Word Highlight Extension - What's it doing there?

[highstream]

On opening SJ today, there's an extension called Word Highlight ("W" on the address bar) that I'd never heard of and certainly didn't install. Where'd that come from? The problem now at minimum is that the Enable box won't uncheck. What's the deal?

[oftentired]

Look hear, [url=slimjet://extensions]slimjet://extensions[/url], and see if it is listed and can be trashed. Slimjet wouldn't have brought this in. Might have picked it up surfing or installing/updating another program.

[highstream]

Perhaps I wasn't clear enough: I wrote that it couldn't be trashed from extensions, i.e., slimjet://extensions. The Enable checkbox won't respond to unchecking.

[oftentired]

My bad I should have picked it up from the "enable box"

Here at this link are some helpful instructions.

[highstream]

Thanks, but it turns out that Word Highlight has been "installed by enterprise policy" and "(This extension is managed and cannot be removed or disabled.)" The trash icon is blocked. So what's this about?

But that's not all. The last update installed (or reinstalled) ebay and Amazon on the toolbar, as well as a second (unneeded) ad blocker that doesn't show in Extensions or in Current Toolbar buttons (there are other buttons now on the toolbar that I don't recall putting there - history, print, etc. - but am not sure). So the question is again, what's going on here?

[oftentired]

Your problem with the extension is not related to the Ebay or Amazon icons. Click the link I provided where you can find information on how to remove a malicious extension that resists being removed normally. I also suggest you scan you system with a reliable anti-malware program such as malewarebytes. Slimjet, downloaded form the Slimjet website links (or other reliable download sources such as softpedia and majorgeeks) does not come with malware of any kind. If you have gotten malware onto your system it came from somewhere else.

Ebay icons and similar icons only show up once during an installation the first time you visit the associated website and it is intended as a non-malicious helpful icon you might find useful for future use. It is simple enough to remove them by customizing the toolbar. Why any of these "helpful" icons showed up for you is unknown to me. In any event they should only show up on your toolbar if you visit the associated website. If your certain you have not visited either Amazon or Ebay and the icons showed up or that you have already visited them and have now visited a second time and had the icons a second time you should submit a bug report about that.

This second instance of an adblocker is problematic. Is it the same exact internal adblocker icon provided with Slimjet or an external extension?

[highstream]

In this case, the instructions at the link you supplied were of no help. MBAM Pro full scan came up clean, as did Comodo CIS a couple of days ago. Ad Blocker is on the Slimjet drop-down menu. I disabled it and moved the button off the toolbar (still on the first screenshot - scroll it to the right). I have six browsers and the only one with Amazon and eBay on it is Slimjet, yet I haven't installed anything via Slimjet except Slimjet. Yes, eBay and Amazon were easily removed, but it's not at all obvious how they and Word Highlight got there in the first place, since I'm very careful about disabling add-ons that some programs toss in. Could another program have done it surreptitiously? Possible, but looking at my recent installs I have no clue which could have done it and only to Slimjet. OTOH, most browsers stick eBay and Amazon buttons or links somewhere by default, so I don't rule out Slimjet. There's got to be more behind the story of Word Highlight, as that's the true ringer in the group, i.e., nonremovable (scroll down the second screenshot).

Slimjet toolbar with extras.JPG

Slimjet extensions.JPG

[oftentired]

Something that is installed to chrome extensions by, "installed by enterprise policy", is extremely likely to be malware of some kind brought in without your permission during a program installation.

Malwarebytes is a very capable anti-malware program and should be able to identify it and remove it. See the link in my previous post for malewarebytes.

[dev]

yep you have some adware/malware on your puter somewhere (i would check the other five browsers on your system but that pdf with cleanprint would be my first port of call ). it looks like its reset your profile too hence the icons ebay etc showing up (first run of slimjet) and giving you two instances of adblocker , adblock (why are using that by the way ? use ublock far lighter on ram if your not going to use the inbuilt one) and the inbuilt adblocker.

this might help https://malwaretips.com/blogs/installed ... y-removal/

[highstream]

oftentired, it appears that you've read too quickly again: "MBAM Pro full scan came up clean."

dev, thanks for the link. Here's what I've found:

- Full scans with MBAM Pro, Comodo and ESET Online Scanner have turned up nothing, zero malware of any kind. Running CCleaner doesn't eliminate it either. Hitman Pro, which is set to be very sensitive, found several false malware positives for files that are part of the clean audio player Bug Head, and several "tracking cookies," but requires a purchase to do anything with the latter (but then many, if not most cookies have some tracking capacity - that's their point);

- Word Highlight extension does not appear in any of my other five browsers, two of which are Chromium based (Opera 35 and Vivaldi);

- Cleanprint is an extension in the Chrome Store, so it's not likely adware/malware; removing it completely has no effect on Word Highlight;

**- The registration code for Word Highlight is "ooabkmkhabkahcjbgpiajffckeibpdoa." After eliminating it from the registry and deleting it from folders/files, restarting Slimjet reintroduces it in folders/files (Chrome-extension). Fully uninstalling Slimjet (Revo Pro), rebooting and reinstalling Slimjet reintroduces it to the registry and files/folders. Note that after the code references are eliminated, the Word Highlight toolar button turns grayed out, but the extension itself remains listed in Extensions per my screenshot.

The latter means Word Highlight is either lurking somewhere on my computer under a different name and Slimjet alone is triggering it, or it's an unintended part of the Slimjet install. The inability of MBAM, Comodo and ESET to find it suggests it's part of the install - things like that do happen - but then if no one else is seeing it...

- The other stuff, such as eBay and Amazon, are part of the Slimjet install - Bookmark bar under the toolbar - and were probably reintroduced yesterday when I used the offline installer instead of the web installer with 7.0.1.0. I had previously been using the latter, and eliminated all the stock bookmarks after the first install some weeks ago.