Trojan.FakeGoogleJS is usually a Malwarebytes detection for fake-Google or browser-extension-style JavaScript artifacts, not a legitimate Google component. Public cases show it beside files such as manifest.json, background.js, content.js, jquery.js, and icon.png under user-writable folders like AppData\Local. Keep the detection quarantined, copy the full path, remove the suspicious extension or app source, clean browser sync, then scan again after reboot.
The label matters because it often appears after a fake extension, cracked download, fake updater, suspicious game/mod package, or account-compromise scare. A one-time quarantined extension folder is different from a recurring startup task, PowerShell loader, or account session abuse. This guide walks through the triage without restoring the files or trusting copied fixlists from forum threads.
What Trojan.FakeGoogleJS Means
Trojan.FakeGoogleJS and the related Trojan.FakeGoogle label are seen in Malwarebytes detection logs for suspicious files that imitate a Google or Chrome-related extension structure. The name can sound like an official Google warning, but it is a security-tool label. The practical question is where the alert points and whether anything is still launching those files.
Several public reports show two common patterns: JavaScript/extension-like files in AppData\Local, and persistence-looking entries with names such as GoogleUpdateSecurityTaskMachine. A real Chrome extension also uses files such as manifest.json, background scripts, content scripts, and icons, so the file names alone do not prove safety. A fake extension abuses the same shape while living in the wrong folder, requesting suspicious access, or returning after cleanup.
First Checks Before You Delete Anything
- Leave Malwarebytes quarantine in place. Do not restore
Trojan.FakeGoogleJSor add an exclusion because the file name mentions Google. - Export or copy the detection details. Save the full path, detection name, scan date, and every companion detection found in the same scan.
- Look at the folder, not only the file. A folder with
manifest.json,background.js,content.js,jquery.js, andicon.pngcan be a fake extension package. - Note nearby account symptoms. Instagram, Discord, Microsoft, email, Steam, or browser-session abuse changes the response from simple cleanup to account recovery.
- Do not run copied FRST or registry fixlists. Those scripts are written for one machine. Running another user’s fixlist can remove the wrong services, tasks, or browser data.
Path Triage: Cache, Extension Folder, Or Persistence?
| Where the alert points | What it likely means and what to do |
|---|---|
AppData\Local\... with manifest.json, background.js, content.js, or icon.png |
Likely fake or unwanted extension-style files. Keep quarantine, remove the extension source, clean browser profiles and sync, then scan again. |
Chrome\User Data\Default\Local Extension Settings or Sync Data\LevelDB |
Browser extension/profile data may be involved. Remove suspicious extensions, check sync, and reset only the affected browser data if needed. |
| Task Scheduler or Registry paths with Google-like task names | Higher risk. Inspect scheduled tasks, Startup apps, services, and Run keys because something may be relaunching the fake files. |
| Downloads, game/mod/crack folder, or an extracted archive | Treat the original download as the likely source. Delete it after quarantine, scan the archive folder, and secure accounts if it ran. |
| Only one quarantined item and clean follow-up scans | Lower risk, but do not restore it. Watch for reappearance and keep browser extensions under review. |
How To Clean Trojan.FakeGoogleJS
- Update Malwarebytes and Windows security tools. Run a fresh scan after definitions update so old cache or deleted files do not confuse the result.
- Remove suspicious extensions in every browser. Check Chrome, Edge, Brave, Opera, Firefox, and any portable browser. Remove extensions you did not install, especially search helpers, game/mod helpers, fake VPNs, coupon tools, download helpers, or anything with a random ID.
- Check browser sync. If an extension returns after removal, disable extension sync temporarily, remove the extension on each signed-in device, then re-enable sync only after the account is clean.
- Review notification permissions and homepage/search settings. Fake extension infections often sit beside push-notification spam, search redirects, or homepage changes.
- Inspect Task Scheduler. Sort tasks by recently created or modified entries. Look for commands that launch Chrome, PowerShell,
cmd.exe,wscript.exe,mshta.exe, random AppData paths, or Google-like task names you do not recognize. - Inspect Startup apps and Run keys. Check Settings -> Apps -> Startup, the Startup folders, and Registry Run entries if you are comfortable. Export a backup before changing registry values.
- Scan after reboot. Reboot and run a full scan. A clean scan after quarantine, extension cleanup, and reboot is a better signal than deleting files while the browser is still open.
- Secure accounts from a clean device if anything ran. Change passwords and revoke sessions for email, Microsoft, Google, Discord, Instagram, Steam, password manager, banking, and crypto accounts if the infection followed a download or account activity appeared.
- Launch Chrome.
- Click the three dots (...) in the top right corner.
- Select Extensions > Manage Extensions.
- Click Remove next to the extension you want to delete.
Quick Access: Type chrome://extensions/ in the address bar.
- Open Safari.
- In the menu bar, click Safari and select Settings (or Preferences).
- Click on the Extensions tab.
- Select the extension and click Uninstall.
- Click the menu button, select Add-ons and themes.
- Go to the Extensions tab.
- Click the three dots (...) next to the extension and select Remove.
Quick Access: Type about:addons in the address bar.
- Launch Microsoft Edge.
- Click the three dots (...) in the top right corner.
- Select Extensions.
- Find the extension and click Remove.
Quick Access: Type edge://extensions/ in the address bar.
- Launch Brave browser.
- Click the menu icon > Extensions.
- Find the extension and click Remove.
Quick Access: Type brave://extensions/ in the address bar.
- Launch Opera.
- Click the Opera logo in the top left corner.
- Select Extensions > Extensions.
- Click the X or Remove button next to the extension.
Quick Access: Type opera://extensions/ in the address bar.
If a website keeps showing unwanted pop-ups, you likely granted it permission to send notifications. To stop them, you need to revoke that permission in your browser settings.
- Copy and paste this into the address bar:
chrome://settings/content/notifications - Scroll down to the Allowed to send notifications list.
- Find the suspicious site.
- Click the three dots (...) next to it and select Remove (or Block).
- Open Safari and go to Settings (or Preferences).
- Click the Websites tab and select Notifications on the left.
- Find the suspicious site in the list on the right.
- Select it and click Remove (or change "Allow" to "Deny").
- Copy and paste this into the address bar:
about:preferences#privacy - Scroll down to Permissions and click Settings... next to Notifications.
- Type the suspicious site in the search bar or find it in the list.
- Select the site and click Remove Website.
- Copy and paste this into the address bar:
edge://settings/content/notifications - Look under the Allow section.
- Find the suspicious site.
- Click the three dots (...) next to it and select Remove (or Block).
- Copy and paste this into the address bar:
brave://settings/content/notifications - Scroll to the Allowed to send notifications list.
- Find the suspicious site.
- Click the three dots (...) and select Remove (or Block).
- Copy and paste this into the address bar:
opera://settings/content/notifications - Check the Allowed to send notifications list.
- Find the suspicious site.
- Click the three dots next to it and select Remove.
If the case started after a game, mod, crack, or fake installer, compare it with our infostealer after downloading a game or mod checklist before changing passwords on the same PC. If the extension keeps returning after you remove it, use the persistence steps in our browser extension keeps reinstalling itself guide.
When Account Safety Becomes The Main Issue
A quarantined JavaScript file is not proof that passwords were stolen. But the risk rises when the detection follows a downloaded executable, cracked game, mod installer, fake update, Discord attachment, or browser session theft. In that case, cleanup and account recovery should be separate tasks.
Clean the Windows device first, then change passwords from a different trusted device. Start with email and the account that controls password resets. Revoke active sessions, remove unknown OAuth/app passwords, check forwarding rules, and turn on multifactor authentication. For social accounts, review recent login locations and connected apps. For Discord or Steam, remove unknown sessions and check for messages sent while you were not using the account.
Could Trojan.FakeGoogleJS Be A False Positive?
It is possible, but do not assume that on the first alert. A false-positive path is more plausible when the file came from a known extension project you control, the code is expected, no persistence exists, the browser behaves normally, and multiple updated scans are clean. Most ordinary users should not restore the quarantined item. If it was a real extension you develop, test it in a clean development profile and submit the file to the detecting vendor rather than excluding the whole folder.
What Not To Do
- Do not restore quarantined files with
FakeGooglein the detection name. - Do not assume the alert is safe because Google, Chrome, or update words appear in a task name.
- Do not install more random “removal tools” from search results.
- Do not reuse another person’s cleanup script, FRST fixlist, or registry file.
- Do not keep using the same browser profile for password changes until extension sync and suspicious add-ons are clean.
FAQ
Is Trojan.FakeGoogleJS from Google?
No. The name is a malware-detection label. It often points to fake-Google or Chrome-extension-style files, not to a legitimate Google update.
Why did Malwarebytes find files like manifest.json and background.js?
Those are normal file names in browser extensions, but malicious or unwanted extensions can use the same structure. The folder path, extension source, permissions, and persistence decide the risk.
Should I wipe Windows after Trojan.FakeGoogleJS?
Not automatically. If quarantine holds, the files were in an extension-like folder, and clean follow-up scans show nothing else, targeted cleanup is often enough. Consider reinstalling only when malware keeps returning, account theft is confirmed, or you cannot trust the original installer chain.
Why does the fake extension come back?
Common reasons include browser sync, another signed-in device, a companion app, a scheduled task, a Run key, or a policy entry. Remove the source before re-enabling sync.
Can I delete the AppData folder manually?
Delete only the suspicious folder after quarantine and scans identify it. Removing large AppData sections blindly can break browsers and apps while leaving the startup task that recreates the folder.
References
- Malwarebytes Forums. “Unable to start Malwarebytes or Malwarebytes Chameleon.” Malwarebytes Forums, public removal log showing
Trojan.FakeGoogletask-cache detections, accessed June 2, 2026. https://forums.malwarebytes.com/topic/216979-unable-to-start-malwarebytes-or-malwarebytes-chameleon/ - Reddit r/computerviruses. “Got infected with floxif virus, trogan.fakegoogle and ramnit virus.” Public user report with
Trojan.FakeGoogleextension-style files under AppData, accessed June 2, 2026. https://www.reddit.com/r/computerviruses/comments/1trwesi/got_infected_with_floxif_virus_troganfakegoogle/ - Chrome for Developers. “Manifest file format.” Google, accessed June 2, 2026. https://developer.chrome.com/docs/extensions/reference/manifest
- Google Chrome Help. “Install and manage extensions.” Google, accessed June 2, 2026. https://support.google.com/chrome/answer/2664769
- Microsoft. “TrojanDownloader:JS/FakeUpdates.J threat description.” Microsoft Security Intelligence, updated February 7, 2024, accessed June 2, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader%3AJS%2FFakeUpdates.J&threatId=-2147133367
