Why am I seeing a Disable Developer Mode Extensions Alert?
If you see a warning when you open Google Chrome that states there are extensions running in developer mode, then there is a chance Chrome may have a malicious Chrome extension installed. In order to protect Chrome users, Google has introduced a feature into Chrome that will alert the user when a non-Chrome Store extension is installed in the browser. This is because many malicious extensions forcibly install themselves into Chrome and are not listed on the the Chrome Web Store.
In order to install extensions manually, rather than through the Chrome Store, user's must configure Chrome to go into Developer Mode so that the extension can be installed from a local file or folder. When extensions are installed locally like this, they are marked as a developer mode extension. This will cause the above alert to be displayed.
The text of this alert is:
Disable developer mode extensions
Extensions running developer mode can harm your computer. If you're not a developer, you should disable these extensions running in developer mode to stay safe.
This alert contains a button that is labeled Disable that when clicked will automatically disable, but not delete, any extensions that were forcibly installed or installed through Developer Mode.
Are Developer Mode Extensions Harmful?
If you installed a Chrome extension from a reliable source, then you do not need to be concerned. On the other hand, if Chrome has suddenly started displaying Developer Mode notifications then you should be concerned.
This is because developer mode extensions can include features that are not normally allowed in extensions listed in the Chrome Web Store. This include local executables and behavior that is frowned up. This behavior could include injecting advertisements, displaying popups, or tracking what sites you visit. You can see an example of advertisements being injected into a web site by a malicious Chrome extension.
How are Malicious Developer Mode Extensions Installed?
Developer Mode extension can be installed through three methods. These methods are:
- The first method is by enabling Developer Mode in the Chrome extensions list and then loading it from a local folder or file.
- The second method is for malware to manually copy the extension into Chrome's folders and then modifying Chrome's configuration so that it loads.
- The third method is to modify Chrome's shortcut so it forces the loading of an extension. For example, an extension could be loaded when Chrome starts by changing the extension to: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --load-extension="%UserProfile%\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa".
How to Disable & Remove Developer Mode Extensions?
Simply clicking on the Disable button in the Developer Mode alert will disable developer mode extensions. Unfortunately, if there is adware running on the computer, it could detect that the extension is removed and add it back again. Due to this I suggest you follow the steps below to not only disable and remove developer mode extensions, but to also scan your computer for malware and remove anything found as well.
To Disable & Remove Chrome Developer Mode Extensions, follow these steps:
- STEP 1: Print out instructions before we begin.
- STEP 2: Use Rkill to terminate suspicious programs.
- STEP 3: Delete and Disable Chrome Developer Mode Extensions
- STEP 4: Use Malwarebytes AntiMalware to clean infections.
- STEP 5: Scan and clean your computer with Zemana AntiMalware.
- STEP 6: Use AdwCleaner to remove adware from the computer.
- STEP 7: Reset browsers back to default settings. (Optional)
- STEP 8: Run Secunia PSI to find outdated and vulnerable programs.
This removal guide may appear overwhelming due to the amount of the steps and numerous programs that will be used. It was only written this way to provide clear, detailed, and easy to understand instructions that anyone can use to remove this infection for free. Before using this guide, we suggest that you read it once and download all necessary tools to your desktop. After doing so, please print this page as you may need to close your browser window or reboot your computer.
To terminate any programs that may interfere with the removal process we must first download the Rkill program. Rkill will search your computer for active malware infections and attempt to terminate them so that they wont interfere with the removal process. To do this, please download RKill to your desktop from the following link.
When at the download page, click on the Download Now button labeled iExplore.exe. When you are prompted where to save it, please save it on your desktop.
Once it is downloaded, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with malware or unwanted programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and a log file will open. Please review the log file and then close so you can continue with the next step. If you have problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.
Do not reboot your computer after running RKill as the malware programs will start again.
Now we want to disable developer mode extensions in Chrome. To do this, open Chrome so that it displays the alert stating that Developer Mode extensions are installed as shown below.
At the above screen, click on the Disable button to disable, but not remove, the developer mode extensions.
Now that we disabled the extensions, we now want to delete the extensions that were disabled. To do this you need to open the Extensions Manager by clicking on the Settings button (), then More Tools, and then Extensions as shown below.
The Extensions screen should now be opened and listing all the installed Chrome extensions. We now want to click on the trash can icon () next to each Extension that does not have a check mark in the Enabled column as shown below.
When done deleting all of the disabled extensions, you can close the Extensions tab and proceed with the rest of the steps.
At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following location and save it to your desktop:
Once downloaded, close all programs and Windows on your computer, including this one.
Double-click on the icon on your desktop named mb3-setup-1878.1878-220.127.116.113-10139.exe. This will start the installation of MBAM onto your computer.
When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave Launch Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.
MBAM will now start and you will be at the main screen as shown below.
We now need to enable rootkit scanning to detect the largest amount of malware that is possible with MalwareBytes. To do this, click on the Settings button on the left side of the screen and you will be brought to the general settings section.
Now click on the Protection tab at the top of the screen. You will now be shown the settings MalwareBytes will use when scanning your computer.
At this screen, please enable the Scan for rootkits setting by clicking on the toggle switch so it turns green.
Now that you have enabled rootkit scanning, click on the Scan button to go to the scan screen.
Make sure Threat Scan is selected and then click on the Start Scan button. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.
MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different than what is shown in the image below due to the guide being updated for newer versions of MBAM.
You should now click on the Remove Selected button to remove all the selected malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.
You can now exit the MBAM program.
At this point you should download Zemana AntiMalware, or ZAM, in order to scan your computer for any any infections or adware that may be present. Please download Zemana AntiMalware from the following location and save it to your desktop:
Once downloaded, close all programs and open windows on your computer.
Now double-click on the icon on your desktop named Zemana.AntiMalware.Setup.exe. This will start the installation of Zemana AntiMalware onto your computer.
When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, Zemana will automatically start and display the main screen.
You will now be at the main screen for Zemana AntiMalware as shown below.
Above the Scan button, please change the scan type to Deep Scan and then click on the Scan button to start the malware removal scan.
Zemana AntiMalware will now start scanning your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
When Zemana has finished finished scanning it will display a screen that displays any malware that has been detected. Please note that the infections found may be different than what is shown in the image below.
Review the scan results and when you are ready to continue with the cleanup process, click on the Next button to delete or repair all of the the selected results. Once you click on the Next button, Zemana will remove any unwanted files and fix any modified legitimate files. If you receive a warning that Zemana needs to close your open browsers, please close any web browsers that may be open and then click on the OK button to continue.
Zemana will now create a System Restore Point and remove the detected files and repair any files that were modified.
When the process is complete, you will be shown a screen that says Completed. At this screen, you can now close the Zemana AntiMalware screen and continue with the rest of the instructions.
Now please download AdwCleaner and save it to your desktop. AdwCleaner will scan your computer for adware programs that may have been installed on your computer without your knowledge. You can download AdwCleaner from the following URL:
When AdwCleaner has finished downloading, please double-click on the AdwCleaner.exe icon that now appears on your desktop. Once you double-click on the icon the AdwCleaner program will open and you will be presented with the program's license agreement. After you read it, click on the I agree button if you wish to continue. Otherwise, click on the I disagree button to close the program. If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
If you selected to continue, you will be presented with the start screen as shown below.
Now click on the Scan button in AdwCleaner. The program will now start to search for known adware programs that may be installed on your computer. When it has finished it will display all of the items it has found in Results section of the screen above. Please look through the results and try to determine if the programs that are listed contain ones that you do not want installed. If you find programs that you need to keep, then uncheck the entries associated with them.
For many people, the contents of the Results section may appear confusing. Unless you see a program name that you know should not be removed,please continue with the next step.
To remove the adware programs that were detected in the previous step, please click on the Clean button on the AdwCleaner screen. AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.
Please save your work and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
Please click on the OK button to let AdwCleaner reboot your computer.
When your computer reboots and you are logged in, AdwCleaner will automatically open a log file that contains the files, registry keys, and programs that were removed from your computer.
Please review this log file and then close the Notepad Window.
If you have already removed all of the developer mode extensions in the previous step, then you probably do not need to do this step. If you are unsure or just want to reset Chrome back to the default extensions, you can follow the steps below for Chrome.
Doing these steps will erase all configuration information from Chrome such as your home page, tab settings, saved form information, browsing history, and cookies. This process will also disable any installed extensions. All of your bookmarks, though, will be preserved.
To reset Chrome, open the program and click on the Chrome menu button () in the top right-hand corner of the window. This will open the main menu for Chrome as shown below.
Now click on the menu option labeled Settings as shown by the arrow in the picture above, which will open the basic settings screen. Scroll down to the very bottom and you will see a Show advanced settings... option as shown in the image below.
Click on the Show advanced settings... option to open the advanced settings screen. Scroll to the very bottom until you see the reset button as shown in the image below.
Now click on the Reset settings button as shown in the image above. Chrome will now open a confirmation dialog asking if you are sure you wish to reset your browser.
To reset Chrome, click on the Reset button. Chrome will now erase all your personal data, browsing history, and disable all installed extensions. Your bookmarks, though, will remain intact and still be accessible. You can now close the Settings tab and continue with the rest of the instructions.
As many malware and unwanted programs are installed through vulnerabilities found in out-dated and insecure programs, it is strongly suggested that you use Secunia PSI to scan for vulnerable programs on your computer. A tutorial on how to use Secunia PSI to scan for vulnerable programs can be found here:
All Chrome Developer Mode Extensions should now be removed from Chrome. If your current security solution allowed any of these malicious programs on your computer, you may want to consider purchasing the full-featured products below that include real time protection.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:
Are Your Protected?
While both Malwarebytes and Zemana are free to scan and clean a computer, if you want to be fully protected with real-time protection then it is recommended that you purchase a premium version.
Purchase the full-featured version of Malwarebytes Anti-Malware, which includes real-time protection, scheduled scanning, and website filtering, to protect yourself against these types of threats in the future!
Purchase the full-featured version of Zemana AntiMalware, which includes second opinion malware scanner when other solutions do not work, cloud scanning, and super-fast scan time, to protect yourself against these types of threats in the future!
Disclaimer: While we highly recommend the above products, it should be noted that BleepingComputer.com earns a commission from their sale.