How to Remove Adware Injected by a Chrome Extension in Windows 11

Pop-up ads appear on every site, your search engine has changed on its own, or a strange new-tab page has taken over Chrome, and you’ve traced it to an extension. To remove adware from a Chrome extension on Windows 11, work in this order: remove the extension, kill whatever keeps reinstalling it, reset Chrome, recheck your settings, scan with Microsoft Defender, and then secure your Google account.

Signs a Chrome Extension Is Injecting Adware

Look for these symptoms. They point to an extension rather than a single bad website:

• Ads, banners, or pop-ups appear on sites that never carry ads, such as Wikipedia or your bank.
• Searches from the address bar go through an unfamiliar search engine before showing results.
• Your homepage or new-tab page changed, and changing it back doesn’t stick.
• Product links on shopping sites are rewritten or redirect through odd domains.
• Chrome shows “Managed by your organization” in the three-dot menu on a personal PC.

Quick test: Open an Incognito window with Ctrl + Shift + N. Chrome doesn’t run extensions in Incognito unless you’ve turned on Allow in Incognito for them in the extension’s Details. If the ads disappear there, an extension is the likely cause. Treat this as a strong hint rather than proof, because some sites also serve different ads to Incognito visitors. If the ads still show, or they show up as Windows notifications at the bottom-right of your screen, a website notification permission is more likely to blame (Fix #4 covers that).

If you need help working out which extension is the bad one, see How to Spot a Fake or Malicious Chrome Extension Before You Install It.

Before You Begin

• Windows 11 PC with Google Chrome for desktop
• An administrator account, which you need to uninstall programs and run full or offline Defender scans
• About 30–60 minutes, because a full scan can take a while
• Your Google account password and second-factor device for Fix #6
• Any open work saved, because the offline scan restarts your PC

Requirement	Details
Device	Windows 11 PC
Browser	Google Chrome (desktop)
Security tools	Windows Security / Microsoft Defender Antivirus (built in, free)
Account	Google account for the final securing step

Step-by-Step Cleanup Checklist

Do these fixes in order. If you reset Chrome before you remove the program that reinstalls the extension, the adware comes straight back.

Fix #1: Remove the Extension

• Open Chrome and click the three-dot menu in the top-right corner.
• Select Extensions > Manage extensions. You can also type chrome://extensions in the address bar.
• Find the extension you don’t recognize or installed just before the ads began. Click Details to check its permissions. Be wary of anything that can “Read and change all your data on all websites.”
• Click Remove on that extension’s card, then click Remove again to confirm.

• Repeat for any other extension you don’t recognize. Adware often installs in pairs.

Expected result: The extension disappears from the list and from the toolbar. If an extension has no Remove button, or it says “Installed by your administrator,” go straight to Fix #2. (Google: Manage extensions)

Fix #2: Check for “Managed by Your Organization” and Leftover Programs

Adware often comes bundled with a Windows program or sets a Chrome policy that forces the extension back on. Chrome then reports itself as “managed,” even on a home PC. If this is a work or school computer, check with your IT department before removing programs or policies, because those settings are usually intentional.

Uninstall leftover Windows programs

• Open Settings > Apps > Installed apps.
• Set Sort by to Install date so the newest programs appear first.
• Look for anything installed around the time the ads started. Common examples are “PDF converters,” “search helpers,” or free utilities you don’t remember choosing.
• Click the three-dot menu next to it and select Uninstall, then confirm.

Check Chrome policies

• In Chrome’s address bar, type chrome://policy and press Enter.
• On a personal PC that no school or employer manages, this page is often empty or shows only a few entries. Some legitimate software, such as security tools, can also set policies, so look up an unfamiliar entry before assuming it’s adware. Note any unfamiliar entries, especially ExtensionInstallForcelist, DefaultSearchProviderSearchURL, HomepageLocation, or RestoreOnStartupURLs.
• Click Reload policies after you uninstall the bundled program. Policies created by that program often disappear once it’s gone, but policies can also come from Group Policy, registry values, scheduled tasks, or legitimate management software, so don’t assume every entry is adware.

Expected result: The policy page no longer lists unfamiliar entries, and “Managed by your organization” disappears from the three-dot menu after you restart Chrome. If entries remain, the Defender scan in Fix #5 may remove the software behind them. If they still survive, see the registry tip under Tips and Troubleshooting. (Google: Chrome policies)

Fix #3: Reset Chrome Settings to Defaults

A reset reverses the changes the extension made to your search engine, startup pages, and new tab.

• Open Chrome and go to the three-dot menu > Settings > Reset settings. You can also type chrome://settings/reset in the address bar.
• Click Restore settings to their original defaults.
• Click Reset settings in the confirmation dialog.

What a reset changes: It restores the default search engine, homepage, startup pages, new tab, and pinned tabs. It also resets site permissions, clears cookies and temporary data, and turns off all extensions.

What it keeps: Your bookmarks and saved passwords.

Afterward, go back to Manage extensions and turn back on only the extensions you trust. For more detail, see How to Reset Google Chrome to Default Settings.

Fix #4: Check Search Engine, Startup Pages and Site Permissions

Confirm the reset stuck and close off the notification route that some adware uses.

• Go to Settings > Search engine. Confirm your chosen search engine is selected. Then click Manage search engines and site search and delete any entry you don’t recognize. Some entries are built-in defaults or shortcuts you added yourself, so only remove ones you’re sure you didn’t set up.
• Go to Settings > On startup. Make sure no unfamiliar URL is listed.
• Go to Settings > Privacy and security > Site settings > Notifications. Under Allowed to send notifications, remove any site you don’t recognize.
• Go to Site settings > Additional content settings > Intrusive ads. Select the option that blocks ads on sites known to show intrusive or misleading ads.

Expected result: Searches go straight to your normal engine, and you no longer get ad pop-ups in the Windows notification area.

Fix #5: Scan Windows With Microsoft Defender

A scan catches anything the program uninstall missed, including potentially unwanted apps (PUAs). Microsoft flags those separately from traditional malware. (Microsoft: Protect your PC from unwanted software)

Run a full scan

• Open Start, type Windows Security, and open it.
• Go to Virus & threat protection. Under Virus & threat protection updates, click Protection updates > Check for updates.
• Return to Virus & threat protection and click Scan options.
• Select Full scan, then click Scan now.

You can also run both steps from an admin PowerShell window:

Update-MpSignature
Start-MpScan -ScanType FullScan

Run an offline scan

• Go back to Virus & threat protection > Scan options.
• Select Microsoft Defender Antivirus (offline scan) and click Scan now, then confirm with Scan.
• Your PC restarts and scans before Windows loads. The scan time varies by PC, so expect it to take a while. You’ll find the results under Protection history after you sign back in.

The PowerShell equivalent is Start-MpWDOScan. For more detail, see How to Run a Microsoft Defender Offline Scan on Windows 11. (Microsoft: Virus & threat protection)

Expected result: Protection history lists anything the scans detected and what Defender did about it. If a detection says Action needed, open it and choose from the actions it offers, such as Remove or Quarantine.

Fix #6: Secure Your Google Account

Do this last, after the scans come back clean, so any leftover malware can’t capture your new password. An extension that could “read and change all your data” may have been able to see what you typed into forms on the pages it could access while it was installed. That doesn’t prove it took your password, but it’s safest to assume it might have. If you aren’t sure the PC is clean, do the password changes in steps 4 and 5 from another device you trust, such as your phone.

• Go to myaccount.google.com/security-checkup and sign in.
• Review Your devices and Recent security activity. Click Sign out on any device you don’t recognize.
• Review Third-party connections and remove access for any app you don’t recognize.

• Go to Security > Password and change your Google password.
• In Chrome, open Google Password Manager > Checkup and change any reused or compromised passwords. Start with banking and email.

To check what the extension may have accessed, see Is a Chrome Extension Stealing Your Data? Here’s How to Check.

Configuration: Settings Worth Keeping On

Setting	Where	Recommended
Potentially unwanted app blocking	Windows Security > App & browser control > Reputation-based protection settings	On, with both Block apps and Block downloads checked
Smart App Control	Windows Security > App & browser control	On, if your device offers it
Enhanced protection	Chrome Settings > Privacy and security > Security	On
Intrusive ads	Chrome Site settings > Additional content settings	Blocking option selected

Smart App Control availability depends on how Windows 11 was installed on your PC. (Microsoft: App & browser control)

Tips and Troubleshooting

The extension keeps coming back. A Windows program or Chrome policy is reinstalling it. Repeat Fix #2, then run the offline scan. If chrome://policy still lists forced extensions after both, the leftover keys are usually under HKLM\SOFTWARE\Policies\Google\Chrome (or the same path under HKCU). Only edit these if you’re comfortable in Registry Editor, and back up the key first. Delete only the values that match the extension or settings you identified on chrome://policy, and leave anything you don’t recognize alone.

Ads continue after you remove the extension. Check for a second extension and review notification permissions (Fix #4). Then check Windows Security > Virus & threat protection > Protection history for unresolved PUAs.

Chrome is too ad-covered to use. Close it with Task Manager (Ctrl + Shift + Esc). Then press Win + R and run chrome --disable-extensions to open Chrome with all extensions off while you clean up.

A trusted extension stopped working. The reset turned it off. Turn it back on in Manage extensions.

You want a second opinion. Run a free Malwarebytes scan after the Defender scan. It’s optional, but it sometimes catches adware leftovers that Defender rates as low-risk.

How to Avoid Malicious Extensions Next Time

• Install extensions only from the Chrome Web Store, and check the developer, the review count, and recent reviews.
• Read the permission prompt. A coupon or wallpaper extension doesn’t need access to every website.
• Choose Custom install in free Windows software and untick any bundled “offers.”
• Use a dedicated password manager such as Bitwarden or 1Password instead of saving everything in the browser.
• Add a hardware security key, such as a YubiKey, to your Google account so a stolen password alone isn’t enough to sign in.

FAQ

How do I know an extension, not a website, is causing the ads? Open the same site in an Incognito window. If the ads vanish, an extension is likely the cause, though it’s a strong hint rather than proof. Ads that appear on every site point to an extension too. Ads that appear as Windows notifications come from a site’s notification permission.

Why does the extension keep coming back after I remove it? A bundled Windows program or a Chrome policy is reinstalling it. Uninstall the program, check chrome://policy, and run a Defender offline scan.

What does “Managed by your organization” mean, and should I worry? It means a policy is controlling Chrome. On a work or school PC, that’s normal. On a personal PC, it usually means software set those policies, and you should follow Fix #2.

Does resetting Chrome delete my bookmarks or saved passwords? No. Your bookmarks and saved passwords aren’t deleted. It does clear cookies and site data, so you’ll need to sign back in to websites.

Do I need to run both a regular and an offline Defender scan? Run the full scan first. Run the offline scan if the full scan finds anything or if the extension keeps returning. The offline scan runs before Windows loads, so malware has a harder time hiding from it.

Could the extension have stolen my Google password? It’s possible if it had permission to read data on all sites, though that permission alone doesn’t prove it did. Change your password once the scans are clean and review your security checkup.

Wrapping Up

Removing the extension and resetting Chrome stops the ads for most people. Fix #2 matters most if the adware keeps coming back, because a bundled Windows program is almost always the cause. If the ads return after a clean offline scan, or Defender keeps finding new threats, treat the PC as compromised. Back up your files to an external drive and do a fresh Windows 11 install.

Step	Action	Applies To
1	Remove the extension	Chrome
2	Uninstall bundled programs, check chrome://policy	Windows 11 + Chrome
3	Reset Chrome settings	Chrome
4	Verify search, startup, and site permissions	Chrome
5	Full and offline Defender scans	Windows 11
6	Security checkup and password change	Google account

Resources

Official sources, retrieved October 5, 2026:

• Manage your extensions in Chrome
• Manage Chrome policies (chrome://policy)
• Protect your PC from unwanted software (Microsoft)
• Virus and threat protection in the Windows Security app
• App & browser control in the Windows Security app
• Google Account Security Checkup