Getting rid of PUA:Win32/ByteFence

SueJohnson said:

FRST_19-10-2023 06.48.31.txtFRST_19-10-2023 06.48.31.txt
Again it didn't notify me.

Check notification settings here:
https://www.tenforums.com/profile.php?do=editoptions

@SueJohnson, well there is not a lot there, just some minor clean-up !

Highlight the entire content of the quote box below.

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
Task: {5CAB266C-EFBC-4211-BEC6-59267825E59B} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [X]

cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::

Right click on the highlighted text and select Copy.
Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.

- - - Updated - - -
@Callender .......... thanks !

SueJohnson said:

Fixlog.txt
Actually I had already gone out to settings and for "Thread subscription mode" selected instantly, using email, and I also checked it had my correct email and I still didn't get notified.

And the PUAs are still there.

Sue,

Just prior to seeing the PUPs, did you download/install a new software/app?

If you think you may have, lets try something else.

Go to Settings > Apps > Apps and Features, scroll the list and see if you find the PUP. If you do, select it and click Uninstall.

Likely something recently installed contains the PUP. If you can isolated it, you can uninstall the app, then if needed, download it, taking care to closely read everything before agreeing to install again.

At the top of this page click "Thread Tools" drop down list and check that you are subscribed to this thread. If you are subscribed already you will see an option to unsubscribe and vice versa.

If you're not seeing notifications at the top of the page when viewing any page here then something in your browser is blocking parts of this website.

If you're not seeing emails check spam and junk filters. Sometimes you might need to sign into your email account via your browser to see all available options and filters.

@SueJohnson ...... let's remove the programs & their logs from your computer !

Please download KpRm by Kernel-panik and save to your Desktop. >>> Downloads - KpRm - ToolsLib

* Click on KpRm.exe to run the tool.
* Vista/Windows 7/8/10 users right-click and select Run As Administrator.

* Put a check mark next to these items:
- Delete tools
- Delete now

* Click the "Run" button.
When the tool has finished, it will create and open a log report and delete itself.

Just a note to say that those PUA's might not exist even though Defender says that they do exist.

See:
Stubborn PUA:Win32/InstallCore

Follow the instructions here to clear threat history:

[Fixed] Windows Defender Identifies the Same Threat Repeatedly - MiniTool Partition Wizard

Related post with possibly easier to use fix. (Batch file)

Clear Windows Security Center (Defender) Protection History

SueJohnson said:

I haven't downloaded anything except the ones you told me to.

I already had checked apps in settings and it is not there.

I see unsubscribe on thread tools .

I have checked spam and junk folders.

I will do the two things you suggested later today.

Okay if you're not getting email notifications then I have no idea why not.