How do I remove an extension that keeps reinstalling itself?
Last week, I downloaded Mumble, a voice chat program. I was playing World of Warcraft at the time, and needed to download Mumble on the fly, so I was insufficiently careful and downloaded an extension, Websteroids, at the same time. Websteroids highlights words in text documents which, when scrolled over, lead to advertisements. The claim of the Websteroids website is that it turns a webpage into a meteoroids game.
I have repeatedly disabled and removed it from my extensions list, uninstalled and reinstalled Firefox, deleted files with the Websteroids name on it, uninstalled it and Mumble, and any other files/programs that I could find from that date. I've run my antivirus program (AVG), spybot s&d, and lavasoft ad aware and followed the advice from their scans. Nevertheless, Websteriods keeps reinstalling itself without warning. I have restarted Mozilla in safe mode and I've also deleted anything I could find from the publisher, Creative Island Media, LLC. The next step that I can think of is a system restore. Before I do that, is there any other less drastic step that might work?
Thank you
Chosen solution
Hi kg-227, unless Firefox is itself infected, uninstalling/reinstalling shouldn't make a difference.
There are cases in which third party software is dropped into the Firefox program folder and doesn't get cleaned out automatically. This is by design so you don't lose plugins, but could be exploited. To address that situation, you can rename the Firefox folder and then reinstall.
Download the installer for your preferred language from this page:
https://www.mozilla.org/en-US/firefox/all/
After exiting Firefox, rename the program folder to something like OldFox.
On 64-bit Windows, it's:
C:\Program Files (x86)\Mozilla Firefox
On 32-bit Windows, it's:
C:\Program Files\Mozilla Firefox
Then run the installer. It should find your existing personal data automatically.
Read this answer in context 👍 1All Replies (20)
The company's website mentions uninstalling from the Control Panel or using a program in its program folder:
- Windows Control Panel: Click Start > Control Panel > Add / Remove Programs > Websteroids
On Windows 8, try Programs or Programs and Features > Uninstall a program
- Windows Program Files: Click Start > Computer > C Drive > Program Files > Websteroids > Uninstall
On 64-bit Windows, I'd also check C:\Program Files (x86)\
Does that help?
Thanks for the suggestions. Unfortunately, I did both of those things.
Modified by mikewills
I didn't read your post very carefully, did I.
If you sort the Uninstall a Program list by install date, does anything else pop up as potentially related?
Yeah, I didn't state it in my original post, but when I was uninstalling Mumble and Websteriods, I also uninstalled all programs from the same date.
Is the extension being dropped into a Firefox folder, either in C:\Program Files (x86)\ or your profile folder?
If you are finding the extension somewhere else, and you are familiar/comfortable with RegEdit.exe, look in these keys for anything related to Websteroids:
- HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions
Two things I'd check at the Windows level:
(1) Startup programs. It sounds as though "something" remains resident. The Autoruns utility is a good tool to examine what is running at startup and disable it if it sounds suspicious.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
(2) Scheduled Tasks. Some malware creates a scheduled task.
I didn't see anything overly suspicious from the Autoruns utility, although I am not sure I understood what it was telling me well enough.
I did find something suspicious on scheduled tasks and removed that. I also realized that I was not seeing hidden files. When I did that, there was an `updater' folder which contained updates and an uninstaller for Websteriods. I ran the uninstaller and then deleted the entire folder.
This may have done the trick. I'll probably have to wait a few hours before I know for sure.
Hi, i came across this forum when trying to solve this problem myself. Websteriods icon still in system tray saying "websteriods is running", only opinion for this is to hide when when hidden, it turns up again. I've removed it from the extensions and all corresponding files deleted from C drive. however the extension still installs again. I've even tried to do a factory reset on my windows 7 but it requires a windows installation disc which i didnt receive with the pc. Dont know what else to try...
Hi kg-227, have you tried to identify it in the Windows Task Manager? On the processes tab, you can add columns, including a description (if available) and path on disk.
To open the Task Manager, either:
- Ctrl+Shift+Esc
- Ctrl+Alt+Del > Start Task Manager
On the Processes tab, you can sort by the process name. Many are gibberish, so it may help to add columns.
View > Select Columns
- Image Path Name
- Command Line
- Description
You can try sorting by path or command line to scan through disk locations. Unfortunately, these fields are sometimes blank. Any luck tracking it down?
Every time I now open firefox, the addon tab tells me that websteroids is disabled due it to being incompatible with the current version of firefox- removing the extension has no discernible effect. This is an improvement of course, but there still seem to be lingering effects of the program.
Hi mikewills, thanks for the update. Could you check the shortcut you use to start Firefox to make sure that the "target" doesn't have any added commands that might be related to this extension?
(Based on Windows 7...)
right-click the shortcut > Properties > Shortcut tab
If Firefox is pinned to the Task Bar, you may need to right-click the task bar button then right-click "Mozilla Firefox" on the lower part of the menu.
The target should be simply the following, with nothing following it, on 64-bit systems:
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Hi, sorry no nothing un-toward in the task manager and also tried your suggestion to mikewillis.
the websteriods icon is still in system tray and keep returning in the extensions on firefox
thanks for your help
Hi kg-227, by any chance did you check the box at the bottom to view processes started by other users? This can double the length of the list.
Another possibility is that it's starting up as a service. I think Autoruns might list those on a separate tab, or you can use the native dialog to look for it:
Start > Run (or search box) > services.msc
I've checked under other users, everything still seems fine, although there is a long list from local service or network service for svchost.exe. not sure if this is at all threatening ...
My internet security found 1 threat which was SPSetupd[1].exe amongst temp internet files. tried the auto runs to no avail
i did search under 'computer' and websteroids folder under program files, a image icon and a file of it is discovered. I deleted these but already done this before and they reappear again
and icon in system tray and re-occurring add on in fire fox still persists...
thank you
The target seems to be correct. Thank you.
I think we need a malware expert to dig into it more deeply. The more advanced tools for that are a little dangerous to use without guidance. A couple of forums are suggested at the end of this article: Troubleshoot Firefox issues caused by malware.
thanks for your help
im guessing that if i uninstall fire fox, this may not help with this issue?
hello i have the same problem with websteroids i did try everything you have suggested but it still wont go. i have windows 8 please can you help me out with this.
Chosen Solution
Hi kg-227, unless Firefox is itself infected, uninstalling/reinstalling shouldn't make a difference.
There are cases in which third party software is dropped into the Firefox program folder and doesn't get cleaned out automatically. This is by design so you don't lose plugins, but could be exploited. To address that situation, you can rename the Firefox folder and then reinstall.
Download the installer for your preferred language from this page:
https://www.mozilla.org/en-US/firefox/all/
After exiting Firefox, rename the program folder to something like OldFox.
On 64-bit Windows, it's:
C:\Program Files (x86)\Mozilla Firefox
On 32-bit Windows, it's:
C:\Program Files\Mozilla Firefox
Then run the installer. It should find your existing personal data automatically.
with the help of jscher2000 suggesting " Troubleshoot Firefox issues caused by malware. " i downloaded the first malware troubleshooter, and after a 45 minute full computer scan, it detected a total of 53 items of tracking cookies, temp files and other things. the icon has disappeared and i haven't had the add on as of yet. so hopefully it stays off! anyone having this problem try installing a malware trouble shooter and see if this uninstalls any un necessary files that could be the problem!
big thanks!