I’m struggling with a browser extension named ‘YOfficeStop’ that persists across all browsers on my Windows 7 system. Despite deleting the source and uninstalling browsers, it reinstalls itself upon every restart. I’ve checked startup processes but found nothing suspicious. Below is the manifest.json of the extension:
JSON
{
"name": "YOfficeStop",
"version": "6.89",
"description": "Office Stop",
"permissions": [
"storage",
"webRequest",
"webRequestBlocking",
"http://*/",
"https://*/",
"management",
"notifications"
],
"background": {
"scripts": ["background.js"]
},
"browser_action": {
"default_icon": "icon128.png"
},
"manifest_version": 2,
"minimum_chrome_version": "35"
}
files are located at C:\ProgramData\Bvtl\Uyfnruq\AACB5D4D:
[Tags]
ExtName=YOfficeStop
ExtVer=6.89
ExtDesc=Office Stop
UserId=18ae074a616ecc94f30f67e696f6a58f