Solved Can't remove an extension- removed extension keeps coming back

[Borgall]

Hi,

I have an extension called Sheets (I looks like a Google Sheets extension). I try to disable and remove it with the right button in vivaldi://extensions/ but every time a reload the browser it is still there. My Synch is disabled. How to remove it?

[Borgall]

@pafflick I think I menaged to fix this. I'm still testing but I think The Jira ticked can be closed as of this thread.
If anyone is facing this problem this is what I did:
I checked vivaldi://about/ and realized the Vivaldi is being run with strange line of command (atribute or paramiter or whatever it is called):
(...) vivaldi.exe" --load-extension=My AppData folder\Local*Packages\Paon\v1-5\addon*" --flag-switches-begin --flag-switches-end --save-page-as-mhtml
It looks that my shortcut was replaced. I changed the shortcut and deleted everythig in Packages folder (there were 3 folders- all with similar content as Paon folder so I just deleted all 3). Then I removed the extension from the browser and after a restart it's still gone.
So it was a malware. Also- strange notofications have gone so I think there were connected.
There are few threds on other browser forums discribing the same problem.

[RealMat0s]

Hi @Borgall

It is rare. Try deleting it and clearing your browser cache / history.

That way, there might not be any way for it to keep popping up.

If so, let us know via the link below.

[TbGbe]

@borgall Maybe that extension creates a service?
Check vivaldi://serviceworker-internals
Hit Unregister for unwanted entries

Also check the url chrome://settings/system and disable "running background apps".

[Borgall]

@TbGbe None on those fixed the problem...
@RealMat0s It didn't help. When I tried to delete the extension one more time my browser crashed. I reported the bug and submitted the bug report. Thank You.

[Hadden89]

@borgall If you are totally sure is unwanted, you could also try the brute force method:

• seek for the extension ID in vivaldi://extensions then close vivaldi. Let us know the ID.
• go into the vivaldi folder and navigate to User Data > Default > Extensions
• remove only the folder associated with that ID and reopen vivaldi.
• go back to vivaldi://extensions and you should have a remove button as the extension is now corrupted due lack of its folder. If still appears, I'll consider a malware scan.

---

Some apps manage to install extensions on startup without any kind of consent but usually most don't because is often considered malicious behaviour

[DoctorG]

@borgall can you please list your extensions: open internal page vivaldi://system#extensions , click Maximize… button, copy list of extensions and paste here.

Perhaps an other program installs the unwanted extension. I had that such issue the past with Windows Automation

[Catweazle]

@borgall , I can't find an extension called Sheets in the store, becaus of this, maybe a highjacker soft and Google has eliminate it of the store.
I think the best is, apart from delete this extension, caché and serviceworkers, to mace a scan with AdwCleaner or Panda Cloud Cleaner to remove it.
A good extensión, OpenSource, is Only Office.
If you only need a spreadsheet, you can also use this one, works in the web panel and don't need account.

[Borgall]

@hadden89 I'm in contact with Vivaldi support so I will leave Your sugestion as a last resort. I don't want to fight on 2 fronts at one time
@Catweazle The story is that this system is backup form (at least) few months ago (my HD failed) and I can't remember if this is some old version or not supported anymore extension or even if I installed it myself. The fact is I can't find it on Chrome Store. I don't need any extension of this kind. Malewarebytes and Panda scans showed some minor problems but nothing connected to Vivaldi.
@DoctorG

ahfgeienlihckogmohjhadlkjgocpleb : Web Store : version 0_2
ajhmfdgkijocedmfjonnpjfojldioehi : Privacy Pass : version 3_0_0
cmedhionkhpnakcndndgjdbohmhepckk : Adblock dla Youtube™ : version 5_1_7
epcnnfbjfcgphgdmggkamkmgojdagdnn : uBlock : version 0_9_5_25
gighmmpiobklfepjocnamgkkbiglidom : AdBlock — najlepszy bloker reklam : version 4_43_0
jeogkiiogjbmhklcnbgkdcjoioegiknm : Slack : version 1_0_3
jffbochibkahlbbmanpmndnhmeliecah : Vivaldi Picture-In-Picture : version 1_0
**kbhlkpjfohpdenbemioojdkjkpgclhfc : Sheets : version 2_0_0_9**
kmendfapggjehodndflmmgagdbamhnfd : CryptoTokenExtension : version 0_9_74 (can't recognize that one)
ldjkgaaoikpmhmkelcgkgacicjfbofhh : Instapaper : version 2_1_2
lglfeioladcfajpjdnghbfgohdihdnfl : Vivaldi Theme Store : version 1_0
mhjfbmdgcfjbbpaeojofohoefgiehjai : Chromium PDF Viewer : version 1
mlomiejdfkolichcflejclcbmpeaniij : Ghostery – Bloker reklam chroniący prywatność : version 8_6_1
mpognobbkildjkofajifpdfhcoklimli : Vivaldi : version 1_5
nkeimhogjdpnpccoofpliimaahmaaome : Google Hangouts : version 1_3_16
ponfpcnoihfmfllpaingbgckeeldkhle : Enhancer for YouTube™ : version 2_0_112

Some of them are not on my normal list, some of them looks familliar.

[Catweazle]

@borgall , CryptoTokenExtension is the inbuild extension from Google in Chromium, you can desactivate it in the privacy settings in Vivaldi, but without this you can't logging in some Google services.

[pafflick]

@borgall Each time you remove it, it could be reinstalled by some software (maybe even malicious) on your computer. Or perhaps the profile itself is broken. Since we were unable to reproduce your bug, I suggest you consider performing Full reset of Vivaldi.

[Borgall]

@pafflick I think I menaged to fix this. I'm still testing but I think The Jira ticked can be closed as of this thread.
If anyone is facing this problem this is what I did:
I checked vivaldi://about/ and realized the Vivaldi is being run with strange line of command (atribute or paramiter or whatever it is called):
(...) vivaldi.exe" --load-extension=My AppData folder\Local*Packages\Paon\v1-5\addon*" --flag-switches-begin --flag-switches-end --save-page-as-mhtml
It looks that my shortcut was replaced. I changed the shortcut and deleted everythig in Packages folder (there were 3 folders- all with similar content as Paon folder so I just deleted all 3). Then I removed the extension from the browser and after a restart it's still gone.
So it was a malware. Also- strange notofications have gone so I think there were connected.
There are few threds on other browser forums discribing the same problem.

[Hadden89]

@borgall So.. something modified the vivaldi shortcuts to load an unpacked(?) extension which load another addon. Really malicious. Let us know what the malware scan says, as there could be leftovers|reinfections (if you open the thing who injected these on your pc).

[Pathduck]

@borgall Did you try to install Contra Returns from Facebook?
https://www.reddit.com/r/pcmasterrace/comments/onjlgp/cannot_delete_contra_returns_files/hr37kg8/?context=3

"After a little experimenting I noticed that Chrome is loading an extension from
C:\Users\MyUserName\AppData\Local\Packages\Paon"

[Borgall]

@pathduck Yes, I think this is the case.
I modified the script from reddit (changed "update" in all the paths to "conf") and deleted rest of the garbage (search -> rnews.exe) manualy. After a reboot I can't find any strange folders so i hope it is gone. I think I wasn't fully infected as Malwarebytes quaratined some files before so I wasn't experiencing any GPU or CPU high usage and therefore focused on the browser and extension.
I hope the anti-malware software devs will add it to the database soon.

[kzymon99]

Hi Are You Still Here? What Are 3 Similar Contents About Paon File

[MahinHossen]

If anyone facing this issue still, please delete the paon package immediately.

The reason I am saying this is that, it's a virus which may have come with some file you have downloaded from internet. I have also faced this and it changed lots of things of my browser.

It may sound weird but I was getting lots of weird youtube history which I haven't even watched. besides, there were multiple issues. It normally happen in your default browser/chrome.

So, I have done these steps, hope it will fix yours too...

• go to chrome://extensions/ turn on developer option on top right. You will see ID of that extension (sheets)
  
  I have already deleted it, so using an example here
  then goto C:\Users\USERNAME\AppData\Local\Google\Chrome\User Data\Default\Extensions and delete that folder named with same ID

• goto shortcut of all the browsers and see if target seems right to you. for example, chrome will be "C:\Program Files\Google\Chrome\Application\chrome.exe" not C:\Users\USERNAME\AppData\Local\Packages\Rnews or something like that. change target to correct directory and save. also goto startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs and check other browsers shortcuts

• at last goto C:\Users\USERNAME\AppData\Local\Packages and delete the folder. Also if you see any suspicious folder in that directory, scan with antivirus though it wont get caught most likely, but hope that's gonna be enough