How to remove "Media Player 1.1" adware extension

Media Player 1.1 is a malicious adware extension, that displays adware pop-ups, links & texts inside your browser. “Media Player 1.1” can be installed on common Internet browsers, Internet Explorer, Mozilla Firefox, Google Chrome in order to display advertisements from unknown publishers and earn money. 

The “Media Player 1.1” extension (Add-on) is tricky to be removed from your browser because is installed automatically every time your browser is starting up via enterprise policies. “Media Player 1.1” is probably installed on your computer after you download and install other free software from the Internet.

Note: You must always pay attention when you install software on your computer.

If you want to easy remove Media Player 1.1. from your Internet browser, follow the steps below:

media-player-1.1-adware[3]

 

How to remove Media Player 1.1 Adware extension from your computer:

Step 1. Uninstall Media Player program from your Control panel.

1. To do this, go to:

  • Windows 8/7/Vista: Start > Control Panel.
  • Windows XP: Start > Settings > Control Panel

start-control-panel

2. Double click to open

  •  Add or Remove Programs if you have Windows XP
  • Programs and Features if you have Windows 8, 7 or Vista.

add-remove-programs_thumb1

3. In the program list, find and remove/Uninstall any of these applications:

  • Media Player
  • Media Server 1.1
  • Video Player
  • * Also uninstall any other unknown or unwanted application.

uninstall-media-player-1.1

 

Step 2. Find the malicious Chrome Policy value

1. Open Google Chrome and at the “URL Address Bar” type: chrome://policy  & press “Enter”.

chrome-policy

2. At Policies window press the “Show Value” button.

gctlftzm

3. Now “Copy” the path of the malicious folder extension.

e.g. “C:/ProgramData/dgoiddfiaigjfjblblmidmpgokkegkld

gybhmzrk

4. Open Windows Explorer and  “Paste” the copied path in the address bar.

qi4zxvue

5. Press “Enter” to navigate to that path:

uddggnac

6. Click with your mouse at the parent folder: e.g. “C:\ProgramData

ydou3mlp

7. Finally delete the malicious folder (e.g. “dgoiddfiaigjfjblblmidmpgokkegkld”) from there.

25voovhy

Step 3: Delete “Registry.Pol” file.

Notice: You must enable the hidden files view to perform this  task.

 

1. Open Windows Explorer & navigate to the following path: C:\Windows\System32\GroupPolicy

system32-grouppolicy

2. In “C:\Windows\System32\GroupPolicy” folder you will find the two (2) following folders:

  1. Machine
  2. User

Registry.pol[3]

3.  Open both folders (Machine & User) and delete any file named “Registry.pol” in them.

e1fkmvyl

 

Step 4. Remove “Media Player 1.1” extension from Chrome.

1. Download and run CCleaner.

2. At “CCleaner” main window, choose "Tools" on the left pane.

ccleaner-tools

3. In "Tools" section, choose "Startup".

ccleaner-startup

4. Choose the "Chrome” tab.

s11s5pm3_thumb1

5. Right-click at the unwanted extension in the list and choose “Open Containing Folder

5vfpnkbn_thumb1

6. Note the folder name where the unwanted extension is running from:

wkjtpkhg_thumb1

7. Press the “Up” button to navigate to the parent folder.

Windows XP:

C:\Documents and Settings\<USERNAME>\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions

zdbvmibo_thumb1

Windows 8,7 & Vista Users: Click at the parent folder:

C:\Users\\<USERNAME>\AppData\Local\Google\Chrome\User Data\Default\Extensions\

hpai4kgj_thumb1

8. Delete the unwanted folder.

mvyf4n0t_thumb1

9. Return to CCleaner & delete the unwanted extension from the list.

remove-chrome-extension-ccleaner

10. Finally look at “Scheduled Tasks” tab and delete from there any unwanted or suspicious entry found.*

* Personally, I prefer to delete from “Scheduled Tasks” any task (entry) that executes any application from the user’s “Downloads” folder or from the “C:\Users\<USERNAME>\AppData\” folder.

e.g.

    • Yes    Task    AmiUpdXp    Amonetizé Ltd    C:\Users\Admin\AppData\Local\SwvUpdater\Updater.exe
    • Yes    Task    FacebookUpdateTaskUserS-1-5-21-2273408809-1896761900-1418304126-1000Core    Facebook Inc.    C:\Users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
    • Yes    Task    FacebookUpdateTaskUserS-1-5-21-2273408809-1896761900-1418304126-1000UA    Facebook Inc.    C:\Users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
    • Yes    Task    {338F2208-C868-43CC-9A39-79727B6B23E2}    Microsoft Corporation    C:\Windows\system32\pcalua.exe -a "C:\Users\Admin\Downloads\psetup (1).exe" -d C:\Users\Admin\Downloads
    • Yes    Task    {474AEF97-0C09-4D25-8135-CDA13E8C1338}    Microsoft Corporation    C:\Windows\system32\pcalua.exe -a "C:\Users\Admin\Downloads\Shockwave_Installer_Slim (9).exe" -d C:\Users\Admin\Downloads
    • Yes    Task    {C05DDE9D-C140-41E5-B35F-33181D34FAFA}    Microsoft Corporation    C:\Windows\system32\pcalua.exe -a C:\Users\Admin\Downloads\WindowsPhone.exe -d C:\Users\Admin\Downloads

4bjfv4uz

11. Close CCleaner.

Step 5. Remove Media Player 1.1 malicious registry entries*

*Notice: Many extensions that have been installed by Enterprise policy don’t put additional entries in Windows registry. So, follow this step only as a precaution.

1. Open Registry Editor.

To do that open the “Run” command* and in the search (run) box, type “regedit” and press “Enter”.

* How to open the “Run” command:

Windows XP:

Click on the “Start” button and choose “Run”.

windows-xp-run

Windows 7, Vista

Click on the “Start” button and click on the “search”box.

windows-7-vista-run

Windows 8:

Right-click on the bottom left corner and select “Run”.

windows-8-run

 

2. In Registry Editor, click on “Edit” menu choose “Find

registry-edit-find

 

3. In the “Find What” box, type: ExtensionInstallForcelist

3w1nlmqj

4. Now look at the right pane in the “ExtensionInstallForcelist” key found and delete any value found under the "Default" value:

e.g. Name = 1  |  Type = REG_SZ  |  Data = kghfjkuefkjhfehfio;file:///C:/Documents and Settings/Application Data…..

image

5. Press the “F3” button on your keyboard to find the next “ExtensionInstallForcelist key on your registry and repeat the same procedure (delete the extra values on the right pane). *

* Note: In a Windows XP based computer, the “ExtensionInstallForcelist” key is found 3 (three) times in these locations in the registry:

  1. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9A8EC6CB-DD83-4E3E-9829-71ED9CEAC021}Machine\Software\Policies\Google\Chrome\ExtensionInstallForcelist
  2. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
  3. HKEY_USERS\S-1-5-21-606747145-746137067-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9A8EC6CB-DD83-4E3E-9829-71ED9CEAC021}Machine\Software\Policies\Google\Chrome\ExtensionInstallForcelist

6. Close Registry Editor”.

 

Step 6: Clean remaining Adware using “AdwCleaner”.

1. Download and save “AdwCleaner” utility to your desktop.

download-adwcleaner-home_thumb1_thum

2. Close all open programs and Double Click to open ”AdwCleaner” from your desktop.

3. Press “Scan”.

adwcleaner-scan_thumb1_thumb

4. When the scan is completed, press “Clean” to remove all the unwanted malicious entries.

adwcleaner-clean_thumb1_thumb

4. Press “OK” at “AdwCleaner – Information” and press “OK” again to restart your computer.

adwcleaner-information

5. When your computer restarts, close "AdwCleaner" information (readme) window and continue to the next step.

 

Step 7. Clean your computer from remaining malicious threats.

Download and install one of the most reliable FREE anti malware programs today to clean your computer from remaining malicious threats. If you want to stay constantly protected from malware threats, existing and future ones, we recommend that you install Malwarebytes Anti-Malware PRO:

Malwarebytes™ Protection
Removes Spyware, Adware & Malware.
Start Your Free Download Now!

*If you don’t know how to install and use “MalwareBytes Anti-Malware“, read these instructions.

Advice: To ensure your computer is clean and safe, perform a Malwarebytes’ Anti-Malware full scan in windows “Safe mode“.*

*To get into Windows Safe mode, press the “F8” key as your computer is booting up, before the appearance of the Windows logo. When the “Windows Advanced Options Menu” appears on your screen, use your keyboard arrows keys to move to the Safe Mode option and then press “ENTER“.

Step 8. Clean unwanted files and entries.

Use “CCleaner” program and proceed to clean your system from temporary internet files and invalid registry entries.*

*If you don’t know how to install and use “CCleaner”, read these instructions.

If this article was useful for you, please consider supporting us by making a donation. Even $1 can a make a huge difference for us in our effort to continue fighting spam while keeping this site free: