This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 54%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Looks like my Browser has malware. The "Norton Safe Search Enhanced" extension is locked and does not let me remove it. I have tried running and scanning the Microsoft Windows Security software but it could not remove it. Please help!!
Managing browser extensions in Microsoft Edge on Windows 11
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 46%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGG%3C/text%3E%3C/svg%3E)
Thank you! I did the Scan. Here is the links:https://drive.google.com/file/d/1iIJEKVg4URrFyCz3IwTIlWAW64eS-MbP/view?usp=drive_link
https://drive.google.com/file/d/1hi1qwUxK8329-MFHyBqFtdio7-gtdQ5t/view?usp=drive_link
Thank you very much!!!
@gai gai Did you setup the proxy server and AutoConfigURL entries? If you did, let me know and I'll adjust the Fixlist.
Fix.
It works! Thank you very much! You make my PC!
Both Edge and Chrome have this unwanted extension. Hopefully this resolves the issue.
If there's still a problem, please upload the resulting Fixlog.txt.
You're most welcome.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 73%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZY%3C/text%3E%3C/svg%3E)
hi i have the same problem and its also managed by an organisation but your answer doesnt help me?
i cant download fixlist bc if i click on the link it says this file doesnt exist and what is frst64.exe file??? i am pretty much a noob so can you explain more to help me?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 76%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVL%3C/text%3E%3C/svg%3E)
Hi, I'm having the same problem. I downloaded Farbar and it's scanning, but it gets stuck. Can you help me?
Try scanning in safe mode.
Right click the start button, hold down the shift key and select "Restart"
At the next screen select:
Troubleshoot => Advanced options => Startup Settings => Restart => press option 4 "Enable Safe Mode" or 5 "Enable Safe Mode with Networking"
Perfect, I did it. I uploaded the FRST and Addiction files to these links.
https://drive.google.com/file/d/1EROuKa2A2ugi3J5bfJRMoSFjogvlb3eC/view?usp=drive_link
https://drive.google.com/file/d/1Rq1GO7myNv_v88XJH7PZKCWXUSebhxEr/view?usp=drive_link
The problem is on both Edge and Chrome
This should resolve the issue. Please upload Fixlog.txt as I'd like to see what malware was running.
Great, I solved it. Thanks so much!! Here's the link to the fixlog.
https://drive.google.com/file/d/1A_40O4fqlKt8B-RXyUe_N9pprrupgxxq/view?usp=drive_link
I'm glad it's solved :) Unfortunately the javascript file is far too obfuscated to reveal its intent anytime soon.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 75%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
Hi, I have the same problem. I'm trying to follow your procedure but Farbar get stuck while scanning. I tried your directions to start scanning in "safe mode" but doesn't works. "Right click the start button, hold down the shift key and select "Restart"" I try right click on the start button (Scan?) but no windows open. Can you help?
Hold down shift + Right click the start button > Shut down or sign out > click Restart
or any of these methods which also apply to Windows 11.
https://www.digitalcitizen.life/4-ways-boot-safe-mode-windows-10/
If any related problems remain after running the Fixlist, upload Fixlist.txt
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 33%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
If you're still keeping up with this, here's a google docs with my .txt output. https://drive.google.com/drive/folders/1xAj20KY8FgwLLl-bsvOOv0wKbXDvnuGy?usp=drive_link
@CelestialLife
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 81%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELR%3C/text%3E%3C/svg%3E)
Hi everyone, i had the same issue, i already scan with FRST and generated the two files FRST.txt and Addition.txt, then i uploaded the files and these are the shared links, could you please tell me how i can get the Fixlist.txt now? Thank you so much in advance!
https://drive.google.com/file/d/1xXsVXdJCdHmNav-GIiWnvpoMppvvUuyC/view?usp=sharing
https://drive.google.com/file/d/1nmmGoNsC7hwP1vnnuKyyOV_JTtoROryO/view?usp=sharing
@Luigi
Do you know what these entries are?
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
Hi, I ran the instructions and the problem was solved. Thank you so much. No, sorry I don't know the origin of these links
You're welcome. We'll remove those entries.
Copy all the code text below then run FRST64.exe and click Fix.
start::
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
end::
I can't access the link. If the Fixlog indicates success, it's all good.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 77%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Can you help me? both Edge and Chrome has it.
here's my FRST and Addition: https://gofile.io/d/YlVd0z
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 84%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 62%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEO%3C/text%3E%3C/svg%3E)
Please help me i have downloaded frst .txt and Addition. the norton thing is pissing me of pls help!! the link below
https://drive.google.com/file/d/19L2-etsC-IkUPRNRj35AcP5s7FcXw2LR/view?usp=sharing
https://drive.google.com/file/d/1qEflzrfJcc60iFK2yr_ZHzMzUk8cqN4x/view?usp=sharing
@Eyitayo Obadina Please change the file permissions as the logs are inaccessible.
@_AW_ the link should work now
Save Fixlist.txt to your Downloads folder then run FRST64.exe and click Fix.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 21%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Hi I need help also cant get rid of this fake norton extension here are my frst and addition
https://drive.google.com/file/d/1_cHCcwR1x2FfGig20VcD6lvngW6DAnbt/view?usp=sharing
https://drive.google.com/file/d/1RqwFIHNshD5fbUHsQpP6hwjmbqNMr3iA/view?usp=sharing
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 6%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
Hi!
I have the same problem as the others :((
'Norton Safe Search Enhanced' extension that I never installed and can't remove, causing my browser to use 'Safey Search Engine'...
I used FRST and my 2 scans are here:
Could you help me with the Fixlist? :)
Do you know what could have put that in my browser? I have installed the same programs as on my other computer and the latter has no prob.
Save Fixlist.txt to your Downloads folder then run FRST64English.exe and click Fix.
The extension possibly came as a fake browser update popup.
It worked! thanks a lot, you helped very quickly :)
And okay, I don't remember exactly what happened but I wondered some days ago why Chrome was kind of 'reset', asking me again to sign in and none of my 2 profiles were connected. It may have been smth like that i thought legit.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 75%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 96%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EML%3C/text%3E%3C/svg%3E)
Hi, i'm french and i have the same problem on Edge. Please help me.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 34%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJL%3C/text%3E%3C/svg%3E)
Hey I am having the same issue, below is a link to my FRST txt files
https://1drv.ms/f/c/cee60e46ef5ba19a/IgCKbsG-6ICfTYDZBmQ9z5muAab-g2cGyJE0RsIaIhNcv7Y?e=UXBDJj
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 69%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
hello..i still have the problem
find attached the fixlog.. hope you can help me. thanks
You need to use a Fixlist written specifically for you, not just some random Fixlist you've found on the internet.
Please follow the instructions in the following post and provide logs for analysis. I will then write a Fixlist for you.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 33%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
Hi, I've done the scan and these are my addition and FRST logs.
https://drive.google.com/file/d/1iQhc3Rls5gDK6xYxNo6yDkMqpM0tb6bj/view?usp=sharing
https://drive.google.com/file/d/1NuNScRDhYOMGz92fxZI_56uOY0q3No4g/view?usp=sharing
hi
I hope I did it right this time..my last try ..too difficult for me ;(
I attached in different ways hope there is one that works.....':D
I have scanned in safe mode
https://drive.google.com/file/d/1HFEGrP-eo9f8EvOHnUC8gIiqMDUcvT1j/view?usp=drive_link
https://drive.google.com/file/d/1HFEGrP-eo9f8EvOHnUC8gIiqMDUcvT1j/view?usp=sharing
https://drive.google.com/file/d/1KMhFmNAiYS2E54ZIcofStSeSclYZqXU9/view?usp=sharing, https://drive.google.com/file/d/1rK9JR3UnIV7kym46xOvnOhfiTl1SHqS9/view?usp=sharing
thanks! you saved my life....
it worked...
it still existed in the web search list but I have managed to cancel it.
Is there anything else that I have to do? Do I have to change passwords on websites?
Stefi
You can also delete the file -
C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\dsue.crx
I don't think you need to change passwords, though if you feel so inclined, it certainly won't hurt.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
:)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 61%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKS%3C/text%3E%3C/svg%3E)
Hello, I'm having the same problem that Edge and Chrome are blocking and redirecting my browsers due to Safety Search Enhanced in the extensions. Could you please help me?
https://1drv.ms/f/c/8fb23ba4c2f60dfa/IgBSQMqR-ij8QrNdOU9_TpUVAcNGo1WQ4jnhVA1ld9iK6xE?e=1Hkr4X
Uninstall Cookie A.Q as it's a PUA/Adware that was likely installed with something else.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 59%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Hi I have the same problem on both Edge and Chrome ,thanks in advance!
https://drive.google.com/file/d/1oe29ub1Ck4lKgiag9UTZoc2NLeP3NWJq/view?usp=drive_link, https://drive.google.com/file/d/1QUHI3FWKt81yZyin5x2WHcnayRIFSsNg/view?usp=drive_link
Fix.
Thanks ,it worked ,I also reported it to google before I found this thread ,I hope it gets sorted soon.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 89%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
hi, i also have this problem on edge and chrome, hopefully i got your instructions write and in this the right file i got from farbar.
https://drive.google.com/file/d/1OLR5GIseokxk8sW2QIeGSbR5yaQkfrSf/view?usp=sharing
Fix.
The problem seems to be fixed, Thank You Very Much!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 55.00000000000001%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
I also have this problem on Edge. i got you instructions and hope you can help me
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 27%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJW%3C/text%3E%3C/svg%3E)
Hello, im having the same problem. This is the link for the frst and addition files.
https://drive.google.com/drive/folders/1UcI2JAe611R2kzSKsWrM92owRAIijug1?usp=drive_link
No it says access denied.
There are multiple infections to remove. Go into your installed apps and uninstall these PUAs -
Quick Driver Updater - https://malwaretips.com/blogs/remove-quick-driver-updater/
Web Companion
OneBrowser
Please upload Fixlog.txt so I can check if any further action is needed.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 82%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
HI! omg such a relief to find this thread! I´m having the same problem and it's been a nightmare, can you please help me fix it?
Here's the link with the ZIP files, I ran Farbar from safe mode. Let me know if you need anything else. Thanks again! Also, how do I prevent this from happening again?
Fix.how do I prevent this from happening again?
Avoid warez sites, cracked software. Be wary with game mod sites as malware sometimes gets uploaded to them. Download software from the author of the software where possible or highly regarded download sites.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 61%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
-
Fix.
Please provide Farbar Recovery Scan Tool (FRST) logs for analysis.
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Note: If you are using Edge or Chrome, SmartScreen may initially block the download. Click on the three dots next to the warning and select Keep => Click the Delete drop arrow => Keep anyway.
Share OneDrive files and folders - Microsoft Support
** Farbar is a safe app utilized in most online malware removal forums.
I was able to download FRST64.exe, but I could not run it... i get pop up reading it contains a virus... see below. Any other ideas? Thanks.
Hey I am having the same issue, below is a link to my FRST txt files
https://1drv.ms/f/c/cee60e46ef5ba19a/IgCKbsG-6ICfTYDZBmQ9z5muAab-g2cGyJE0RsIaIhNcv7Y?e=UXBDJj
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 24%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
Hi, sorry to bother you, but could you make me a fixlist please?
https://drive.google.com/drive/u/0/folders/1zvyaFq3XdpPnYwtVYQ6dPfr03BXcHjAL
@AWOIT-0301 my bad man, also i think the files werent complete or something so i will send a updated version in the morning. Also tysm for caring
Run the scan from safe mode.
Sorry for all the trouble, heres the link.
https://drive.google.com/drive/folders/1zvyaFq3XdpPnYwtVYQ6dPfr03BXcHjAL?usp=sharing
Fix.
You are the MAN! Like seriously thank you, this is a new pc i saved up for a long time and you just saved it. Hope everything goes well in your life because you are the person that deserves it the most (after my mom). Anyways i put the fixlog in the google drive link i sent you in case you wanted it.
All is good in the Fixlog. To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck with your new PC. :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 87%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hello,
I'm having the same problem. Would it be possible to get a FixList? Share link is below.
https://drive.google.com/file/d/1tV4XvUUxso-wTL1mNshd6KqcAIr7JCKj/view?usp=sharing
Fix.![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 72%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELG%3C/text%3E%3C/svg%3E)
Hello @_AW_
Here's another one having the same problem. I tried to delete Chrome Policies through Windows Registry Editor, and I managed to do it, but still I cannot delete the Norton software downloaded on my PC and the extension in Edge, Chrome...
It would be great if you could take a look to the FRST and Addition txt, to get the FixList.
Thanks a lot in advance!
https://drive.google.com/drive/folders/1wkud_qRZzdknzWZUPlQzWnD5zN267Pq3?usp=sharing
Fix.
The problem seems to be fixed, Thank You Very Much!
(whoops pushed on the wrong thread to anwser butt still Thank you)
Thank you so much @_AW_ , so thankful for your help!
Wish you the best!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 1%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELP%3C/text%3E%3C/svg%3E)
Hi @_AW_
I got the same problem, here's my log. I hope you can help me :(
https://1drv.ms/t/c/479dc231d28804e9/IQCXyHGQ2LhcQZ-p8_cPEUf_AdCsEKqbQAQlIfYgmeFOZgU?e=MXFfoY
https://1drv.ms/t/c/479dc231d28804e9/IQAqbxbg8GEDR7Q6x407LFYnAaapU1xj3byYTxZqhQYDtQM?e=jJQIp6
Have a pleasant day/night !
Hi Laureen, I'm preparing the fixlist. Do you know what this scheduled task is?
Task: {43387468-722F-4C1B-A2EE-9BD72C6DED52} - System32\Tasks\Microsoft\Windows\UBAP\UBAPScheduler => C:\e83d1508-f9f2-4dda-bbb3-903d4525cb5c\python.exe [103192 2024-02-06] (Python Software Foundation -> Python Software Foundation) -> "C:\1b08ae95-3830-44c6-ba4b-7a34ecb88d85\30731\7110\abc51017-0c60-4d5a-ac89-51f3ef5ec936.py"
Not at all, i don't know what is it.
Please upload Fixlog.txt as I'd like to inspect the file report for the python script I mentioned in the previous post.
Thank you so much !! It worked so well ! Here the log you ask for :
https://1drv.ms/t/c/479dc231d28804e9/IQDOSZ2NTZq8SLU_vxYnORD1AZxkulneUc8_76tFFO8BXUI?e=EL6NcH
It is something i need to be worried about ?
Thank you again !!
That script has poor detection but is definitely malware. VT report:
https://www.virustotal.com/gui/file/b9ed49353e5705a729075a68441ffc4be4286929d0119c0bfdce972b9de1e932
Basically it builds an identifier for your computer and phones home to its command and control. Further commands to execute are received. I've no idea what these commands would be without running the malware.
It would probably be best to assume that it could be an info stealer and to change any important passwords and use MFA where possible.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 75%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
Hi, following a suggestion from reddit, can you help me please. I have the same problems and would love help
https://drive.google.com/drive/folders/1GtIT6Rx2-H2Rn4yIH-rYTMa6I8PxRqXr?usp=sharing
You also have the Python based malware I mentioned in this post.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 76%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELR%3C/text%3E%3C/svg%3E)
Hello!
I hope you are well. Today I seem to have downloaded some kind of virus similar to the one described in this thread. We have been trying to remove it all day to no avail. Could you please provide a fixit? Heres the link to the files you need: https://drive.google.com/file/d/1VLkYYg5hxcLtEJeilMz5UHYSt91KQXu2/view?usp=sharing, https://drive.google.com/file/d/1y8SvvYL1jUPr_6S186SQO-d_EPSSiuYz/view?usp=sharing
Your help would be much appreciated!
You also have/had the Python based malware I mentioned in this post.
Thank you so much! This is such a relief. However, this python based malware, is this something I should be concerned about? How would I go about removing it?
It was removed with the Fixlist. Upload Fixlog.txt if you like me to check.
What I previously wrote still stands -
It would probably be best to assume that it could be/was an info stealer and to change any important passwords and use MFA where possible.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 46%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESI%3C/text%3E%3C/svg%3E)
Hi, could you make a fixlist for me as well please? I ran into the same problem. Sorry to bother you! https://drive.google.com/drive/folders/1M-qsE_tFEeH-2gCObaFV4fj-kdGj9on_?usp=sharing
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 27%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
hii , i have the same problem with same extension on chrome , this is the link for 2 files https://1drv.ms/f/c/35c8e2f09fdf7384/IgAZ6jgK8D1AQoWHyVIEkMG2AUhK0jBGmCuHTHRGS1uhA34?e=vwF5nG
@Serban Ilie there's also some adware installed yesterday that this will remove.
Also go into Windows Defender's exclusions and remove the path exclusion for C:\Users\LENOVO
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 40%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Sorry to bother you, but I am having the same issue. The scan paused at "scanning other areas" so I terminated it. But it still seems to get the log. Here is the linkhttps://drive.google.com/file/d/10fvd-u3UEC38BCitmDJlM3sMNDZgx3wP/view?usp=drive_link
This will remove the fake Norton extensions and an adware installer.
Fix.![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 70%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EUM%3C/text%3E%3C/svg%3E)
Hello, I seem to have the same problem. Sorry to bother you, but I hope you could help me :(
Here's the link:
https://drive.google.com/file/d/1oMVoYkgRZsaQlUJaylmWiwreVRpShPoj/view?usp=sharing
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 4%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi, I am also having trouble with this same problem. I was wondering if you could also help me.
Link: https://drive.google.com/drive/folders/1iCJI4l2EQOjOXT-w0kp9ntFbz3Nj-flx?usp=drive_link
It's up to you, if you click on threat quarantined there should be the option to restore it.
If you don't want to do that, we can see if Autoruns shows anything. Unfortunately it's nowhere near as comprehensive as Farbar.
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
I do not see any option to restore FRST64.exe. See below. If you know how to restore it let me know. Meanwhile I will try Autoruns now. Give me a few minutes.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
OK. I ran Autoruns. See link for the log file: https://drive.google.com/file/d/1cM0VrlJ_QKbP-gL4Axj7xqD2ROoTRbeE/view?usp=sharing
Please let me know what you find. Thank you.
Save the following fixlist in your Downloads folder then run FRST and click Fix.
https://drive.google.com/file/d/1u0qU7tyBKr0RhrMpRV-LmIowxng_H1Tz/view?usp=sharing
Thank you very much! the extension has been removed from both Edge and Chrome.
just some info/feedback for everyone:
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 81%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Hi, I have the same issues. Could you please help me. Big thanks for your help
https://drive.google.com/file/d/1d_rLMz-NQC53siAOrEbg05NgRyEtszmO/view?usp=sharing
It seems whatever that extension is, is blocking the download. Farbar is definitely not malware.
If you have Microsoft Edge running, press ctrl + shift + N to open an inPrivate window.
Try downloading from the inPrivate window as all extensions will be disabled and shouldn't disrupt the download.
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Downloading Farbar is not a problem... I see it in my Downloads folder. The problem is my computer does not let me run it... thinks it is a virus. See below. Any other options? Thanks.
I am able to download it. When I double click to run it, I get this Blue window pop up, and then I click "run anyway".
After I click "Run anyway", I then get this window, and then the "FRST64.exe" file disappears from the Downloads folders.
Any other ideas? Thank you.
There's something odd going on that I can't reproduce on either of my Windows 11 installations.
Open up Windows 11 Virus & threat protection and click on Protection history.
Does it show any recent actions as far as quarantining or deleting FRST64.exe?
Yes, Protection history shows Threat blocked... looks like everytime I try to run FRST64.exe, the Windows Security blocks it.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 18%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJD%3C/text%3E%3C/svg%3E)
Hi, good day!
Please try to scan your computer for any virus or malware.
Please try to scan your system using Microsoft Safety Scanner or the free edition of Malwarebytes.
https://www.malwarebytes.com/mwb-download/
Microsoft Safety Scanner
https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download?view=o365-worldwide
After that, proceed with the steps below.
Press Windows key+R to open Run then type:
%localappdata%\Microsoft\Edge\
Make a backup of the User Data folder and save it on another location
After that delete the said folder on the path above
Please check if this fixes the issue.
I look forward to receiving your update and I'm willing to collaborate with you till we resolve the issue. Do keep me informed by clicking "Add comment" below.
Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.
It was working a few days ago... I cannot say exactly which day. I see a few new apps that were installed. Let me know if you see something unusual. One concern... why do I have TWO Co-pilot apps-see below??? Could one be a fake? I will run scan with your recommended software and then follow your instructions... will do in morning and let you know. Thank you!
Thanks for the update! That sounds great, go ahead and take your time with it in the morning. I’ll look forward to hearing how it goes once you’ve had a chance to run the scan.
OK. I downloaded and ran BOTH Microsoft Safety Scanner AND then Malwarebytes. Then I deleted the User Data folder at %localappdata%\Microsoft\Edge. After doing all this I still have the same issue with "Norton Safe Search Extension" on the Edge browser, and it is still locked so I cannot remove it. Looks like this Norton extension is hiding someplace where the malware scanning software cannot find it. Wow. Please let me know what else I may do?