The Kittcat chrome extension is an anchor-component of a browser hijacker malware we came across in our routine checks. It is new at least on the surface level. In reality, it is yet another rebranding of the findflarex.com extensions that lead to boyu.com.tr (link is to our removal page for Boyu). The only notable difference is that now findflarex is also changed as the publisher, to finditfasts.com
Since quite a few users on various forums have requested help with removing it, we felt compelled to create this tutorial. In what you need to do, it is practically the same as other malware extensions of this type like Loungoo and HyperSearch. The main common trait that hijackers share is that they cling to systems like stubborn barnacles on a ship’s hull. They resist simple removal, so the process of eliminating them is rarely a quick or simple one.
Kittcat Extension Removal Guide
The Kittcat extension will likely require some ‘advanced’ steps to remove (the quote/unquote is on purpose because it’s not that bad), but we still recommend you try to get rid of it the conventional way. This will only take a minute or two, so it’s worth the try. And if it doesn’t work, you still have the in-depth tutorial we’ve prepared for you next:
- First, open the Extensions Manager. You can access it through the browser’s main menu.
- You must inspect the list of installed extensions closely. Look for the Kittcat extension extension or anything else that seems unwanted or unfamiliar – e.g. Loungoo, HyperSearch, or something else that appeared, but you have no idea why it’s there.
- When you find the item that must be uninstalled, hit the “Remove” button.
- If this doesn’t work on the first try, disable the extension by clicking the toggle button, and try again.
Close and re-open the browser and go back to the Extensions Manager to see if the rogue add-on is gone. If it’s still there or if you weren’t able to perform any of the steps, don’t worry – it’s to be expected. Just move on to the full removal below – it will let you get rid of Kittcat extension and all its related components.
SUMMARY:
| Name | Kittcat (extension in Chrome) |
| Type | Browser Hijacker |
| Detection Tool | We tested that SpyHunter successfully removes parasite* and we recommend downloading it. Manual removal may take hours, it can harm your system if you re not careful, and parasite may reinstall itself at the end if you don't delete its core files. |
OFFERBrowser hijackers employ tactics that lock browser settings. This prevents easy removal. Users might see a “Managed by your organization” message in the browser menu or on the settings page. Like roots breaking through concrete, it’s more than a surface problem. These policies need to be addressed and removed, only then can users regain control of their browsers. Fortunately, at this point the ‘managed’ state is very common and we know what to do to remove it.
How to Delete Kittcat extension Virus Policies From Chrome
You won’t be able to get rid of Kittcat extension until its rogue policy is gone from the browser. That is where we start the removal process:
Access the browser’s policy management page next. You’ll find it at chrome://policy for Google Chrome. For other Chromium-based browsers, you just need to replace “chrome” in the URL with the appropriate name.
On the policy management page, look out for policy values made of long sequences of random letters. Copy any such policies and save them in a text file. This is crucial for later reference.
Next, return to the Extensions Manager.
A particularly annoying persistence technique some hijackers employ is to redirect you to Google or another page when you try to go in the Extensions tab in Chrome. Here’s the solution:
Navigate directly to the browser’s extensions folder on the computer instead. For Chrome, this path is typically C:\Users[Your Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions.
Then you’ve got to delete all subfolders you find there. The result will be that all your browser extensions will be corrupted and, in turn, disabled. Even the legitimate ones. This is necessary. Reinstallation of the legitimate extensions comes later. To be clear, the folder Kittcat resides in is ‘knbjchamdcpdeapjojehlhhobdlgfogc’. Don’t restore or backup that folder.
In the Extensions Manager, enable Developer Mode to see the IDs of all installed extensions. Note down the IDs of any rogue extensions you want to remove. Save them alongside the suspicious policy values. The Kittcat extension’s ID is ‘knbjchamdcpdeapjojehlhhobdlgfogc‘ – this is the string you need to copy. If there’s another malware, copy its own ID.
Remove the Kittcat extension In the Registry Editor
Now that you have gathered the rogue policy values and IDs, your focus must shift to the system registry.
Open the Registry Editor through the Start Menu (search for it there). Ensure it’s running as Administrator. This grants the needed permissions to make changes.
Use the Find function (Ctrl + Shift + F) to locate the rogue policy values and extension IDs.
Upon locating each entry, delete the corresponding registry key (folder) to the left. Every trace of the hijacker must be removed. Incomplete removal risks leaving the door open for the hijacker’s return when you restart your comp.. Always run an extra search after an item is deleted to see if there’s another one left, the find functions won’t find anything if you are done.
The next annoying persistence trick by hijackers like the Kittcat Chrome extension is to prevent you from deleting its registry keys by restricting your access to them. If you get such an error, this is the solution:
To bypass these restrictions, users must change the permissions on the parent key. Right-click the key, select Permissions, then Advanced, then Change.
Type “everyone” to change the key owner. Confirm with the Check Names button.
Click OK, then put ticks in the two “Replace…” options, and then Apply and click OK.
After applying these changes, deletion will be possible. Go ahead and get rid of the stubborn registry key.
Alternative Policy Removal Steps
Even after a thorough cleaning of the registry, some hijacker policies might persist. If the “Managed by your organization” message isn’t gone from your browser, try these two additional methods:
First, open the Group Policy Editor – you can find it in the Start Menu.
Navigate to Administrative Templates under Computer Configuration and Right-click on it. Select the Add/Remove option and remove all entries in the following list.
You can also use another tool. Again. this is completely optional and you don’t need to do it if you did everything up until now correctly. This is more of a troubleshooting step if something goes unexpectedly wrong. The Chrome Policy Remover is a totally free utility that runs a script that deletes all Chrome policies.
Download the tool. Run it with administrative rights (right click on it, run as admin). If you get a Windows security warning, just ignore it by clicking More Info > Run. The tool is safe, don’t worry.
Then the script will run automatically and all Chrome policies will be deleted.
Final Steps: Reversing Kittcat’s Chrome Changes
With rogue policies removed, it’s time to undo unwanted changes in the browser. The Kittcat Chrome extension is no longer
Return to the affected browser’s Extensions Manager. The “Remove” button should now work, so click it for any browser add-on you don’t want there, including the Kittcat extension extension.
Go to Settings > Privacy and Security. Select the option to delete browsing data. Opt for a timeframe that predates the date when you first noticed the hijacker. Keep your saved passwords intact, but delete everything else.
Check Site Settings next (it should be under Privacy and Security for most browsers).
Review the permissions, all of them. Remove unfamiliar or suspicious URLs from the “Allow” section. Findflarex.com, boyu.com.tr, maxask.com are all common examples of rogue URLs, but there could be others.
Next ensure the default search engine is one you can trust like, Google, Bing, or Yahoo.
Then move on to the Manage Search Engines section and delete any dubious search engines the hijacker might have added.
The last two browser settings sections you must review are “On Startup” and “Appearance“. Hijackers like Kittcat extension often tamper with these. Rogue URLs might be left behind and you must delete them.
This should be the last step to clean your PC and browser from the Kittcat Chrome extension. The hacker should be gone after you complete it.
Leave a Comment