Edge Brower Hijacker Policies Difficult to Remove

Question

Edge Brower Hijacker Policies Difficult to Remove

grey area 20

Two policies in Edge ("managed by your organization"), but there is no organization - it's a home Win 10 HP laptop, and I'm the admin user. They are ExtensionInstallAllowList and ExtensionInstallForceList, which links to (++don't go here++) "https://worldnotificationupdate2.com/crx/updates.php". I cannot remove these settings. When I try to delete them in regedit (even having changed permissions, and checked Edge isn't running) they will not delete.

So, it's a browser hijacker that's difficult to remove. How do I remove it? (Hopefully, without reinstalling Windows.)

Accepted answer

2 additional answers

Your answer

Answer 1

_AW_ 62,621 Volunteer Moderator

Please provide Farbar Recovery Scan Tool (FRST) logs for analysis.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Note: If you are using Edge or Chrome, SmartScreen may initially block the download. Click on the three dots next to the warning and select Keep => Show more => Keep anyway.

If your computer's language is not English, rename FRST64.exe to FRST64English.exe
Run the tool, leave the default settings, and press Scan.
Zip the logs, FRST.txt and Addition.txt, then upload to a cloud storage service like OneDrive, Google Drive or gofile.io
Post the share link.

Share OneDrive files and folders - Microsoft Support

grey area 20 Reputation points

2025-08-14T17:23:56.26+00:00

https://gofile.io/d/WDqlTv
_AW_ 62,621 Reputation points Volunteer Moderator

2025-08-14T23:56:56.8966667+00:00
There's indications of infection dating back to March. This should resolve things.

Download Fixlist.txt and save to the Desktop where FRST64.exe is located.

Close any apps with unsaved work.

Run FRST64.exe as administrator and click "Fix".

The computer will reboot to complete the procedure.

Please upload Fixlog.txt so I can check if any further action is needed.
grey area 20 Reputation points

2025-08-15T01:49:19.8266667+00:00

That appears to have fixed it! Thank-you very much for the assist. I was all at sea.

https://gofile.io/d/RMy92R
_AW_ 62,621 Reputation points Volunteer Moderator

2025-08-15T01:57:33.7166667+00:00

The fixlog indicates that everything was successfully dealt with.

To remove FRST64.exe and its folders, rename it to uninstall.exe and run it. A reboot will be required.

Good luck :)

Answer 2

Paulo GM 50,250 Independent Advisor

Hi,

I used to have this same problem. Can you check if this path in the Registry can be deleted?

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge

Screenshot_1

This is the location where I deleted the Edge keys that contained the policies preventing extensions from being uninstalled. Once deleted, you could also check these paths and delete the Edge keys: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge Computer\HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge

grey area 20 Reputation points

2025-08-06T19:57:28.83+00:00

Thanks, but the key won't delete. I think it must be running under some process, because changing the permissions or ownership doesn't seem to do anything useful (i.e. it still won't delete).
Paulo GM 50,250 Reputation points Independent Advisor

2025-08-06T20:19:15.29+00:00

I see. Could you follow the steps provided by Dave from this thread? This should remove any existing policies on your device.https://learn.microsoft.com/en-us/answers/questions/2361035/managed-by-your-organization-(false-notice-as-it-i?forum=microsoftedge-all&referrer=answers)
grey area 20 Reputation points

2025-08-06T21:19:24.3066667+00:00

No, the adverse policies remain, unfortunately.
Paulo GM 50,250 Reputation points Independent Advisor

2025-08-06T21:58:20.2+00:00

That's odd, probably malware. I suggest running a full scan using Malwarebytes and see if that fixes the problem.
grey area 20 Reputation points

2025-08-06T22:47:00.45+00:00

Yeah, I tried Malwarebytes, as well. I also took the machine to a local business - they did manage to remove the browser hijacker from Chrome, but not from Edge. (I manually found some virus files on the machine, but oddly Defender only noticed them when I actually went into the folder they were in.) I'm looking at three ideas: one is ProcMon to try to find out what process is holding the policies. 2nd is PsExec so I can regedit as SYSTEM. 3rd is to reinstall Windows.
Paulo GM 50,250 Reputation points Independent Advisor

2025-08-07T00:01:58.7866667+00:00

Were you able to run all the commands mentioned from the thread I mentioned earlier to remove all the policies? If all were not executed, it’s possible that another policy is still active and preventing those policies in Edge from being deleted.
grey area 20 Reputation points

2025-08-07T15:41:16.2766667+00:00

Indeed not - some of the commands were successful, some were partially successful and some were along the lines of "thing not found". I'm assuming the partially successful ones were where those particular keys I'm trying to get rid of didn't delete. (I tried it twice, once normally, and once in Safe Mode.)
Paulo GM 50,250 Reputation points Independent Advisor

2025-08-07T17:45:09.3433333+00:00

Got it. I'm sorry but I'm out of ideas at this point. AW can take over from here as I've seen his method using the Farbar tool work for other users with the same issue.

Answer 3

Juan Mercado 0

i tried all of these and it still was there, but after i had edited the registry and run the commands in Powershell, I used a tool in CCLeaner and it eliminated the extensions existence from both Chrome extensions and MSEdge extensions. It still says my browser in managed but it no longer hijacks the search or opening of browsers.

Share via

Edge Brower Hijacker Policies Difficult to Remove

2 additional answers

Your answer