This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 54%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Looks like my Browser has malware. The "Norton Safe Search Enhanced" extension is locked and does not let me remove it. I have tried running and scanning the Microsoft Windows Security software but it could not remove it. Please help!!
Both Edge and Chrome have this unwanted extension. Hopefully this resolves the issue.
If there's still a problem, please upload the resulting Fixlog.txt.
Great! This worked!! Thank you!!!
You're most welcome.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 73%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZY%3C/text%3E%3C/svg%3E)
hi i have the same problem and its also managed by an organisation but your answer doesnt help me?
i cant download fixlist bc if i click on the link it says this file doesnt exist and what is frst64.exe file??? i am pretty much a noob so can you explain more to help me?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 76%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVL%3C/text%3E%3C/svg%3E)
Hi, I'm having the same problem. I downloaded Farbar and it's scanning, but it gets stuck. Can you help me?
Try scanning in safe mode.
Right click the start button, hold down the shift key and select "Restart"
At the next screen select:
Troubleshoot => Advanced options => Startup Settings => Restart => press option 4 "Enable Safe Mode" or 5 "Enable Safe Mode with Networking"
Perfect, I did it. I uploaded the FRST and Addiction files to these links.
https://drive.google.com/file/d/1EROuKa2A2ugi3J5bfJRMoSFjogvlb3eC/view?usp=drive_link
https://drive.google.com/file/d/1Rq1GO7myNv_v88XJH7PZKCWXUSebhxEr/view?usp=drive_link
The problem is on both Edge and Chrome
This should resolve the issue. Please upload Fixlog.txt as I'd like to see what malware was running.
Great, I solved it. Thanks so much!! Here's the link to the fixlog.
https://drive.google.com/file/d/1A_40O4fqlKt8B-RXyUe_N9pprrupgxxq/view?usp=drive_link
I'm glad it's solved :) Unfortunately the javascript file is far too obfuscated to reveal its intent anytime soon.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 75%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
Hi, I have the same problem. I'm trying to follow your procedure but Farbar get stuck while scanning. I tried your directions to start scanning in "safe mode" but doesn't works. "Right click the start button, hold down the shift key and select "Restart"" I try right click on the start button (Scan?) but no windows open. Can you help?
Hold down shift + Right click the start button > Shut down or sign out > click Restart
or any of these methods which also apply to Windows 11.
https://www.digitalcitizen.life/4-ways-boot-safe-mode-windows-10/
If any related problems remain after running the Fixlist, upload Fixlist.txt
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 33%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
If you're still keeping up with this, here's a google docs with my .txt output. https://drive.google.com/drive/folders/1xAj20KY8FgwLLl-bsvOOv0wKbXDvnuGy?usp=drive_link
@CelestialLife
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 81%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELR%3C/text%3E%3C/svg%3E)
Hi everyone, i had the same issue, i already scan with FRST and generated the two files FRST.txt and Addition.txt, then i uploaded the files and these are the shared links, could you please tell me how i can get the Fixlist.txt now? Thank you so much in advance!
https://drive.google.com/file/d/1xXsVXdJCdHmNav-GIiWnvpoMppvvUuyC/view?usp=sharing
https://drive.google.com/file/d/1nmmGoNsC7hwP1vnnuKyyOV_JTtoROryO/view?usp=sharing
@Luigi
Do you know what these entries are?
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
Hi, I ran the instructions and the problem was solved. Thank you so much. No, sorry I don't know the origin of these links
You're welcome. We'll remove those entries.
Copy all the code text below then run FRST64.exe and click Fix.
start::
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
end::
I can't access the link. If the Fixlog indicates success, it's all good.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 77%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Can you help me? both Edge and Chrome has it.
here's my FRST and Addition: https://gofile.io/d/YlVd0z
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 84%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
please help me tooAddition.txt
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 62%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEO%3C/text%3E%3C/svg%3E)
Please help me i have downloaded frst .txt and Addition. the norton thing is pissing me of pls help!! the link below
https://drive.google.com/file/d/19L2-etsC-IkUPRNRj35AcP5s7FcXw2LR/view?usp=sharing
https://drive.google.com/file/d/1qEflzrfJcc60iFK2yr_ZHzMzUk8cqN4x/view?usp=sharing
@Eyitayo Obadina Please change the file permissions as the logs are inaccessible.
@_AW_ the link should work now
Save Fixlist.txt to your Downloads folder then run FRST64.exe and click Fix.
it worked thank you so much
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 18%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJD%3C/text%3E%3C/svg%3E)
Hi, good day!
Please try to scan your computer for any virus or malware.
Please try to scan your system using Microsoft Safety Scanner or the free edition of Malwarebytes.
https://www.malwarebytes.com/mwb-download/
Microsoft Safety Scanner
https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download?view=o365-worldwide
After that, proceed with the steps below.
Press Windows key+R to open Run then type:
%localappdata%\Microsoft\Edge\
Make a backup of the User Data folder and save it on another location
After that delete the said folder on the path above
Please check if this fixes the issue.
I look forward to receiving your update and I'm willing to collaborate with you till we resolve the issue. Do keep me informed by clicking "Add comment" below.
Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.
It was working a few days ago... I cannot say exactly which day. I see a few new apps that were installed. Let me know if you see something unusual. One concern... why do I have TWO Co-pilot apps-see below??? Could one be a fake? I will run scan with your recommended software and then follow your instructions... will do in morning and let you know. Thank you!
Thanks for the update! That sounds great, go ahead and take your time with it in the morning. I’ll look forward to hearing how it goes once you’ve had a chance to run the scan.
OK. I downloaded and ran BOTH Microsoft Safety Scanner AND then Malwarebytes. Then I deleted the User Data folder at %localappdata%\Microsoft\Edge. After doing all this I still have the same issue with "Norton Safe Search Extension" on the Edge browser, and it is still locked so I cannot remove it. Looks like this Norton extension is hiding someplace where the malware scanning software cannot find it. Wow. Please let me know what else I may do?
Please provide Farbar Recovery Scan Tool (FRST) logs for analysis.
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Note: If you are using Edge or Chrome, SmartScreen may initially block the download. Click on the three dots next to the warning and select Keep => Click the Delete drop arrow => Keep anyway.
Share OneDrive files and folders - Microsoft Support
** Farbar is a safe app utilized in most online malware removal forums.
I was able to download FRST64.exe, but I could not run it... i get pop up reading it contains a virus... see below. Any other ideas? Thanks.
It seems whatever that extension is, is blocking the download. Farbar is definitely not malware.
If you have Microsoft Edge running, press ctrl + shift + N to open an inPrivate window.
Try downloading from the inPrivate window as all extensions will be disabled and shouldn't disrupt the download.
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Downloading Farbar is not a problem... I see it in my Downloads folder. The problem is my computer does not let me run it... thinks it is a virus. See below. Any other options? Thanks.
I am able to download it. When I double click to run it, I get this Blue window pop up, and then I click "run anyway".
After I click "Run anyway", I then get this window, and then the "FRST64.exe" file disappears from the Downloads folders.
Any other ideas? Thank you.
There's something odd going on that I can't reproduce on either of my Windows 11 installations.
Open up Windows 11 Virus & threat protection and click on Protection history.
Does it show any recent actions as far as quarantining or deleting FRST64.exe?
Yes, Protection history shows Threat blocked... looks like everytime I try to run FRST64.exe, the Windows Security blocks it.
It's up to you, if you click on threat quarantined there should be the option to restore it.
If you don't want to do that, we can see if Autoruns shows anything. Unfortunately it's nowhere near as comprehensive as Farbar.
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
I do not see any option to restore FRST64.exe. See below. If you know how to restore it let me know. Meanwhile I will try Autoruns now. Give me a few minutes.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
OK. I ran Autoruns. See link for the log file: https://drive.google.com/file/d/1cM0VrlJ_QKbP-gL4Axj7xqD2ROoTRbeE/view?usp=sharing
Please let me know what you find. Thank you.
Save the following fixlist in your Downloads folder then run FRST and click Fix.
https://drive.google.com/file/d/1u0qU7tyBKr0RhrMpRV-LmIowxng_H1Tz/view?usp=sharing
Thank you very much! the extension has been removed from both Edge and Chrome.
just some info/feedback for everyone: