Parfumeur

All right! Thanks .... Once again I had to restore from my Acronis back-up, and now seems to be running OK. The browser hijack is still there with the Malwarebyte pop up warning when I open Chrome and access some sites... it's randoms. A tid bit of info. Usually, after 2-3 minutes after my log into Windows, I get a warning that the Firewall is turned off. BUT when I immediately check [Settings] it says it's turned on. ?! The last time it froze, (and ths happens often, the graphics card fan turns on, the laptop gets hot, mouse slows to a crwal or freezes as if some i/o is taking a looooong time. I then am forced to reboot. This damn Lenovo W540 has an awful track pad, and no I/O disk light , so I never know if the disk is being accessed. Impossible these days to find a laptop wiht a drive access light! AV_block_remove_2024.03.16-00.57.log

Hi Porthos, Here is the file. After I created the [mbst-grab-results.zip], my mouse started stuttering with long delays to my motions/entries, while trying to attach it here. Had to reboot, then got in a loop with the BSOD: CRITICAL_PROCESS_DIED. Now in a loop, cannot boot. I had to extract the file in safe mode to a USB, and I'm now on another system to send it. mbst-grab-results.zip

I did follow instructions and mailed it. Maybe I skipped a step in sending it? Since I restored, and the 'coolsearches' issue is still there, I'll create a new file for you. 'Merci' Porthos.

I did follow instructions and mailed it. Maybe I skipped a step in sending it? Since I restored, and the 'coolsearches' issue is still there, I'll create a new file for you. 'Merci' Porthos.

Sorry, "Portos", should have been 'Porthos'. Dumas would have not been happy!

Hi Portos.... Thank you for looking into this. I did restore from a backup dated 2/27/2024. AND removed al lot of obsolete files/apps. Rebooted, then ran Chrome, at first it was fine then on the 3rd-4th try, the 'coolsearches' popped up, duly blocked by Malware bytes. Got a feeling it's activated either by what was searched, time on line, or some other delaying factor. AND this was from the backup (using Acronis). Maybe I should restore from an earlier date and see what happens.

This week I keeo getting a browser highjack: coolsearches > IP 3.95.119.220 Which is not detected by ADWCleaner or Malwarebytes. There is no program (app) by that name, nor any mention in my browser Chrome in the add-ons or extensions. Seach for those strings in the registry did not find anything. Any help or hint much appreciated!