“Best” Antivirus for Chromebooks (Is a Hoax) – Everything You Need to Know about Virus Protection

You can “install” apps, games, extensions, and themes to your browser, but that’s different from “installing” to your OS.

To clarify, you can add and install third-party software to the Chrome Browser.

But you can’t add nor install third-party software to Chrome OS. They’re two different entities. 

Back on topic, these antivirus apps you’ll find aren’t really made to do anything in the form of actively scanning and defending against malware like you’re used to (Windows Defender, Norton, McAfee, Avast, etc.)

But rather, they’re just simple apps that you can add to your browser to easily scan online web pages, attachments, emails, documents, PDFs, and other files for viruses.

This isn’t beneficial to a Chromebook user because even if one of these files were infected with malware, it won’t be able to infect the system. These antivirus apps are actually geared towards Windows and Mac users who are using the Chrome Browser so they can quickly scan these files for malicious code.

Are you lost yet?

If you are, don’t worry.

The key takeaway is that if you’re using a Chromebook, these antivirus apps for Chromebooks aren’t necessary and will probably just slow down your browser.

The same goes for antivirus extensions marketed for Chromebooks- they’re not needed either. Don’t buy into the advertising.

If you were wondering how you can install antivirus on a Chromebook- you can’t. That’s the simple answer.

Caveats and considerations

Okay, so let’s get down to the nitty-gritty stuff.

Earlier, I mentioned that Chrome OS is bulletproof against malware (in terms of practicality). This is mainly due to the many different security features it sports.

Chromebooks have many built-in security features that make them extremely safe and secure:

• It’s built with many common access ports for trojans and malware blocked off permanently
• Every web page runs inside a memory sandbox- locked from contacting the actual system files
• Built-in system verification that scans and checks for any software manipulation or tampering upon reboot
• Inability to install programs
• Inability to run executable files
• Repairs itself if any issues are found
• Automatically updates to install security updates
• Stores Google user data on Google’s servers rather than the Chromebook itself
• Ability to Powerwash and completely revert back to default settings

This gives Google the right to flaunt their device and OS, but there are just a few things users should be cautious about.

Even with a very safe OS, users can still install apps and extensions to the Chrome Browser. This is the major contact point users allow the device to have with third-party software.

If you were to install an app or extension that’s been poorly coded, infected, vulnerable, or even just created to pose as a legitimate app but is actually malware, then you could very well infect your device.

These apps and extensions available for installation on the Chrome Web Store do have to pass a rigorous check before being uploaded and available for the public, but sometimes, malicious code still slips through.

Other times, exploits are found and abused.

This applies to both apps you’ve never heard of and trusted, popular apps that everyone’s using. They can both be subject to vulnerable code that can be exploited.

There are a lot of software companies looking trying to get users to install their apps and extensions. Their goal is to force advertisements to display on your device- whether in the browser, notifications, or anywhere else.

These bogus apps and extensions are often discovered quickly and removed from the Chrome Web Store.

A story about Chrome Browser hijacking- in action

However, sometimes they’re not removed fast enough and many users have already installed it.

For example, here’s a summary of a blog post published by Malwarebytes. This entire study was conducted by a team of researchers over there and is a very nice read (there’s a link to it following the story if you’d like to read it).

It’s about an extension on the Chrome Web Store that was once available to download.

There was once a site that would force users to install an extension called iCalc. It would do this by having your browser automatically navigate to the installation page.

You couldn’t close the window or tab, and there was no way to refuse the installation of the extension.

If you tried to point your cursor towards the “x” button to close the window or tab, you’d be hit with an instant pop-up dialog box and an automatic audio message.

You’d have to click the button to install it, which would then bring you over to the Chrome Web Store.

You’d be greeted with a blank description for the extension, no product images, and no reviews. It simply looks like an incomplete extension that was haphazardly uploaded. You’d then be forced to add it to Chrome.

This is the best part:

It’d then ask you for permissions.

You’d have to allow it to be able to “read and change all your data on the websites you visit.” You’d have to agree to it in order to install it in order to unlock your browser.

You’d think that a calculator app wouldn’t need such personal data, no?

After it was installed, you’d have a very basic calculator on your hands. Okay, what now? All that work for this?

But that’s just what you see on the surface. Beneath the calculator facade, the code says a completely different story.

The code was scripted to create a secret proxy and intercept web requests on your browser (and Chromebook’s) behalf.

In other words, it would communicate with a secret website and fetch commands from it at scheduled intervals.

It was eventually pulled from the Chrome Web Store, but only after it’s been downloaded by nearly a whole thousand users. The damage had already been done.

And the scary part?

After its removal from the directory, it was quickly republished and aimed towards Russian users and downloading a social networking site.

These are often referred to as “rogue extension” that attempt to perform “malvertising” (the use of advertising through malware).

Although you don’t see these often on the Store, and they’re often pulled quickly, you should still protect your data.

Here’s a video of the extension in action:

Of course, this was shown on a Windows PC. But the fact that rogue extensions exist on the Chrome Web Store is an issue.

I found this story on Malwarebyte’s blog. I urge you to head on over and read the whole thing. It’s very interesting and could possibly save your computer.

And if you’re interested, there’s another very detailed report of a similar case over at ComputerWorld. The author goes over how he removed an extension that hijacked Chrome.

Chrome extensions can pose security exploits

Do you get it now?

Although your Chromebook is safe from malware, your data can be at risk depending on the extensions you have installed.

This is pretty much the most common method you can get spyware or hijacked on Chrome OS.

Extensions allow other parties access to your browser and personal data, so you need to very careful with which ones you install.

Often, these malicious extensions will hijack your browser and have it redirect to dangerous sites or mess with your bookmarks.

They’re pretty easy to remove though- all you need to do is uninstall the extension and the issue is usually fixed instantly.

But for those who aren’t so tech-savvy, it could be a nightmare. So again, install extensions with caution.

How safe are Chrome extensions?

I’m not trying to scare you or make you paranoid.

Most extensions are popular and trusted and used by many, many people.

These are often from big brands and companies you’ve heard of.

Chances are, these are safe to install.

Other times, you need an extension or app that’s lesser-known. It may have a few reviews, a few users, and asks for a few permissions. These are the ones you need to “scan” for malicious intent.

Of course, not everyone is a security-hacker-malware-spyware-virus prevention expert. So I wrote down some tips on deciding whether or not to install it.

Here are some tips on how to check if a Chrome extension is safe:

• Read the reviews. Obviously, a higher-rated app or extension is better, but make sure there’s a sufficient number of reviews as well because they can be fake ratings. Also be sure to read the negative one-star reviews as well. These can often show the real issues with the app or extension (although these can be fake as well written by competitors- so use your best judgment).
• Look at the publish date. A trusted extension or app won’t be removed from the Chrome Web Store. So if it’s safe, it should have a date published from a while ago to back it up. This way, you can tell if it’s just a fly-by-night re-upload of another spammy extension. Though, there are always exceptions. It could be a new, legitimate app or extension. So again, use good judgment.
• Check the last update date. A good developer keeps their apps and extensions updated with new features, security patches, and bug fixes. A newer, more recent update date means the developer is still providing support for it which is a good sign.
• Do a search on it. Just do a quick search in your favorite search engine of the name of the app or extension. You’ll quickly see reviews, videos, and other sites talking about it. Form this, you can determine if its’ safe or not.
• Do a search on the company. On each description page, developers get the opportunity to plug their homepage for the app or extension. You can quickly visit their page or do a search on the company behind the product to see if they seem legitimate or not. Some developers don’t have a homepage, so they leave it blank. You shouldn’t deem it as unsafe just because there’s no site linked.
• Check the permissions. Install the app or extension and see what permissions it requests. If it seems more than needed for the purpose of it, you can easily deny it and then uninstall it from Chrome. You won’t ever activate it if you deny permissions, so you don’t have to worry about it doing any harm to your privacy. It was never activated. It’s like a “quarantine” for malicious extensions or apps.

It’s always best practice to only install extensions and apps that you trust and that you truly need.

Uninstall the ones you rarely use or any other questionable ones.

Here’s a video demonstrating how to remove Chrome extensions (it’s quick and just takes a few seconds):

Is your Chromebook acting strange?

If you think your Chromebook has been compromised, infected, or corrupted, it’s very easy to fix.

All you need to do is a simple Powerwash.

It takes about three minutes and will reset your laptop to default settings.

How it works is by simply deleting everything saved locally on your Chromebook. This means all your downloaded images, files, videos, docs, music, and other data will all be erased. Your laptop will be restored back to factory conditions like when it was brand new.

If you have stuff you want to save from getting deleted, you can back it up to an external storage device or use Google Drive.

Keep in mind that all your online data connected to your Google Account will remain intact. This means your Google Account settings, history, preferences, and everything else that’s saved on Google’s servers won’t be lost and kept safe during the process.

A Powerwash will simply erase everything stored directly on your device and only your device.

This means if you corrupted something (unlikely), changed a setting and can’t change it back, need to restart an installation of Steam, screwed up trying to install Minecraft, messed up on an installation of Linux, or simply because your Chromebook isn’t working properly, you’ll be able to reformat all the local data on it and restore it.

But before you do that, let’s try another approach that’s not as extreme.

If you think your Chromebook is infected or if it’s acting differently, you should uninstall your Chrome extensions:

Step 1: Try using Incognito mode (“CTRL + SHIFT + N”). This will disable all apps and extensions installed on your browser.

Step 2: If the issue is fixed, you may have a malicious extension installed. If not, skip the rest of these steps and just do a Powerwash.

Step 3: Disable all Chrome extensions. Type in “chrome://extensions/” (without the quotes) in the address bar in Chrome Browser and press Enter. You can refer to the video in the previous section if you need additional help.

Step 4: Untick every single extension to disable it.

Step 5: Re-enable the extensions one-by-one and test if the problem arises again after each extension.

Step 6: Delete the extension that causes the issue.

If the problem still isn’t fixed after trying this, go ahead and perform a Powerwash.

When you’re ready, here’s a complete tutorial on how to do a Powerwash on your Chromebook.

Stay secure with some of the most trusted and best Chrome privacy extensions

There are few extensions I recommend from the Chrome Web Store that can definitely help protect your privacy and help you stay secure online.

HTTPS Everywhere

I’ve written about this security extension before, but I’ll give a little overview of it here.

HTTPS Everywhere is a handy little Chrome extension that forces thousands of websites to use “HTTPS” instead of “HTTP.”

If you don’t know what the difference between HTTP and HTTPS is, here’s a cheat sheet:

• HTTP: Stands for HyperText Transfer Protocol and is now considered to be insecure. It doesn’t encrypt the data sent between you and the website you’re visiting.
• HTTPS: Stands for HyperText Transfer Protocol Secure and is not the new standard for security. It encrypts all data transferred between you and the website you’re on so that no outside parties can access it.

What this extension does is forces the site to use HTTPS whenever possible. This can prevent spying, privacy invasion, account hijacking, and even bypass some filters and censorship.

It’s free and created by the Electronic Frontier Foundation and the Tor Project– two of the world’s leading platforms in protecting your privacy online. This Chrome extension is a must-have if you want to stay secure.

On the Chrome Browser, you can see which sites are using HTTPS by looking for the green padlock icon directly to the left of the address bar. If it’s using the insecure HTTP, you’ll see an exclamation mark or an info button. 

Get HTTPS Everywhere.

As a side note, PlatypusPlatypus will be converting over to HTTPS by October 17, 2017 =].

Privacy Badger

This is another Chrome extension that I always install whenever I download a new instance of Chrome.

Privacy Badger is also made by the EFF and the goal of this extension is to block any unwanted web spying ads and trackers.

If you’re reading this without a tracker blocker, you’re probably being watched by thousands of ad companies. It’s nearly impossible to visit any website without getting trackers placed on your browser.

These trackers basically monitor your browsing activities in order to serve you relevant ads. That’s why you sometimes see ads for a particular product you were searching for earlier.

It’s not illegal practice for ad companies to do this, but it does bring up the question of your privacy being invaded. I’m not going to get into a huge philosophical discussion here. I’m just going to suggest that if you want one of the best privacy extensions for Chrome ever made, get Privacy Badger.

It’s completely free to use and it’s also customizable. Whenever you visit a site, it’ll identify potential trackers. All the unsafe ones will be automatically blocked, while safe ones are automatically approved. You can adjust which ones you’d like to block and allow, and you can also disable it for specific sites if it breaks the site you’re viewing.

Privacy Badger is an easy solution to ad trackers. Get Privacy Badger.

SaferVPN

SaferVPN is a VPN (virtual private network) service that allows you to browse the web anonymously.

If you’re anonymous, you can’t be tracked. If you can’t be tracked, you can’t be spied upon. If you can’t be spied upon, your privacy is safe.

VPNs have become very popular lately because everyone is scrambling to safeguard themselves online. SaferVPN allows you to use up to 500MB to bandwidth monthly for free.

It’s known for its stability, simplicity, and ease-of-use. It’s pretty fast for a free VPN service and it works pretty well.

With a VPN, you can do more than just protect your privacy. You can also access blocked or filtered websites and apps like Facebook, YouTube, Pandora, Instagram, Twitter, Skype, Netflix, and even SnapChat if you’re behind a school or work web filter. You can also set your home country to over thirty different locations like the US, UK, Canada, and others so trackers won’t be able to locate you. You can bypass firewalls and unblock your favorite sites.

You can browse the web with bank-grade encryption and even use WiFi security and identity protection over unprotected WiFi hotspots (like at many restaurants) and public networks. They have a feature called a “hotspot shield’ to accomplish this task. It also works faster than using a free proxy you found online.

It also changes your IP address as well. If you didn’t know, your IP address a unique set of numbers that identifies you online. From this IP, ad companies and other networks can find out a bunch of juicy details about you- such as your location, Internet service provider (ISP), and other fine information. If you’re hiding behind a VPN, you get a new bogus IP that you can use however you want. You can hide your IP and online identity to prevent any tracking from ad companies and ad targeting. It’s anonymity you can’t get with a basic browser.

SaferVPN also states it safeguards your data and doesn’t show any ads. It’s a fully anonymous, private, and unrestricted Internet connection directly within Chrome. You don’t need to download any additional software nor give any private information unless you decide to opt-in for the paid version. Their technology encrypts your online activities by connecting to another network in another country.

If you want to browse online anonymously, try SaferVPN. There are tons of other free VPN extensions for Chrome you can check out here. They each have their own perks and drawbacks, so read some reviews and see what you like best.

Try out SaferVPN here.

WOT: Web of Trust

WOT is a community-based online website reputation system.

Whenever you visit a site, you’ll see the WOT icon in your browser change color to signify if the site is safe or not.

Every single URL will get specific security icons. You can check to see if the site is deemed safe or marked as unsafe by its visitors.

WOT aims to protect your online security from online threats that only humans can detect. Sure, Google Chrome’s Browser has some security measures to keep you safe from dangerous sites by showing that scary warning. But it can only do so much. WOT utilizes a huge online community dedicated to rating sites as safe or dangerous. When you install WOT, you become part of that dedicated community. You can help improve the app by rating sites and leaving your own thoughts about them so other visitors can decide whether or not it’s a good idea to visit an unknown site.

WOT utilizes this huge community and complex algorithms combined into one lean, mean, bad website busting machine. It filters out fake reviews as well.

You’ll stay protected and secure with Web of Trust. You’ll be alerted of phishing, malware, scams, rogue web stores, dangerous links, and a lot more. You can see exactly why a site is dangerous and read the report for any site. WOT also shows a five-star review system and shows a badge displaying a site’s overall rating as “safe, suspicious, or unsafe” in three obvious colors (green for safe, yellow for suspicious, and red for unsafe). You’ll also get warnings for dangerous sites if it’s not obvious enough as stated earlier. You can even read reviews by other users based on their experience with the site. If the site hasn’t been reviewed yet, you can request for someone else with the proper technical know-how in the community know-how to browse it and review it for you.

WOT is also universal- you’ll see these alerts next to results in search engines (Google, Bing, Yahoo, etc.), social sites, email, and other popular sites so you’ll know if a site is unsafe or not.

It also features two different modes. You can use real-time protection which allows you to surf any site with active notifications that warn you. Or you can use Manual Mode to browse more passively if you’re browsing sites you already trust. This way, you don’t get annoyed by notifications on sites that are marked dangerous but you need to visit anyway.

WOT is completely free to use. It’s one of the easiest ways to check if a site is safe or not. It’s like an automatic website safety checker that works instantly with Chrome.

Try out WOT.

Blur

Blur is a nice tool that protects your payments, passwords, and privacy online.

It’s like a password manager (similar to LastPass) that stores all your passwords and personal information in a super secure bank-grade server.

It generates complex and unique passwords for every site you visit. This way, if one password is leaked, that person can’t access all your other accounts. It has the ability to create strong passwords in a single click and it works for sites you already have passwords for.

Blur can also generate a unique email, credit card number, and password for every online transaction as well. The tech behind it is crazy, but you should know that having unique everything is only a good thing.

Let’s say a site you’re shopping on gets hacked and a generated credit card by Blur was used. It doesn’t matter. The credit card number is a “fake” card stored on the site (but it works with checkout) and is only linked to your real card number through Blur. f your account gets hacked, it doesn’t matter because your credit cards and personal information aren’t even stored on the compromised site. And they can’t link it to your actual card number because that’s stored on Blur.

It’s called a “masked card” that acts like a disposable card, sort of like PayPal. But don’t worry. This doesn’t mean you have to type in a fake card every time. Blur comes with auto-fill so you can use your real card, billing, and address info with a single click. But the site won’t ever see these details. The same goes for emails as well.

It organizes all of this information into an easy to read table that’s only accessible by you. Not even the company Blur itself can see this information. If you want to get really geeky, it uses AES-256 encryption with separate keys for authentication and authorization. Encryption keys get stored using host-proof hosting and encrypted data is stored using personal storage accounts like Dropbox (if you’d like). JavaScript functions also run in protected elements rather than directly in the page.

And it also has a built-in privacy guard that blocks trackers from spying on you. It blocks sites from collecting data and building a profile about you. It stops big sites (like Facebook) and other prying eyes from gathering your personal data. Blur uses a community algorithm that blocks new threats to protect your privacy. This algorithm is based on all the users that use Blur.

If I had to compare Blur vs. LastPass, I’d say Blur is better for those who shop online a lot. LastPass is better for storing passwords and login credentials for everything else. Blur’s technology is better for online shoppers with the unique credit card numbers that work at any online store. LastPass’s technology is better for storing, saving, and organizing login details for any website.

If you shop online and you want an easy, secure way to save all your information, go with Blur.

If you want to check out the alternative, I wrote a detailed review about LastPass.

Blur offers both free and paid options. You get plenty of goodies with the free plan, like masked emails and password management. The masked cards feature is only available with the paid plan, but it’s kind of worth it if you shop online a lot. You don’t have to worry about your favorite online shopping destinations getting hacked and hackers getting access to your credit or debit cards. You also get masked phone numbers as well.

Check out Blur and protect your passwords, payment information, and even emails online.

How to be completely safe from browser hijacking on the Chrome Browser

Okay, so you’ve read the vision of Chrome OS and how it’s super secure.

You’ve read about how Chromebooks don’t need antivirus. You’ve read about how they can’t install antivirus.

You’ve read the horror stories of rogue extensions.

You’ve read some tips on downloading and identifying safe apps and extensions on the Chrome Web Store.

You’ve checked out a few Chrome extensions to protect your privacy online.

(Not feeling safe enough? I wrote a bigger list of Chrome extensions to protect your privacy online.)

You should be pretty safe to browse the web at this point.

But…

If you want to be completely safe from malicious extensions, you have two last options:

• Never install an extension
• Browse in Guest or Incognito mode

By not installing any extension, you won’t put yourself at risk to any hijacking. But the problem is that you won’t be able to block any trackers, warn you of dangerous sites, protect your IP and more (some benefits that some extensions provide), and you’ll severely limit the capabilities of Chrome. So that’s a trade-off.

Or you can have a “main” browser with trusted extensions. And you can do everything else in either Guest or Incognito mode. Both of these modes disable any extensions installed on Chrome so you’ll be in full security. But again, you won’t get any of the benefits from the good extensions.

Actually, I don’t see why you’d ever use option two. It doesn’t really make any sense.

So just one option- don’t install any extensions or apps.

But that’s completely overkilling it (and kind of paranoid) in my opinion.

Chrome is an awesome web browser and should be utilized to its fullest potential, which includes installing these extensions. You’d be missing out on tons of products built for productivity, entertainment, learning, shopping, photos, sports, social networking, and a lot more by not installing anything.

The best advice I can give is this:

Feel free to check out what catches your eye- but feel obligated to eye what you catch.

That’s the corniest line I could come up with in under twenty seconds. Sorry.

Stay safe

Well, that’s it.

I hope this article has helped you make better choices to protect your privacy and stay safe online with your Chromebook.

If you have any tips to add, leave them in the comments and I’ll check them out.

And if this guide has helped you, let me know as well =].

Also, consider telling a friend about this guide (social buttons at the top for your convenience) and spreading the safety.

It’s a scary and dangerous world online, but with Chromebooks and Chrome OS, it makes it a little safer. And that’s good for anyone who bought into these amazing devices.

Thanks for reading.

• About the Author

About Andy Z.

Andy is a casual-hardcore Chrome OS fan and contributes to the site regularly. He likes computers, tech, sports cars, videogames, and of course, Chromebooks. Thinker. Introvert. Geek. You can find him on Twitter (@platytech), or send him an email (check the "Contact Us" page).