Avoid infecting your device via "Word Online Extension Is Not Installed"
Written by Tomas Meskauskas on
What kind of scam is "Word Online Extension Is Not Installed"?
"Word Online Extension Is Not Installed" is a scam designed to infect victims' devices with the DarkGate malware. This scheme was observed being promoted via spam emails instructing recipients to open their HTML attachments.
These files display fake pop-ups claiming that users cannot access Microsoft Word documents because they do not have the "Word Online" browser extension installed. In the process of fixing the bogus issue, victims are lured into infecting their systems with malware.
"Word Online Extension Is Not Installed" scam overview
At the time of research, this scam began with a spam email. Several versions of this mail, which relate to stationary item catalogs and operational guidelines, were discovered. However, other lures and promotional methods (aside from spam emails) are possible.
The scam letters are intended to trick recipients into opening their attachments. Once opened, the attached HTML documents display a fake pop-up window. It is presented as an alert regarding Microsoft Word documents. The "pop-up" claims that the "Word Online" extension is not installed on the browser, and if the user wishes to view the documents they are trying to access offline – they must click the "How to fix" button.
Doing so prompts a different hoax pop-up. It reiterates the information in the initial "window", and it instructs the user to open and run the Windows PowerShell. Essentially, what the scam is asking, is for the victim to execute a PowerShell script copied into their clipboard (copy-paste buffer).
This malicious script downloads an HTA format file from a C&C (Command and Control) server and runs it – thus initiating the download/installation process for DarkGate (more information on which can be found in our article on this malware). The clipboard is also cleared of the command, possibly to hide the origin of the infection.
It is pertinent to mention that "Word Online Extension Is Not Installed" could be used to spread other malicious software aside from DarkGate.
To summarize, victims of malware-spreading scams can experience multiple system infections, data loss, severe privacy issues, significant financial losses, and identity theft.
If you suspect that your device is already infected, we advise performing a full system scan with an anti-virus and eliminating all threats without delay.
| Name | "Word Online Extension Is Not Installed" fake pop-up file |
| Threat Type | Phishing, Scam, Social Engineering, Trojan, Malware |
| Fake Claim | Documents cannot be viewed because "Word Online" browser extension is not installed. |
| Detection Names | Avast (Other:SNH-gen [Phish]), Combo Cleaner (Trojan.GenericKD.72701686), ESET-NOD32 (HTML/Phishing.Agent.FLO), Kaspersky (HEUR:Trojan.Script.DarkGate.gen), Microsoft (Trojan:JS/Darkgate.RVA!MTB), Full List Of Detections (VirusTotal) |
| Payload | DarkGate |
| Symptoms | The scam itself is identifiable by its fake Microsoft Word alert, but malware infections do not have such obvious symptoms. Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Infected email attachments, malicious online advertisements, social engineering. |
| Damage | Malware infections, stolen passwords and banking information, identity theft, the victim's computer added to a botnet. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Similar scam example
"Please Install The Root Certificate" is a scam that operates in the same manner as "Word Online Extension Is Not Installed". However, the former is promoted on the Web rather than via email. Both spam campaigns and malicious websites are prevalent in malware distribution.
Therefore, being vigilant with incoming messages and when browsing is paramount to device/user safety.
How did I encounter "Word Online Extension Is Not Installed"?
The HTML files that show "Word Online Extension Is Not Installed" have been noted being proliferated via spam emails. As described previously, the infection occurs when victims are deceived into following the instructions given by said documents.
However, these files could be distributed using other methods. For example, they could be hosted on malignant sites (or the files could be forgone, and the instructions be provided by the webpages). They are most often accessed via redirects generated by websites using rogue advertising networks, intrusive ads, search engine poisoning techniques, spam browser notifications, mistyped URLs, and installed adware.
Phishing and social engineering tactics are standard in malware proliferation. Aside from spam campaigns and malicious pages, malware is commonly spread through other dubious download channels (e.g., Peer-to-Peer sharing networks, third-party downloaders, etc.), pirated programs/media, illegal software activation tools ("cracks"), and fake updates.
Furthermore, some malicious programs can self-proliferate via local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).
How to avoid installation of malware?
Caution is key to computer safety. Therefore, treat incoming emails, PMs/DMs, and other messages with care. Do not open attachments or links found in suspicious mail, as they can be infectious. And be vigilant when browsing since fake and malicious online content usually appears genuine and innocuous.
Additionally, download only from official and verified channels. Activate and update software using legitimate functions/tools, as those obtained from third-parties can contain malware.
It is paramount to have a reputable anti-virus installed and kept up-to-date. Security programs must be used to run regular system scans and to remove threats and issues. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.
Text presented in "Word Online Extension Is Not Installed" scam file's first fake pop-up window:
Create, edit and share Word documents. Work with others on shared projects, in real-time.
The "Word Online" extension is not installed in your browser. To view the document offline, click the "How to fix" button.
[How to fix] [Details]
Screenshot of "Word Online Extension Is Not Installed" scam file's second fake pop-up window:
Text presented in this fake pop-up:
Create, edit and share Word documents. Work with others on shared projects, in real-time.
The "Word Online" extension is not installed in your browser. To view the document offline, click the "How to fix" button.
1. Right-click the Start button and run "Windows PowerShell" ("Windows Terminal").
2. Right-click in the console window.
Wait for the operation to complete and reload the page.
[How to fix] [Details]
Appearance of the "Word Online Extension Is Not Installed" scam (GIF):
Screenshots of spam emails promoting the "Word Online Extension Is Not Installed" scam files:
Text presented in this email:
Subject: RE: TT INSTRUCTIONS AND INDEMNITY #277
Good day., The enclosed file includes a comprehensive catalog of stationery items acquired for our department for the latter half of the year. It's essential for our daily operations. Your prompt processing of this expense will guarantee we maintain an adequate stock. Regards
Text presented in this email:
Subject: May-Year 2024 (Upto 13.05.2024) Musters.
Operational guidelines for review
Included, you will find the operational guidelines for the recently imple=ented system.
Please examine and provide your recommendations.
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is "Word Online Extension Is Not Installed"?
- STEP 1. Manual removal of malware.
- STEP 2. Check if your computer is clean.
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.
If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.
Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".
Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".
In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.
These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.
Frequently Asked Questions (FAQ)
What is "Word Online Extension Is Not Installed" scam?
"Word Online Extension Is Not Installed" is a scam promoted via spam emails. The letters include attachments, which imitate Microsoft World alerts claiming that the files cannot be accessed. The attached documents instruct victims into rectifying the nonexistent issue by executing a PowerShell command, which initiates the infection chain for DarkGate malware.
What is the purpose of scams?
In short, the purpose of "Word Online Extension Is Not Installed" is to proliferate malware. The end goal of most scams is to generate revenue for cyber criminals. Aside from spreading malicious software, this can be achieved by deceiving victims into sending money to scammers, disclosing private information, downloading/installing software, purchasing products, subscribing to services, allowing criminals to access devices remotely, and so forth.
I have read a spam email but didn't open the attachment, is my computer infected?
No, reading an email is harmless. Infection processes are triggered when malicious attachments or links are accessed. Some virulent files begin downloading/installing malware once they are opened. While others need additional user interaction. This is true of the "Word Online Extension Is Not Installed" files that include instructions, completing which initiates the infection chain.
My computer is infected with malware, should I format my storage device to get rid of it?
Malware removal rarely necessitates formatting.
What are the biggest issues that malware can cause?
The threats posed by an infection depend on the malware's capabilities and the cyber criminals' modus operandi. Generally, high-risk software can cause severe privacy issues, significant financial losses, and identity theft.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner is designed to scan systems and eliminate all kinds of threats. It is capable of detecting and removing most of the known malware infections. It must be stressed that performing a complete system scan is essential since sophisticated malicious programs tend to hide deep within systems.
Outstanding!
▼ Show Discussion