How To Detect and Remove the Chrome.exe Virus

To hide their malware, cybercriminals created the Chrome.exe virus, also known as the Poweliks Trojan. Since the malware appears to be a real application, you don’t realize your device has been infected. To remove Chrome malware, you should install a highly-rated antivirus program that scans your device and quarantines the infected process. 

This type of fileless malware is the cybercriminal version of Obi-Wan Kenobi telling Stormtroopers, “These aren’t the droids you’re looking for.” You can expect to see the Chrome.exe process in your Task Manager if you're using Google Chrome. Meanwhile, the Chrome.exe that’s running is really the malware you want to remove.

Keep reading our Chrome.exe virus removal guide for step-by-step instructions.

How to identify the Chrome.exe virus

Although the Trojan malware “Jedi mind trick” can sound scary, you can still use Google Chrome without worrying too much. By understanding the differences between legitimate Chrome.exe and the Poweliks Chrome.exe virus, you can identify a virus infection and keep using your favorite browser.

What is your computer doing?

Poweliks uses the same name as your browser’s executable file, but your computer will act differently. You can look for the following symptoms to diagnose your computer with the virus:

• Your computer is slow.
• You see a lot of pop-up ads when browsing.
• You see ads from websites you’ve never visited.
• You can’t access websites.
• Your browser won’t let you download files.
• You find suspicious browser extensions you haven't installed.

How much memory is your browser using?

Just like you need to check for symptoms that differentiate strep and the common cold, you want to look for additional digital symptoms to determine whether your computer has a dangerous infection. Other indicators of the Chrome.exe virus might include high CPU usage. You should also check for the following:

1. Open Windows Task Manager to see which programs are running, and look for Chrome.exe*32.
2. You may see multiple versions of the Chrome.exe file. This is the first hint that your computer is infected.
3. Review the Memory column in Windows Task Manager for Chrome.exe*32.
4. If you have many tabs open, close them to see if that reduces Chrome's memory usage.

What processes should you look for?

If Chrome is still using a lot of memory, you now need to start thinking about the final definitive test. Just like you’d go to the doctor to get a throat culture for strep, it’s time for you to take a full look at your device. Although Poweliks looks like Google Chrome, it has some unique characteristics. Going back to your Task Manager, you need to look for the following processes:

• dllhost.exe *32
• dllhst3g.exe *32
• DLLHOST.exe
• dllhst3g.exe

What other files should you look for?

Finally, you might want to search your file folders for Chrome.exe*32. To do this:

1. Open your Task Manager.
2. Right-click on the Chrome.exe*32 process.
3. Open the file location.

The only file location where you should find the Chrome.exe*32 file is this directory:

C:\Program Files (x86)\Google\Chrome\Application

If you find the file anywhere else, you have a Poweliks infection.

How to remove the Chrome.exe Virus

Although it might take you some time to locate the Chrome.exe virus, you don’t need to buy a new device. You can remove the virus by taking the following steps:

1. Install and update antivirus software

The Chrome.exe virus is just the beginning of the problem. With malware like Poweliks, you have to worry about the additional malware that it downloads, launches, and updates. With all these other files, you either need advanced IT skills or antivirus software.

Start by finding the best antivirus software. Although most antivirus software should be able to detect Poweliks, the following have specific detections for it:

TotalAV is cost-effective, user-friendly, and includes the antivirus essentials you need, including scans, protection against phishing, ransomware, malicious apps and extensions, and more. It even offers a free version, so you can always keep your device protected and try it out risk-free before committing.

Norton is more than just an antivirus; it also offers comprehensive cybersecurity suites. It has no shortage of features, including identity theft protection, parental controls, and a VPN.

With excellent protection scores, friendly customer service, and a full range of security features, Bitdefender is a great choice for protecting your device from malware. When we tested it, it had no impact on our system performance.

A well-known and well-regarded name in the antivirus industry, McAfee also scored well in third-party protection tests. Along with a firewall, it also includes phishing protection, parental controls, and a file shredder. We especially like that its cheapest plan, Antivirus Basic, still includes a firewall, password manager, VPN, and identity monitoring.

2. Run an antivirus scan

After installing an antivirus program or antimalware tool, run a full system scan. To do this, you should:

1. Open the solution’s dashboard or main window.

2. Look for System Scan.

3. Click Start Scan.

4. Once the antivirus completes the scan, you can review the report that looks like this:

3. Delete corrupted files

Your antivirus will automatically quarantine the virus’s files. Many will also delete them, but if yours doesn’t, you may want to find a malware removal tool compatible with your operating system. For example, Malwarebytes works on both Mac and Windows, making it a good option if your household has devices running both.

These solutions usually delete all the corrupted files for you. For example, in Malwarebytes, you would see this type of report:

4. Restart your computer and scan again

As you would on a math test, double-check your work. Cybercriminals don’t want you to be able to remove malware, so they build persistence into it.

Restarting your computer stops all running processes, clears your device’s memory, and clears the cache. You want to make sure you start with a clean slate after removing the Trojan.

Since malware processes run automatically as soon as you log in, running another antivirus scan ensures everything is cleaned up.

5. Reset your browser settings

After you've cleaned Chrome.exe off your device, you should also take steps to remove any Chrome malware from your browser. You can do this by resetting your browser settings.

1. Open Google Chrome.
2. Click on the three dots in the top-left corner and select Settings.
3. Select Reset settings on the left-hand side of the Chrome settings. 
4. Click Restore settings to their original defaults.
5. From the pop-up, click Reset settings to confirm.

You can also remove any suspicious browser extensions directly from Chrome. 

What is the Chrome.exe virus?

The Chrome.exe virus, or Poweliks Trojan, is a Trojan horse malware that masquerades as a legitimate program to evade detection. The ".exe" means it's an executable file. When someone clicks on the file, it gives the computer instructions about what to do next.

When a user clicks on the file to open it, it triggers a series of actions:

• The Poweliks downloader installs on the device.
• The Microsoft Windows registry stores the file under the name Chrome.exe.
• The installer deletes itself.

Because the malware, disguised as Google Chrome, installs in the Windows registry rather than on the hard drive, antivirus tools struggle to detect it.

Once installed, the virus can:

• Read your emails
• Access your phone contacts
• Establish connections with hidden websites
• Create, modify, or remove files or processes
• Collect and send system information
• Perform click fraud, or generate multiple clicks on advertisements to generate more revenue
• Download additional malware
• Be controlled by a cybercriminal

5 ways to avoid malware infections

Just as taking your Vitamin C helps your immune system protect you against colds and strep, you can also take steps to protect your information and devices. Learning how to stay safe online is the protective vitamin for your digital health.

1. Update your devices and software

In the case of Poweliks and other downloader malware, the danger lies in its ability to control the device and install other malicious software. Typically, malware exploits vulnerabilities, weaknesses in an operating system or software’s code.

Software and operating updates fix these weaknesses, so installing security patches is a critical cybersecurity step.

2. Secure your wireless network

By securing your wireless network, you can protect your devices from different types of attacks, including malware. To secure your network, you can edit your router’s settings to:

• Encrypt it using Wi-Fi Protected Access 2 (WPA2).
• Change the default password.
• Update firmware to protect against vulnerabilities.
• Scan your router for malware.

You should also consider using a virtual private network (VPN) to further secure your Wi-Fi connection — especially when connecting to public Wi-Fi. A VPN makes it harder for hackers to target your device with malware by disguising your IP address. During our testing, these top VPN apps stood out from the rest:

The best VPN apps for securing your Wi-Fi network

3. Be careful when downloading files

Poweliks is considered fileless malware because it installs in the registry rather than the system. However, cybercriminals typically hide the malware in malicious documents, either sent by email or downloadable from a malicious website.

To protect against the Chrome.exe virus, you should only download attachments or files when you can trust the sender or website.

4. Change your passwords

To protect yourself, use a unique password for each login. After you delete any malware from your device, you should reset all your passwords. Some malware, such as Poweliks, can download and install a virus that steals usernames and passwords.

5. Use an antivirus

When you install antivirus software on your device, it regularly scans for, detects, and deletes malware. With this protection, you don’t have to worry about looking for signs that a virus infected your device. 

Even Macs and Chromebooks should have some form of antivirus protection. If you're missing this key form of protection, check out our guide to the best antivirus software for recommendations.

Bottom line

For most people, a virus like Poweliks can feel overwhelming. However, the good thing about technology is that you don’t have to be an IT expert to fix most things. When you have a good antivirus and learn about online safety, you can prevent most cyberthreats and continue doing everything you enjoy online.

FAQs