox, Internet Explorer and Chrome, Start Up (if it's there). You can "uninstall" it from the programs, but that does not stop it. If it's running as a service this will also come back too, even if you stop it and set the service to manual.
By all means do all this, the removals that is, but BEFORE you re-boot your PC, thinking you are home and dry, run the registry editor (regedit.exe) - but BE CAREFUL - and search for all instances of "updater.exe" (without the quotes).
You will find 3 or 4 registry keys, or maybe more, in or, listing, the folder, normally, C:\program data\
These need deleting, one by one, until you get the end of the registry. It may take some time.....
NOTE: This search will also find entries for updaters for probably Skype, Adobe and some other PC Branded updaters. You are looking for the file in C:\program data\.
Once these keys are deleted (it's your risk, no liability from me) hopefully you will be rid of it.
However BEWARE. When authors of these rubbish trojans see posts like these they then find another way of amending the installation of their, lets face it, virus.
The REAL golden rule is to be extremely aware of what you are doing and/or downloading from the internet to avoid childish programs like this ending up being installed on your PC.
After the registry keys have been deleted make sure you delete the folder itself on the PC, also do a PC wide search for websteroids and delete any files you find.
Hope you fare well.....
Best of luck