If a browser extension keeps reinstalling itself, the extension folder is usually only the visible symptom. Something else is restoring it: browser sync, an enterprise-style policy, a companion app, a scheduled task, a startup entry, or adware running in the user profile. Remove the restoring source first, then remove the extension and reset the browser.
This matters when an extension appears in Chrome, Edge, Brave, or Opera without consent, injects ads, changes search, asks for broad site access, manages other extensions, or returns after you delete it. Treat that as a browser-hijacker or PUA persistence problem until you prove it is only a sync mistake.
Why the extension comes back
Recurring extensions usually return through one of these paths:
- Sync restores it. The extension is still attached to your Google, Microsoft, or Opera profile and returns after sign-in.
- A browser policy forces it. Chrome and Edge both support managed extension policies. Legitimate administrators use them, but adware can abuse the same policy area on personal PCs.
- A companion program reinstalls it. A recently installed “PDF”, “coupon”, “download helper”, “cleaner”, “ad blocker”, or game/mod tool may recreate the extension.
- A scheduled task or startup entry reloads it. Tasks under AppData, ProgramData, or a random vendor folder can rewrite browser settings after every reboot.
- The browser profile is still contaminated. Deleting one extension directory does not clean preferences, local state, policy, sync data, or another profile.
Record clues before deleting it
Open the browser extension page and turn on developer mode if the browser offers it. Write down the extension name, ID, permissions, source path, and whether it says Installed by your administrator, Managed by your organization, or from another store. These clues tell you where to look next.
| Clue | What it usually means |
|---|---|
| Same extension returns after sign-in | Sync or browser import is restoring it. |
| Cannot remove it from the browser UI | A policy may be force-installing it. |
| It returns after reboot | A startup item, scheduled task, service, or companion app may be reinstalling it. |
| It appears in several browsers | Look for a Windows-level app, policy, or adware component, not only one browser profile. |
| It has broad site access or history permissions | Assume possible data exposure and review passwords/sessions after cleanup. |
If the returning item is a Malwarebytes detection named Trojan.FakeGoogleJS, first preserve the full AppData or extension-folder path. Our Trojan.FakeGoogleJS cleanup guide explains how to separate fake extension files, browser sync, and scheduled-task persistence.
Clean it in the right order
- Pause sync and auto-import first. Sign out of the affected browser or pause sync. In Edge, also check profile import settings if it keeps copying Chrome extensions back. Do not turn sync on again until the local machine is clean.
- Check browser policy pages. Open
chrome://policy,edge://policy,brave://policy, or the equivalent Chromium policy page. Look for extension-related entries such asExtensionSettingsorExtensionInstallForcelist. Google and Microsoft document these as administrator controls for force-installed extensions [1] [2] [3]. On a work or school device, ask the administrator. On a personal PC, unexpected extension policies are suspicious and should be investigated together with installed apps and startup entries. - Remove suspicious installed apps. Sort Windows installed apps by date. Uninstall unknown ad blockers, shopping helpers, search tools, downloaders, “web protectors”, cracked-software helpers, or bundles installed near the first extension appearance.
- Inspect startup persistence. Check Startup Apps, Task Scheduler, Services, and the Startup folders. Be especially careful with entries launching from
%AppData%,%LocalAppData%,%ProgramData%,%Temp%, or a random folder name. Disable only items you understand or can clearly connect to the unwanted extension. - Close every browser process. Use Task Manager to end Chrome, Edge, Brave, Opera, and their background update/helper processes before removing profile leftovers.
- Remove the extension from the browser UI. Use the browser’s Extensions page first. If the extension is unpacked and points to a local profile folder, delete that specific extension folder only after the restoring process is stopped.
- Reset browser settings after the source is gone. Reset search, startup page, new tab, notification permissions, and site permissions. If the extension changed search or redirects, see Gridinsoft’s PUA and browser hijacker removal guide for the broader cleanup order.
- Scan for PUA/adware persistence. Run Gridinsoft Anti-Malware if the extension returns, appears in multiple browsers, arrived after a bundle, or created ads/redirects. A scan is useful here because the visible extension may be reinstalled by a separate Windows component.
Where to check in each browser
| Browser | Useful places to check |
|---|---|
| Chrome | chrome://extensions, chrome://policy, sync settings, and profile folders under %LocalAppData%GoogleChromeUser Data. |
| Microsoft Edge | edge://extensions, edge://policy, profile import settings, and profile folders under %LocalAppData%MicrosoftEdgeUser Data. |
| Brave | brave://extensions, brave://policy, sync chain settings, and profile folders under %LocalAppData%BraveSoftwareBrave-BrowserUser Data. |
| Opera | opera://extensions, sync settings, startup settings, and profile data under %AppData%Opera Software or %LocalAppData%ProgramsOpera. |
When to change passwords
Change passwords only after the extension and its restoring source are gone. Prioritize email, browser-synced accounts, banking, work accounts, password manager, social media, and gaming accounts if the extension had permissions for browsing history, all-site access, clipboard activity, notifications, downloads, or extension management. Also sign out of other sessions where the account provider offers that option.
If you are unsure whether an extension is malicious, compare its permissions with Gridinsoft’s browser extension safety checklist. Broad access is not automatically malware, but broad access plus silent installation or reinstallation is enough reason to clean the PC and review sensitive accounts.
What not to do
- Do not repeatedly delete the same extension folder while the browser is still running. The restoring process may immediately recreate it.
- Do not remove corporate or school policies from a managed device. If the PC belongs to an organization, contact IT.
- Do not reinstall the browser as the first fix. Reinstalling often keeps the same sync account, policies, tasks, or Windows-level app.
- Do not install more random “extension remover” tools. That can add another PUA to the same problem.
FAQ
Why does the extension return after I delete its folder?
Because another source is probably restoring it. Check browser sync, policy pages, recent installed apps, scheduled tasks, startup entries, and AppData or ProgramData helpers before deleting the folder again.
Does “Managed by your organization” always mean malware?
No. It is normal on school or work devices. On a personal PC, unexpected browser policy entries deserve investigation because unwanted software can use policy mechanisms to force-install extensions.
Should I reset Chrome or Edge?
Resetting helps only after the restoring source is removed. If you reset first, the same sync account, policy, task, or companion app can bring the extension back.
Can a browser extension steal passwords?
Some extensions can read page content or browsing activity depending on their permissions. If the extension had broad site access or appeared without consent, clean the device first, then change important passwords and revoke suspicious sessions.
References
- Google Chrome Enterprise Help. “Automatically install apps and extensions.” Google, accessed June 1, 2026. https://support.google.com/chrome/a/answer/6306504?hl=en-EN
- Chrome Enterprise. “ExtensionSettings: Extension management settings.” Google, accessed June 1, 2026. https://chromeenterprise.google/policies/extension-settings/
- Microsoft Learn. “ExtensionInstallForcelist.” Microsoft, last updated May 22, 2026, accessed June 1, 2026. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/ExtensionInstallForcelist
- Microsoft Support. “Microsoft Edge Extensions: Frequently Asked Questions.” Microsoft, accessed June 1, 2026. https://support.microsoft.com/en-us/edge/microsoft-edge-extensions-frequently-asked-questions
