This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 54%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Looks like my Browser has malware. The "Norton Safe Search Enhanced" extension is locked and does not let me remove it. I have tried running and scanning the Microsoft Windows Security software but it could not remove it. Please help!!
Both Edge and Chrome have this unwanted extension. Hopefully this resolves the issue.
If there's still a problem, please upload the resulting Fixlog.txt.
Great! This worked!! Thank you!!!
You're most welcome.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 73%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZY%3C/text%3E%3C/svg%3E)
hi i have the same problem and its also managed by an organisation but your answer doesnt help me?
i cant download fixlist bc if i click on the link it says this file doesnt exist and what is frst64.exe file??? i am pretty much a noob so can you explain more to help me?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 76%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVL%3C/text%3E%3C/svg%3E)
Hi, I'm having the same problem. I downloaded Farbar and it's scanning, but it gets stuck. Can you help me?
Try scanning in safe mode.
Right click the start button, hold down the shift key and select "Restart"
At the next screen select:
Troubleshoot => Advanced options => Startup Settings => Restart => press option 4 "Enable Safe Mode" or 5 "Enable Safe Mode with Networking"
Perfect, I did it. I uploaded the FRST and Addiction files to these links.
https://drive.google.com/file/d/1EROuKa2A2ugi3J5bfJRMoSFjogvlb3eC/view?usp=drive_link
https://drive.google.com/file/d/1Rq1GO7myNv_v88XJH7PZKCWXUSebhxEr/view?usp=drive_link
The problem is on both Edge and Chrome
This should resolve the issue. Please upload Fixlog.txt as I'd like to see what malware was running.
Great, I solved it. Thanks so much!! Here's the link to the fixlog.
https://drive.google.com/file/d/1A_40O4fqlKt8B-RXyUe_N9pprrupgxxq/view?usp=drive_link
I'm glad it's solved :) Unfortunately the javascript file is far too obfuscated to reveal its intent anytime soon.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 75%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
Hi, I have the same problem. I'm trying to follow your procedure but Farbar get stuck while scanning. I tried your directions to start scanning in "safe mode" but doesn't works. "Right click the start button, hold down the shift key and select "Restart"" I try right click on the start button (Scan?) but no windows open. Can you help?
Hold down shift + Right click the start button > Shut down or sign out > click Restart
or any of these methods which also apply to Windows 11.
https://www.digitalcitizen.life/4-ways-boot-safe-mode-windows-10/
If any related problems remain after running the Fixlist, upload Fixlist.txt
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 33%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
If you're still keeping up with this, here's a google docs with my .txt output. https://drive.google.com/drive/folders/1xAj20KY8FgwLLl-bsvOOv0wKbXDvnuGy?usp=drive_link
@CelestialLife
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 81%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELR%3C/text%3E%3C/svg%3E)
Hi everyone, i had the same issue, i already scan with FRST and generated the two files FRST.txt and Addition.txt, then i uploaded the files and these are the shared links, could you please tell me how i can get the Fixlist.txt now? Thank you so much in advance!
https://drive.google.com/file/d/1xXsVXdJCdHmNav-GIiWnvpoMppvvUuyC/view?usp=sharing
https://drive.google.com/file/d/1nmmGoNsC7hwP1vnnuKyyOV_JTtoROryO/view?usp=sharing
@Luigi
Do you know what these entries are?
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
Hi, I ran the instructions and the problem was solved. Thank you so much. No, sorry I don't know the origin of these links
You're welcome. We'll remove those entries.
Copy all the code text below then run FRST64.exe and click Fix.
start::
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
end::
I can't access the link. If the Fixlog indicates success, it's all good.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 77%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Can you help me? both Edge and Chrome has it.
here's my FRST and Addition: https://gofile.io/d/YlVd0z
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 84%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
please help me tooAddition.txt
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 62%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEO%3C/text%3E%3C/svg%3E)
Please help me i have downloaded frst .txt and Addition. the norton thing is pissing me of pls help!! the link below
https://drive.google.com/file/d/19L2-etsC-IkUPRNRj35AcP5s7FcXw2LR/view?usp=sharing
https://drive.google.com/file/d/1qEflzrfJcc60iFK2yr_ZHzMzUk8cqN4x/view?usp=sharing
@Eyitayo Obadina Please change the file permissions as the logs are inaccessible.
@_AW_ the link should work now
Save Fixlist.txt to your Downloads folder then run FRST64.exe and click Fix.
it worked thank you so much
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 21%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Hi I need help also cant get rid of this fake norton extension here are my frst and addition
https://drive.google.com/file/d/1_cHCcwR1x2FfGig20VcD6lvngW6DAnbt/view?usp=sharing
https://drive.google.com/file/d/1RqwFIHNshD5fbUHsQpP6hwjmbqNMr3iA/view?usp=sharing
it worked thanks alot
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 6%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
Hi!
I have the same problem as the others :((
'Norton Safe Search Enhanced' extension that I never installed and can't remove, causing my browser to use 'Safey Search Engine'...
I used FRST and my 2 scans are here:
Could you help me with the Fixlist? :)
Do you know what could have put that in my browser? I have installed the same programs as on my other computer and the latter has no prob.
Save Fixlist.txt to your Downloads folder then run FRST64English.exe and click Fix.
The extension possibly came as a fake browser update popup.
It worked! thanks a lot, you helped very quickly :)
And okay, I don't remember exactly what happened but I wondered some days ago why Chrome was kind of 'reset', asking me again to sign in and none of my 2 profiles were connected. It may have been smth like that i thought legit.
See if this removes the extension.
Note: the commands run will force terminate any instance of Microsoft Edge.
Type powershell into search, then right click Windows Powershell and run as administrator.
Copy and paste in the following code then press enter.
Stop-Process -Name 'msedge' -Force;reg delete HKCU\SOFTWARE\Policies\Microsoft\Edge /f;reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f; reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f;
Open Edge and check for the extension.
Did it, but got the following ERROR's. After this I opened Edge, but still see "Norton Safe Search Enhanced" extension and it is locked. Was your Powershell command typed correctly? Thank you.
Yes it's all typed correctly. I assume you must not have had msedge running.
Run the following from an admin Windows Powershell:
reg query HKLM\SOFTWARE\Policies\Microsoft\Edge /s; reg query HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /s;
Post a screenshot.
Did it. See below for screen shot. Let me know if I need to be closing apps before running the Powershell commands? Let me know? Thank you.
See if the registry policy keys can be removed this way.
First download ExecTI - https://winaero.com/execti/
Scroll down the page and click on Download "ExecTI" then scroll down on the next page to Click here to download the file.
Run ExecTI and enter powershell.exe then click OK.
In the Powershell window run the command below:
reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f; reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f;
Then in Microsoft Edge enter into the Address bar edge://policy/ and click enter.
Click Reload Policies.
OK. Did it. FYI, in the Powershell I again got ERRORS. See below...
After this I went to Edge and edge://policy/, and clicked Reload Policies, and get this screen.
Let me know if need any more info??? I still see "Norton Safe Search Enhanced" extension and it is locked. thank you.
It's those policy keys that need to be removed. Once they're removed the extension will be gone.
Close Microsoft Edge, then open Task Manager and up the top enter msedge
Right click and End task on any Edge instances that may be running. After that try the Powershell commands again.
If you still have no luck, go into Defender and click on Threat quarantined and see if you can restore Farbar. Earlier you clicked on Threat blocked which doesn't have that option.
OK. End task on msedge, and the retry Powershell commands did not work... still get Errors in Powershell. Next was able to restore Farbar and run it, but it FREEZES while Scanning Other Area ... see below? It is stuck and I cannot even close the Farbar.. window. Any ideas?? Thank you.
Has it created even partially FRST.txt and Addition.txt?
You should be able to right click Farbar's icon in the Taskbar and End Task.
Only way I could end it was through the Task Manager. Yes, it did make the FRST and Addition files. See links below. Please let me know what you find. Thank you.
https://drive.google.com/file/d/1XV0CUM981DfSSQCm2Xi28jDk9Gr0TCIl/view?usp=sharing
https://drive.google.com/file/d/1TqL-i7dHDgFpQ44vxSOhLCVZ7cbe833_/view?usp=sharing