Chrome says managed by organization and odd error messages

First, I did do the steps on this page here for the "your browser is managed by your organization"

here is that url I used :

https://malwaretips.com/blogs/remove-managed-by-your-organisation-virus/

other than defender and one other item that Hitman fixed, there were no errors or malware found in the various steps.  But alas after reboot still have the "your browser is managed by your organization" message on my laptop.   And it is my personal one, so obviously no company, etc etc

Also various error messages appear.  Usually during boot up - like a file is missing.   I tried to screen capture it but alas failed.  Will try to capture with camera from phone when it reappears.

Also it seems I have Microsoft Defender Smartscreen running (very annoying to get it to run FRST!) as well as McAfee running.

Here is the log files from FRST :

(FRST Log file) :

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

• Please download AdwCleaner and save it to your Desktop
• Close all open programs and browsers
• Right click on the icon and select Run as administrator
• Click Scan now
• Allow the program to Quarantine what it finds except for Pre-installed applications if you would like to keep those or other entries you would like to keep
• When completed click View Scan Log File
• Copy and paste the contents in your reply
• Click Skip Basic Repair if it appears then close the program

• Launch Chrome
• In the address bar type chrome://settings/content/notifications and hit Enter
• Scroll down to Allowed to send notifications
• For any entry you are not familiar with or do not want click on the 3 horizontal dots to the right and select Remove

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CreateRestorePoint:
CloseProcesses:
AV: Norton Security Online (Enabled - Up to date) {1122B19A-E671-38EC-8EAC-87048FD4528D}
AV: Norton Security Online (Enabled - Up to date) {A2708B76-6835-6565-CB96-694212954A75}
AV: Norton Security Online (Disabled - Out of date) {9E3FD331-C4C2-7AC4-0537-131EEF1B1F8A}
FW: Norton Security Online (Enabled) {9A4B0A53-225A-643D-E0C9-C077EC460D0E}
FW: Norton Security Online (Disabled) {A6045214-8EAD-7B9C-2E68-BA2B11C858F1}
FW: Norton Security Online (Enabled) {291930BF-AC1E-39B4-A5F3-2E31710715F6}
SearchScopes: HKU\S-1-5-21-4201938413-1014792726-983612931-1001 -> DefaultScope {0AEC0748-8799-4A9C-995C-36202654768C} URL = 
SearchScopes: HKU\S-1-5-21-4201938413-1014792726-983612931-1001 -> {0AEC0748-8799-4A9C-995C-36202654768C} URL 
SearchScopes: HKU\S-1-5-21-4201938413-1014792726-983612931-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&l=dis&prt=NGC&chn=1122&geo=US&ver=22.19.9.63&locale=US_en&guid=5A0C022F-93D9-43AF-A1CC-213DC04E7B70&doi=2016-09-01&o=APN11913&gct=kwd&qsrc=2869
FirewallRules: [{618B5357-098B-4F66-A4BC-9A98DB363F1A}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{EF111DC1-C32C-477A-851C-62DD0D7D07B3}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File
FirewallRules: [{33183412-9E4D-4137-A1B9-149833CB8B05}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File
HKU\S-1-5-21-4201938413-1014792726-983612931-1001\...\Run: [{5E9C47D5-C2A3-4B5B-9646-23F9F5362F1A}] => C:\Users\cofun\Downloads\MTGAInstaller.exe
HKU\S-1-5-21-4201938413-1014792726-983612931-1001\...\Run: [] => [X] 
S4 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\116.1.57.62\elevation_service.exe" [X] 
HKLM\...\Print\Monitors\HP B111 Status Monitor: hpinkstsB111LM.dll (No File) 
Task: {AD038E73-97A7-4C22-B781-24530923FEEA} - System32\Tasks\IPVanish.VpnClient => C:\Program Files\IPVanish VPN\IPVanish.VpnClient.exe  --taskscheduler (No File) 
Task: {88284482-8E40-4918-85AD-DF86BF9D9AC0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe  --automatic (No File) 
CustomCLSID: HKU\S-1-5-21-4201938413-1014792726-983612931-1001_Classes\CLSID\{62fea752-045e-95c0-525b-b17487673e6e1}\InprocServer32 -> 0xEDC4BC1F8704D701CE39BD1F8704D701010000000300000000000000 => No File 
CustomCLSID: HKU\S-1-5-21-4201938413-1014792726-983612931-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\cofun\AppData\Local\GoToMeeting\19228\G2MOutlookAddin64.dll => No File 
CustomCLSID: HKU\S-1-5-21-4201938413-1014792726-983612931-1001_Classes\CLSID\{f00dfd40-8892-a2fb-f1ee-dbad4ab9f83d1}\InprocServer32 -> 0x5831555555555557454C5145324B36564341554155555452393834574446303947573839 => No File 
Toolbar: HKU\S-1-5-21-4201938413-1014792726-983612931-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File 
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found] 
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found] 
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found] 
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found] 
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
DeleteKey: HKEY_CURRENT_USER\Software\Google\Chrome
DeleteKey: HKEY_CURRENT_USER\Software\Policies\Google
DeleteKey: HKEY_LOCAL_MACHINE\Software\Google\Chrome
DeleteKey: HKEY_LOCAL_MACHINE\Software\Policies\Google
DeleteKey: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Enrollment
DeleteValue: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}|CloudManagementEnrollmentToken
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallWhitelist
DeleteKey: HKEY_USERS\S-1-5-21-757262739-2975744681-2449658496-1000\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
DeleteKey: HKEY_USERS\S-1-5-21-757262739-2975744681-2449658496-1000\SOFTWARE\Policies\Google\Chrome\ExtensionInstallWhitelist
C:\ProgramFiles (x86)\Google\Policies
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION 
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Emptytemp:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Note: The Emptytemp: command will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.

• AdwCleaner log
• Chrome Notifications reviewed?
• Fixlog
• Update on computer/Chrome behavior

okay - will try to remember to check every day

here is the adwcleaner log - found only pre installed items - don't mind them being quaranteen (sp) - can always reinstall them afterwards, if necessary.

I loaded up FRST64 and did the highlight the items above and did a ctrl C but fix button never enabled.  Should I copy it to the search ??

NEVER MIND - the Fix button looked Greyed out when it was just a darker color.  So did get the FRST64 to run the fix.  Log is below....

 Did the chrome and deleted various entries that looked suspicious or I didn't know.

FRST fix log follows :

Edited by TomV22, 11 September 2023 - 09:21 PM.

If memory serves, it was on the password page that it said those words.  Just went there and it appears to be gone.

The only thing I have noticed, is that it seems like I have to hit items like close window X button numerous times (2-3 times or more) before it closes.   Or having to select a button like reply multiple times before it will respond.   More so in the past few days, including yesterday while running the various programs.

Thomas

mouse

• Remove all external mice
• Press the Windows Key + R at the same time
• Type devmgmt.msc and press Enter
• Expand the Mice and other pointing devices section by clicking + sign
• Right click on each entry, select Uninstall, then OK
• Reboot your computer
• Reconnect your external mouse
• Check your computer performance

• Results

okay - did the below for the mouse this morning (Wed Sept 13)

While deleting, in the device management screen, the top folder kept closing and opening.  I presume that was due to deleting of the mouses (mice)?

And now I see the same 3 devices under mouse.  One i believe is the touch pad and the 2 HID Compliant mouses.  I do use a Logitech mouse and keyboard off this one USB plug in device.   Would that cause that ?

Also Hitman keeps running every time I boot up and keeps squawking about ILPrint driver.  I know that driver is necessary for printing for Inventory Lab.  Even though I tell HitMan to ignore it, every reboot it keeps flagging it as an issue.  Should I remove hitman ?

Thomas

Something odd is going on with Chrome.  At times it works great - responsive.

other times slower than a dog - as in can't even open a window to go to google.   Just constant spin spin spin.   

And it's either all good or all bad.    Could chrome browser gotten infected  and maybe needs a reinstall (don't want to lose my extentsions / passwords) ?

also when I did the mouse reload, there was a windows update that occurred as well....

Thomas

Edited by TomV22, 13 September 2023 - 10:36 AM.

Mouse - yes. 

Chrome is either slow or okay.  Every reboot it stays the same.  Have like 8-10 tabs open on 1 page.  

• Hit the Windows Key + R at the same time
• In the Run box type or copy/paste chrome --disable-extensions and hit Enter
• Let me know if Chrome works properly

• Results?