Removal instructions for the fake Google Sheets browser extension
Written by Tomas Meskauskas on (updated)
What kind of software is this fake Google Sheets extension?
Our research team discovered this fake Google Sheets browser extension while inspecting deceptive sites. This piece of rogue software is disguised as a spreadsheet app that is part of the web-based Google Docs Editors suite. It must be emphasized that this extension is not associated with Google Sheets, Google Docs Editors, or Google LLC.
Upon examination, we determined that this fraudulent extension collects sensitive data, displays browser notifications, and potentially performs other harmful activities.
Fake Google Sheets browser extension overview
When we executed the setup containing this fake Google Sheets extension, it also installed other unwanted and potentially malicious software onto our testing system.
This illegitimate extension was not installed onto either the Google Chrome or Microsoft Edge browsers. Instead, this installer dropped the extension's folder – titled "Extension" – into the "C:\Users\[username]\AppData\Local\Temp\" folder.
This manner of installation is a persistence-ensuring technique since eliminating the fraudulent Google Sheets extension from Chrome/Edge will not get rid of it. Hence, after standard removal, this software will reappear when the browser is opened again.
Additionally, having this extension on a device modifies the Chrome/Edge browser's shortcut. The target has ""--proxy-server="217.65.2.14:3333"" added to it (note that the IP address in this appendix may vary). Steps for how to remove this software can be found below.
Another mechanism used by this fake Google Sheets browser extension is utilizing the "Managed by your organization" feature on Google Chrome and Microsoft Edge.
The extension also spies on users' browsing activity. Malicious extensions typically collect browsing and search engine histories, downloads, Internet cookies, log-in credentials (usernames/passwords), finance-related data, etc. This vulnerable information can be sold to third-parties or otherwise abused for profit.
Furthermore, this rogue extension can deliver browser notification spam. These ads commonly endorse online scams, unreliable/hazardous software, and even malware. What is more, the browser extension in question could possess other harmful capabilities.
To summarize, the presence of software like this fake Google Sheets extension can lead to system infections, serious privacy issues, financial losses, and identity theft.
| Name | Fraudulent Google Sheets browser extension |
| Threat Type | Malicious Extension, Unwanted Extension |
| Browser Extension(s) | Google Sheets |
| Detection Names (installer) | N/A (VirusTotal) |
| Symptoms | The "Managed by your organization" feature is activated in Chrome or Edge browser, decreased Internet browsing speed, spam notifications are displayed, your computer becomes slower than usual. |
| Distribution Methods | Dubious websites, malicious installers, deceptive pop-up ads, free software installers (bundling), torrent file downloads. |
| Damage | Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites, possible additional malware infections. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Similar software examples
We have written about thousands of unwanted browser extensions. They usually appear harmless, and some even imitate existing software. We have discovered several rogue extensions that impersonate Google products/services, e.g., "Google Drive", "Chrome", "Google Translate", "Google Docs", etc.
Most malicious extensions have data-tracking functionalities, and many exhibit adware or browser-hijacking abilities. Keep in mind that regardless of how genuine or useful a piece of software appears – that does not mean that it is. Likewise, remember that operational features alone do not prove a software's legitimacy or safety.
How did this fake Google Sheets extension install on my computer?
We downloaded the setup containing this fake Google Sheets extension (and other unwanted software) from a scam page using an adult-themed lure. However, this software could be pushed using other websites/methods.
Extensions of this kind are promoted on various scam sites and legitimate-looking download webpages. They are primarily entered via redirects caused by intrusive ads, websites using rogue advertising networks, misspelled URLs, spam browser notifications, and adware.
Another potential distribution technique is bundling, which involves packing ordinary program installers with unwanted/malicious supplements.
The threat of inadvertently allowing bundled content into the device is increased by downloading from dubious channels (e.g., freeware and free file-hosting sites, P2P sharing networks, etc.) and by treating installations with negligence (e.g., ignoring terms, skipping steps/sections, using "Quick/Easy" settings, etc.).
Additionally, intrusive advertisements proliferate rogue software. Once clicked on, some of these adverts can execute scripts to perform sneaky downloads/installations.
How to avoid installation of rogue software?
We highly recommend researching software prior to downloading/purchasing. All downloads must be made from official and verified sources. Installation processes have to be approached with caution, e.g., by reading terms, studying available options, using the "Custom/Advanced" settings, and opting out of all additional apps, extensions, tools, features, etc.
We also advise vigilance while browsing, as fraudulent and malicious online content usually appears legitimate and harmless. For example, while intrusive ads may look innocuous – they redirect users to unreliable and questionable websites (e.g., gambling, scam-promoting, adult dating, pornography, etc.).
In case of continuous encounters with advertisements and/or redirects of this kind, check the device and immediately remove all suspect applications and browser extensions/plug-ins. If your computer is already infected with the fake Google Sheets extension, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate this rogue software.
Deceptive website used to promote an installer containing this fake Google Sheets extension:
Fake Google Sheets extension on the Microsoft Edge browser:
Screenshot of fake Google Sheets extension's detailed information (Google Chrome):
Screenshot of fake Google Sheets extension's detailed information (Microsoft Edge):
Another variant of this fake extension named "Google Sheets Offline":
Removal steps for this fake Google Sheets browser extension:
Delete the installation folder of the fake Google Sheets extension – titled "Extension" – from the AppData\Local\Temp\ folder (i.e., delete C:\Users\[username]\AppData\Local\Temp\Extension).
Delete the appendix – --proxy-server="217.65.2.14:3333 (note that the IP address in it could differ) – from the target of Chrome/Edge browser's shortcut.
Video showing how to remove fake Google Sheets extension using Combo Cleaner:
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
Frequently Asked Questions (FAQ)
What harm can rogue extensions cause?
The functionalities possessed by rogue browser extensions and how they are used – determine the threats associated with their presence on a device. Unwanted extensions often operate as adware or browser hijackers.
This fake Google Sheets extension can display spam browser notifications, which are known to endorse deceptive/malicious content. It also has data-tracking abilities. Hence, the primary dangers linked to such software are system infections, privacy issues, financial losses, and identity theft.
How do rogue extension developers generate revenue?
As this fake Google Sheets browser extension has data-tracking functionalities, its developers could profit by selling or abusing the sensitive information collected through it. This software also displays browser notifications; hence, revenue might be made through content promotion.
How did a fake Google Sheets extension infiltrate my computer
This fake Google Sheets browser extension was promoted on a deceptive webpage using an adult-oriented lure. Note that it could be spread by relying on other sites/techniques as well. Generally, rogue software is distributed via bundled installers, online scams, freeware and free file-hosting websites, Peer-to-Peer sharing networks, spam browser notifications, and intrusive ads.
Will Combo Cleaner remove rogue software?
Yes, Combo Cleaner can scan devices and eliminate all unwanted/malicious software detected. Note that manual removal (unaided by security programs) might not be an ideal solution. In some cases, file leftovers remain hidden within the system – after the software has been manually removed. What is more, the remaining components might continue to run and cause issues. Therefore, thorough software removal is crucial.
Outstanding!
▼ Show Discussion