FacebookTwitterLinkedIn

Removal instructions for the fake Google Sheets browser extension

Also Known As: Fraudulent Google Sheets browser extension
Damage level: Medium

What kind of software is this fake Google Sheets extension?

Our research team discovered this fake Google Sheets browser extension while inspecting deceptive sites. This piece of rogue software is disguised as a spreadsheet app that is part of the web-based Google Docs Editors suite. It must be emphasized that this extension is not associated with Google Sheets, Google Docs Editors, or Google LLC.

Upon examination, we determined that this fraudulent extension collects sensitive data, displays browser notifications, and potentially performs other harmful activities.

fake Google Sheets browser extension on Google Chrome

Fake Google Sheets browser extension overview

When we executed the setup containing this fake Google Sheets extension, it also installed other unwanted and potentially malicious software onto our testing system.

This illegitimate extension was not installed onto either the Google Chrome or Microsoft Edge browsers. Instead, this installer dropped the extension's folder – titled "Extension" – into the "C:\Users\[username]\AppData\Local\Temp\" folder.

This manner of installation is a persistence-ensuring technique since eliminating the fraudulent Google Sheets extension from Chrome/Edge will not get rid of it. Hence, after standard removal, this software will reappear when the browser is opened again.

Additionally, having this extension on a device modifies the Chrome/Edge browser's shortcut. The target has ""--proxy-server="217.65.2.14:3333"" added to it (note that the IP address in this appendix may vary). Steps for how to remove this software can be found below.

Another mechanism used by this fake Google Sheets browser extension is utilizing the "Managed by your organization" feature on Google Chrome and Microsoft Edge.

The extension also spies on users' browsing activity. Malicious extensions typically collect browsing and search engine histories, downloads, Internet cookies, log-in credentials (usernames/passwords), finance-related data, etc. This vulnerable information can be sold to third-parties or otherwise abused for profit.

Furthermore, this rogue extension can deliver browser notification spam. These ads commonly endorse online scams, unreliable/hazardous software, and even malware. What is more, the browser extension in question could possess other harmful capabilities.

To summarize, the presence of software like this fake Google Sheets extension can lead to system infections, serious privacy issues, financial losses, and identity theft.

Threat Summary:
Name Fraudulent Google Sheets browser extension
Threat Type Malicious Extension, Unwanted Extension
Browser Extension(s) Google Sheets
Detection Names (installer) N/A (VirusTotal)
Symptoms The "Managed by your organization" feature is activated in Chrome or Edge browser, decreased Internet browsing speed, spam notifications are displayed, your computer becomes slower than usual.
Distribution Methods Dubious websites, malicious installers, deceptive pop-up ads, free software installers (bundling), torrent file downloads.
Damage Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites, possible additional malware infections.
Malware Removal (Windows)

To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.
▼ Download Combo Cleaner
To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Similar software examples

We have written about thousands of unwanted browser extensions. They usually appear harmless, and some even imitate existing software. We have discovered several rogue extensions that impersonate Google products/services, e.g., "Google Drive", "Chrome", "Google Translate", "Google Docs", etc.

Most malicious extensions have data-tracking functionalities, and many exhibit adware or browser-hijacking abilities. Keep in mind that regardless of how genuine or useful a piece of software appears – that does not mean that it is. Likewise, remember that operational features alone do not prove a software's legitimacy or safety.

How did this fake Google Sheets extension install on my computer?

We downloaded the setup containing this fake Google Sheets extension (and other unwanted software) from a scam page using an adult-themed lure. However, this software could be pushed using other websites/methods.

Extensions of this kind are promoted on various scam sites and legitimate-looking download webpages. They are primarily entered via redirects caused by intrusive ads, websites using rogue advertising networks, misspelled URLs, spam browser notifications, and adware.

Another potential distribution technique is bundling, which involves packing ordinary program installers with unwanted/malicious supplements.

The threat of inadvertently allowing bundled content into the device is increased by downloading from dubious channels (e.g., freeware and free file-hosting sites, P2P sharing networks, etc.) and by treating installations with negligence (e.g., ignoring terms, skipping steps/sections, using "Quick/Easy" settings, etc.).

Additionally, intrusive advertisements proliferate rogue software. Once clicked on, some of these adverts can execute scripts to perform sneaky downloads/installations.

How to avoid installation of rogue software?

We highly recommend researching software prior to downloading/purchasing. All downloads must be made from official and verified sources. Installation processes have to be approached with caution, e.g., by reading terms, studying available options, using the "Custom/Advanced" settings, and opting out of all additional apps, extensions, tools, features, etc.

We also advise vigilance while browsing, as fraudulent and malicious online content usually appears legitimate and harmless. For example, while intrusive ads may look innocuous – they redirect users to unreliable and questionable websites (e.g., gambling, scam-promoting, adult dating, pornography, etc.).

In case of continuous encounters with advertisements and/or redirects of this kind, check the device and immediately remove all suspect applications and browser extensions/plug-ins. If your computer is already infected with the fake Google Sheets extension, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate this rogue software.

Deceptive website used to promote an installer containing this fake Google Sheets extension:

Website promoting fake Google Sheets browser extension

Fake Google Sheets extension on the Microsoft Edge browser:

fake Google Sheets browser extension on Edge

Screenshot of fake Google Sheets extension's detailed information (Google Chrome):

fake Google Sheets browser extension details (Chrome)

Screenshot of fake Google Sheets extension's detailed information (Microsoft Edge):

fake Google Sheets browser extension details (Edge)

Another variant of this fake extension named "Google Sheets Offline":

Fake Google Sheets Offline extension

Removal steps for this fake Google Sheets browser extension:

Fake Google Sheets extension install folder (titled Extension)

Delete the installation folder of the fake Google Sheets extension – titled "Extension" – from the AppData\Local\Temp\ folder (i.e., delete C:\Users\[username]\AppData\Local\Temp\Extension).

Chrome/Edge shortcut target modified by fake Google Sheets extension

Delete the appendix – --proxy-server="217.65.2.14:3333 (note that the IP address in it could differ) – from the target of Chrome/Edge browser's shortcut.

Video showing how to remove fake Google Sheets extension using Combo Cleaner:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

Frequently Asked Questions (FAQ)

What harm can rogue extensions cause?

The functionalities possessed by rogue browser extensions and how they are used – determine the threats associated with their presence on a device. Unwanted extensions often operate as adware or browser hijackers.

This fake Google Sheets extension can display spam browser notifications, which are known to endorse deceptive/malicious content. It also has data-tracking abilities. Hence, the primary dangers linked to such software are system infections, privacy issues, financial losses, and identity theft.

How do rogue extension developers generate revenue?

As this fake Google Sheets browser extension has data-tracking functionalities, its developers could profit by selling or abusing the sensitive information collected through it. This software also displays browser notifications; hence, revenue might be made through content promotion.

How did a fake Google Sheets extension infiltrate my computer

This fake Google Sheets browser extension was promoted on a deceptive webpage using an adult-oriented lure. Note that it could be spread by relying on other sites/techniques as well. Generally, rogue software is distributed via bundled installers, online scams, freeware and free file-hosting websites, Peer-to-Peer sharing networks, spam browser notifications, and intrusive ads.

Will Combo Cleaner remove rogue software?

Yes, Combo Cleaner can scan devices and eliminate all unwanted/malicious software detected. Note that manual removal (unaided by security programs) might not be an ideal solution. In some cases, file leftovers remain hidden within the system – after the software has been manually removed. What is more, the remaining components might continue to run and cause issues. Therefore, thorough software removal is crucial.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Removal Instructions in other languages
Software uninstall instructions
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Fraudulent Google Sheets browser extension QR code
Scan this QR code to have an easy access removal guide of Fraudulent Google Sheets browser extension on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

▼ REMOVE IT NOW
Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.