I can not delete the adware in an key under folder of Chrome

[Jack_Klauch]

I can not delete the adware in an key under folder of Chrome in the regestration editor, if I try to delete it is my access denied, if I want to change the owner the access is denied, and if I try it with the help of the registrar registry Manager to delete it, I get the error message ACCESS DENIED I want to delete the key permanently to eliminate the adware finally. The Adware cleaner is scanning the Adware but it can't remove it. I tried many programms but no one helped me, the Adware is still there. the Key Path is named: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

There may be more than just delete that file.

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Let me know what problems persists.

Wait for further instructions

[Jack_Klauch]

I cant open FRSST64 because of my Windows Defender

 

[nasdaq]

Hi,

If the downloaded was from the link I gave you, it's safe.

Get it back from the quarantine folder.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus

[Jack_Klauch]

Its not in my Quarante, I dont know how to disable it, do you have discord? I really need your help.

[Jack_Klauch]

Or any other Programm that you can help me better, and i really think this file in my Registry editor is the last part of the virus, i deletet over 100 FIles manual and this is the last one where it is not working, if it recreates it self i will destroy the other parts.

[Jack_Klauch]

Can you give me an anwser?

[AdvancedSetup]

@nasdaq is in Europe and it's the weekend @Jack_Klauch

The FRST program is very safe to use. Please temporarily disable Defender or SmartScreen if needed and download it, run it, post back the requested logs.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

[Jack_Klauch]

I cant Open the software, I tried 3 diferent ways to disable Smart Screen Windos Defender but i still cant open it

[Jack_Klauch]

I scanned but i think the software found Nothing, i also scanned the file in the registry wich i think is the adwar. here my Logs

 

Addition.txt FRST.txt SearchReg.txt

[AdvancedSetup]

Thanks, please be patient and @nasdaq should be along soon to help finish up with you

 

[nasdaq]

Hi,

Remove this program in bold via the Control Panel > Programs > Programs and Features.
NativeDesktopMediaService (HKLM-x32\...\{FC44DE72-60F9-4BC1-B098-D2F6B5A06187}) (Version: 3.5.0 - Jetmedia) <==== ACHTUNG
<<<>>>

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome

Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset and clean up" > "Restore settings to their original defaults"
 
Restart Chrome.
<<<>>>

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

[Jack_Klauch]

I cant Find the Programm you meaned, sorry. And can you send me  a download link from "Fixlist.txt" 

 

 

[nasdaq]

Hi,

The program must have been deleted without using the Add/Remove Programs applet.

It's only a entry from the Registry.

It's not active. If you wish to remove it from the Registry follow these instructions.

https://www.bleepingcomputer.com/tutorials/manually-remove-programs-from-add-remove-programs/

===

Click on the Fixlist.txt folder in the bottom of my previous post.

If you need it the the link is: 

https://forums.malwarebytes.com/applications/core/interface/file/attachment.php?id=277653

[Jack_Klauch]

Here Is the Fixlog 

Fixlog.txt

[nasdaq]

How is the computer running now?

[Jack_Klauch]

fine, but I dont think the Virus is completely gone

[Jack_Klauch]

And i still cant dele thisNot even with 

[nasdaq]

Hi,

This topic shows a solution to remove the com.microsoft.browsercore key.
https://answers.microsoft.com/en-us/windows/forum/all/network-administrator/2f1a3c46-2c09-4c54-94b6-43c6ee92ee0b?page=2

How to boot in the RE (Recovery Environment)

Boot the compromised PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference...

To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html

Set you eyes on this option.
Reset Windows 10 OPTION ONE  Reset Windows 10
To Reset Windows 10 at Boot

From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10

Select in this order
"Troubleshoot" > "Advance Options" > "Command Prompt"

Once in the command prompt

Run the Regedit and delete the com.microsoft.browsercore key

Save, Exit,  Regedit.

Hope that helps.

[Jack_Klauch]

i will do it when it starts again the Reset Of windows, because My friend helped me and showed me how to delete it , The AdwCleaner is still finding some 2 threats but when he is deleting them and i restartet after an hour he finds the same threads again.   

[Jack_Klauch]

Thank you a lot for your help, maybe you know how to delete this two last threads but if not i think i have to reset my pc and dowload eveything again 😕

[nasdaq]

I need to be able to see the text.

Can you copy and post it?

[Jack_Klauch]

https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKA1VtC1mRJr0-ErRfvnZgV8aMYC2HwSKrksZKwkmjwS4-u2vZVtAD0lsWdxB7uLqhpvwhkq2krqMV-CfIH3mfNYfAdhfQDRAm-80ZtZhyJoOLtsAjEhiegw8DTOCaLt89As4233GNuwZgkLwKuPVX_oE1YNiiNQOy6IDOQd1H5NhE3PG7fj0MJ6
                               

And

 

https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKA1VtC1mRJr0-ErRfvnZgV8aMYC2HwSKrksZKwkmjwS4-u2vZVtAD0lsWdxB7uLqhpvwhkq2krqMV-CfIH3mfNYfAdhfQDRAm-80ZtZhyJoOLtsAjEhiegw8DTOCaLt89As4233GNuwZgkLwKuPVX_oE1YNiiNQOy6IDOQd1H5NhE3PG7fj0MJ6

[Jack_Klauch]

I also can't read it completely, i have to look at the logs

[Jack_Klauch]

Oh Wait It is the same thread, the AdwCleaner shows 2 different Threads but it is the same Thread Detail for both threads