Browser Extension has taken over my Address Bar through possible Broswer Hijack - Virus, Trojan, Spyware, and Malware Removal Help (2024)

For the open firewall ports, how can I ID what these ports are so I can see if I know what they are? I haven't looked too far into my ports before so I'm not sure if I need them open or not.

I have run the Fix through FRST and it did clear the issue on Chrome and it is working okay for now, however, Edge is still redirecting and is still "managed by your organization". In the extensions on Edge, it shows a greyed out extension called "Simple New Tab" and I can't remove it or change any settings with it.

I have also uninstalled Adobe Flash Player.

Here's the result of the FRST fix:

Fix result of Farbar Recovery Scan Tool (x64) Version: 19.04.2024 01

Ran by Garrett's PC (20-04-2024 10:58:19) Run:1

Running from C:\Users\Garrett's PC\Desktop

Loaded Profiles: Garrett's PC & SQLTELEMETRY$SQLEXPRESS & MSSQL$SQLEXPRESS

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start::

SystemRestore: On

CreateRestorePoint:

CloseProcesses:

Folder: C:\Users\Garrett's PC\AppData\Local\OAC

Folder: C:\Users\Garrett's PC\AppData\LocalLow\For Fun Labs

Task: {C9FF2BDD-2B05-4EDD-B4D0-C727514EE79F} - System32\Tasks\NvOptimizerTaskUpdater_V2 => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [455680 2024-02-17] (Microsoft Windows -> Microsoft Corporation) -> -File C:/Windows/System32/NvWinSearchOptimizer.ps1 <==== ATTENTION

2024-04-11 14:24 - 2024-04-11 14:24 - 000000271 _____ C:\WINDOWS\system32\NvWinSearchOptimizer.ps1

2024-04-11 14:24 - 2024-04-11 14:24 - 000003586 _____ C:\WINDOWS\system32\Tasks\NvOptimizerTaskUpdater_V2

2024-04-11 14:24 - 2024-04-11 14:24 - 000001882 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VLC.lnk

2024-04-11 14:24 - 2024-04-11 14:24 - 000000000 ____D C:\WINDOWS\NvOptimizerLog

2024-04-11 14:24 - 2024-04-11 14:24 - 000000000 ____D C:\Users\Garrett's PC\AppData\Local\vlc-updater

2024-04-11 14:24 - 2024-04-11 14:24 - 000000000 ____D C:\Users\Garrett's PC\AppData\Local\TaskUpdater

2024-04-14 22:27 - 2024-04-14 22:27 - 000000000 ____D C:\WINDOWS\InternalKernelGrid4

ShortcutWithArgument: C:\Users\Garrett's PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --google-base-url=hxxps://qtrsearch.com --extensions-on-chrome-urls --load-extension=C:\Windows\InternalKernelGrid4

ShortcutWithArgument: C:\Users\Garrett's PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --google-base-url=hxxps://qtrsearch.com --extensions-on-chrome-urls --load-extension=C:\Windows\InternalKernelGrid4

ShortcutWithArgument: C:\Users\Garrett's PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\63e1f6e8d7f2f9e7\Honey.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --google-base-url=hxxps://qtrsearch.com --extensions-on-chrome-urls --load-extension=C:\Windows\InternalKernelGrid4

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --google-base-url=hxxps://qtrsearch.com --extensions-on-chrome-urls --load-extension=C:\Windows\InternalKernelGrid4

ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --google-base-url=hxxps://qtrsearch.com --extensions-on-chrome-urls --load-extension=C:\Windows\InternalKernelGrid4

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION

AlternateDataStreams: C:\Logs:err [1154]

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [274]

AlternateDataStreams: C:\Users\Garrett's PC\Downloads\avg_antivirus_free_setup.exe:MBAM.Zone.Identifier [213]

AlternateDataStreams: C:\Users\Garrett's PC\Downloads\CCSetup.exe:MBAM.Zone.Identifier [143]

AlternateDataStreams: C:\Users\Garrett's PC\Downloads\ccsetup623.exe:MBAM.Zone.Identifier [215]

AlternateDataStreams: C:\Users\Garrett's PC\Downloads\spybotsd_2.9.85.5.exe:MBAM.Zone.Identifier [321]

AlternateDataStreams: C:\Users\Garrett's PC\Downloads\spywareblastersetup60.exe:MBAM.Zone.Identifier [322]

AlternateDataStreams: C:\Users\Public\AppData:CSM [120]

AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [466]

Task: {66B84CFC-3A3D-4B14-883B-2323AB78C3D3} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION

Task: {F4D2A29D-AD41-421B-851C-B83A5787B789} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe (No File)

Task: {F61E5179-8E0B-494A-B3AB-EB022280C611} - System32\Tasks\MySQLNotifierTask => "C:\Program Files (x86)\MySQL\MySQL Notifier 1.1MySQLNotifier.exe" --c (No File)

ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

ContextMenuHandlers2: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

ContextMenuHandlers2: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => -> No File

ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> No File

S3 cpuz149; \??\C:\Users\GARRET~1\AppData\Local\Temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION

S3 cpuz152; \??\C:\WINDOWS\temp\cpuz152\cpuz152_x64.sys [X] <==== ATTENTION

S3 cpuz157; \??\C:\WINDOWS\temp\cpuz157\cpuz157_x64.sys [X] <==== ATTENTION

S1 EneTechIo; \??\C:\WINDOWS\system32\drivers\ene.sys [X]

S3 hsstap; \SystemRoot\System32\drivers\hsstap.sys [X]

cmd: netsh winsock reset catalog

cmd: netsh int ip reset C:\resettcpip.txt

cmd: Bitsadmin /Reset /Allusers

cmd: ipconfig /flushdns

Removeproxy:

Emptytemp:

End::

*****************

SystemRestore: On => completed

Restore point was successfully created.

Processes closed successfully.