Managing browser extensions in Microsoft Edge on Windows 11
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Looks like my Browser has malware. The "Norton Safe Search Enhanced" extension is locked and does not let me remove it. I have tried running and scanning the Microsoft Windows Security software but it could not remove it. Please help!!
Managing browser extensions in Microsoft Edge on Windows 11
Thank you! I did the Scan. Here is the links:https://drive.google.com/file/d/1iIJEKVg4URrFyCz3IwTIlWAW64eS-MbP/view?usp=drive_link
https://drive.google.com/file/d/1hi1qwUxK8329-MFHyBqFtdio7-gtdQ5t/view?usp=drive_link
Thank you very much!!!
@gai gai Did you setup the proxy server and AutoConfigURL entries? If you did, let me know and I'll adjust the Fixlist.
Fix.It works! Thank you very much! You make my PC!
Both Edge and Chrome have this unwanted extension. Hopefully this resolves the issue.
If there's still a problem, please upload the resulting Fixlog.txt.
You're most welcome.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Good luck :)
hi i have the same problem and its also managed by an organisation but your answer doesnt help me?
i cant download fixlist bc if i click on the link it says this file doesnt exist and what is frst64.exe file??? i am pretty much a noob so can you explain more to help me?
Hi, I'm having the same problem. I downloaded Farbar and it's scanning, but it gets stuck. Can you help me?
Try scanning in safe mode.
Right click the start button, hold down the shift key and select "Restart"
At the next screen select:
Troubleshoot => Advanced options => Startup Settings => Restart => press option 4 "Enable Safe Mode" or 5 "Enable Safe Mode with Networking"
Perfect, I did it. I uploaded the FRST and Addiction files to these links.
https://drive.google.com/file/d/1EROuKa2A2ugi3J5bfJRMoSFjogvlb3eC/view?usp=drive_link
https://drive.google.com/file/d/1Rq1GO7myNv_v88XJH7PZKCWXUSebhxEr/view?usp=drive_link
The problem is on both Edge and Chrome
This should resolve the issue. Please upload Fixlog.txt as I'd like to see what malware was running.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Great, I solved it. Thanks so much!! Here's the link to the fixlog.
https://drive.google.com/file/d/1A_40O4fqlKt8B-RXyUe_N9pprrupgxxq/view?usp=drive_link
I'm glad it's solved :) Unfortunately the javascript file is far too obfuscated to reveal its intent anytime soon.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Hi, I have the same problem. I'm trying to follow your procedure but Farbar get stuck while scanning. I tried your directions to start scanning in "safe mode" but doesn't works. "Right click the start button, hold down the shift key and select "Restart"" I try right click on the start button (Scan?) but no windows open. Can you help?
Hold down shift + Right click the start button > Shut down or sign out > click Restart
or any of these methods which also apply to Windows 11.
https://www.digitalcitizen.life/4-ways-boot-safe-mode-windows-10/
If any related problems remain after running the Fixlist, upload Fixlist.txt
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
If you're still keeping up with this, here's a google docs with my .txt output. https://drive.google.com/drive/folders/1xAj20KY8FgwLLl-bsvOOv0wKbXDvnuGy?usp=drive_link
@CelestialLife
Hi everyone, i had the same issue, i already scan with FRST and generated the two files FRST.txt and Addition.txt, then i uploaded the files and these are the shared links, could you please tell me how i can get the Fixlist.txt now? Thank you so much in advance!
https://drive.google.com/file/d/1xXsVXdJCdHmNav-GIiWnvpoMppvvUuyC/view?usp=sharing
https://drive.google.com/file/d/1nmmGoNsC7hwP1vnnuKyyOV_JTtoROryO/view?usp=sharing
@Luigi
Do you know what these entries are?
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac
Hi, I ran the instructions and the problem was solved. Thank you so much. No, sorry I don't know the origin of these links
You're welcome. We'll remove those entries.
Copy all the code text below then run FRST64.exe and click Fix.
start::
AutoConfigURL: [{38101BE0-6A95-451E-A2A1-6C69B1417AD9}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
AutoConfigURL: [{798F68F9-9688-484F-9E2B-66FBF3D58ED6}] => hxxp://127.0.0.1:62134/CPREBUILT.pac <==== ATTENTION
end::
I can't access the link. If the Fixlog indicates success, it's all good.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
Can you help me? both Edge and Chrome has it.
here's my FRST and Addition: https://gofile.io/d/YlVd0z
Please help me i have downloaded frst .txt and Addition. the norton thing is pissing me of pls help!! the link below
https://drive.google.com/file/d/19L2-etsC-IkUPRNRj35AcP5s7FcXw2LR/view?usp=sharing
https://drive.google.com/file/d/1qEflzrfJcc60iFK2yr_ZHzMzUk8cqN4x/view?usp=sharing
@Eyitayo Obadina Please change the file permissions as the logs are inaccessible.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
@_AW_ the link should work now
Save Fixlist.txt to your Downloads folder then run FRST64.exe and click Fix.
Hi I need help also cant get rid of this fake norton extension here are my frst and addition
https://drive.google.com/file/d/1_cHCcwR1x2FfGig20VcD6lvngW6DAnbt/view?usp=sharing
https://drive.google.com/file/d/1RqwFIHNshD5fbUHsQpP6hwjmbqNMr3iA/view?usp=sharing
Hi!
I have the same problem as the others :((
'Norton Safe Search Enhanced' extension that I never installed and can't remove, causing my browser to use 'Safey Search Engine'...
I used FRST and my 2 scans are here:
Could you help me with the Fixlist? :)
Do you know what could have put that in my browser? I have installed the same programs as on my other computer and the latter has no prob.
Save Fixlist.txt to your Downloads folder then run FRST64English.exe and click Fix.
The extension possibly came as a fake browser update popup.
It worked! thanks a lot, you helped very quickly :)
And okay, I don't remember exactly what happened but I wondered some days ago why Chrome was kind of 'reset', asking me again to sign in and none of my 2 profiles were connected. It may have been smth like that i thought legit.
Hi, i'm french and i have the same problem on Edge. Please help me.
Hey I am having the same issue, below is a link to my FRST txt files
https://1drv.ms/f/c/cee60e46ef5ba19a/IgCKbsG-6ICfTYDZBmQ9z5muAab-g2cGyJE0RsIaIhNcv7Y?e=UXBDJj
hello..i still have the problem
find attached the fixlog.. hope you can help me. thanks
You need to use a Fixlist written specifically for you, not just some random Fixlist you've found on the internet.
Please follow the instructions in the following post and provide logs for analysis. I will then write a Fixlist for you.
Hi, I've done the scan and these are my addition and FRST logs.
https://drive.google.com/file/d/1iQhc3Rls5gDK6xYxNo6yDkMqpM0tb6bj/view?usp=sharing
https://drive.google.com/file/d/1NuNScRDhYOMGz92fxZI_56uOY0q3No4g/view?usp=sharing
hi
I hope I did it right this time..my last try ..too difficult for me ;(
I attached in different ways hope there is one that works.....':D
I have scanned in safe mode
https://drive.google.com/file/d/1HFEGrP-eo9f8EvOHnUC8gIiqMDUcvT1j/view?usp=drive_link
https://drive.google.com/file/d/1HFEGrP-eo9f8EvOHnUC8gIiqMDUcvT1j/view?usp=sharing
https://drive.google.com/file/d/1KMhFmNAiYS2E54ZIcofStSeSclYZqXU9/view?usp=sharing, https://drive.google.com/file/d/1rK9JR3UnIV7kym46xOvnOhfiTl1SHqS9/view?usp=sharing
thanks! you saved my life....
it worked...
it still existed in the web search list but I have managed to cancel it.
Is there anything else that I have to do? Do I have to change passwords on websites?
Stefi
You can also delete the file -
C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\dsue.crx
I don't think you need to change passwords, though if you feel so inclined, it certainly won't hurt.
To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
:)
Hello, I'm having the same problem that Edge and Chrome are blocking and redirecting my browsers due to Safety Search Enhanced in the extensions. Could you please help me?
https://1drv.ms/f/c/8fb23ba4c2f60dfa/IgBSQMqR-ij8QrNdOU9_TpUVAcNGo1WQ4jnhVA1ld9iK6xE?e=1Hkr4X
Uninstall Cookie A.Q as it's a PUA/Adware that was likely installed with something else.
Hi I have the same problem on both Edge and Chrome ,thanks in advance!
https://drive.google.com/file/d/1oe29ub1Ck4lKgiag9UTZoc2NLeP3NWJq/view?usp=drive_link, https://drive.google.com/file/d/1QUHI3FWKt81yZyin5x2WHcnayRIFSsNg/view?usp=drive_link
Fix.Thanks ,it worked ,I also reported it to google before I found this thread ,I hope it gets sorted soon.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
hi, i also have this problem on edge and chrome, hopefully i got your instructions write and in this the right file i got from farbar.
https://drive.google.com/file/d/1OLR5GIseokxk8sW2QIeGSbR5yaQkfrSf/view?usp=sharing
Fix.The problem seems to be fixed, Thank You Very Much!
I also have this problem on Edge. i got you instructions and hope you can help me
Hello, im having the same problem. This is the link for the frst and addition files.
https://drive.google.com/drive/folders/1UcI2JAe611R2kzSKsWrM92owRAIijug1?usp=drive_link
No it says access denied.
There are multiple infections to remove. Go into your installed apps and uninstall these PUAs -
Quick Driver Updater - https://malwaretips.com/blogs/remove-quick-driver-updater/
Web Companion
OneBrowser
Please upload Fixlog.txt so I can check if any further action is needed.
HI! omg such a relief to find this thread! I´m having the same problem and it's been a nightmare, can you please help me fix it?
Here's the link with the ZIP files, I ran Farbar from safe mode. Let me know if you need anything else. Thanks again! Also, how do I prevent this from happening again?
Fix.how do I prevent this from happening again?
Avoid warez sites, cracked software. Be wary with game mod sites as malware sometimes gets uploaded to them. Download software from the author of the software where possible or highly regarded download sites.
-
Fix.Hi, I have the same issues. Could you please help me?
Big thanks for everything.
https://drive.google.com/file/d/1d_rLMz-NQC53siAOrEbg05NgRyEtszmO/view?usp=sharing
Hello, i have the same issue, here is the files. https://we.tl/t-8Gcz9fIBg3
Can someone help me ?
Fix.Looks like working but i can't restart Edge or reinstall google chrome now. I try to reinstall Edge but it won't work. Any Ideas ? I have a recent backup of my computer, i thinks i'm gonna use it :)
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
2 deleted commentsComments have been turned off. Learn more
See if the registry policy keys can be removed this way.
First download ExecTI - https://winaero.com/execti/
Scroll down the page and click on Download "ExecTI" then scroll down on the next page to Click here to download the file.
Run ExecTI and enter powershell.exe then click OK.
In the Powershell window run the command below:
reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f; reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f;
Then in Microsoft Edge enter into the Address bar edge://policy/ and click enter.
Click Reload Policies.
OK. Did it. FYI, in the Powershell I again got ERRORS. See below...
After this I went to Edge and edge://policy/, and clicked Reload Policies, and get this screen.
Let me know if need any more info??? I still see "Norton Safe Search Enhanced" extension and it is locked. thank you.
It's those policy keys that need to be removed. Once they're removed the extension will be gone.
Close Microsoft Edge, then open Task Manager and up the top enter msedge
Right click and End task on any Edge instances that may be running. After that try the Powershell commands again.
If you still have no luck, go into Defender and click on Threat quarantined and see if you can restore Farbar. Earlier you clicked on Threat blocked which doesn't have that option.
OK. End task on msedge, and the retry Powershell commands did not work... still get Errors in Powershell. Next was able to restore Farbar and run it, but it FREEZES while Scanning Other Area ... see below? It is stuck and I cannot even close the Farbar.. window. Any ideas?? Thank you.
Has it created even partially FRST.txt and Addition.txt?
You should be able to right click Farbar's icon in the Taskbar and End Task.
Only way I could end it was through the Task Manager. Yes, it did make the FRST and Addition files. See links below. Please let me know what you find. Thank you.
https://drive.google.com/file/d/1XV0CUM981DfSSQCm2Xi28jDk9Gr0TCIl/view?usp=sharing
https://drive.google.com/file/d/1TqL-i7dHDgFpQ44vxSOhLCVZ7cbe833_/view?usp=sharing
Hi, i have this same problem
I try reg delete and "Access denied"
I try FRST but in desperation, I deleted the "Norton Safe Search Enhanced" extension folders, but that didn't help. In fact, now FRST doesn't detect this extension. What should I do?
See if this removes the extension.
Note: the commands run will force terminate any instance of Microsoft Edge.
Type powershell into search, then right click Windows Powershell and run as administrator.
Copy and paste in the following code then press enter.
Stop-Process -Name 'msedge' -Force;reg delete HKCU\SOFTWARE\Policies\Microsoft\Edge /f;reg delete HKLM\SOFTWARE\Policies\Microsoft\Edge /f; reg delete HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /f;
Open Edge and check for the extension.
Did it, but got the following ERROR's. After this I opened Edge, but still see "Norton Safe Search Enhanced" extension and it is locked. Was your Powershell command typed correctly? Thank you.
Yes it's all typed correctly. I assume you must not have had msedge running.
Run the following from an admin Windows Powershell:
reg query HKLM\SOFTWARE\Policies\Microsoft\Edge /s; reg query HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge /s;
Post a screenshot.
Did it. See below for screen shot. Let me know if I need to be closing apps before running the Powershell commands? Let me know? Thank you.