endnotes click is added to microsoft edge. i cannot find it. the microsoft edge

Hi arian80,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution, before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Please give me some time to examine your logs and I will get back to you as soon as possible.

Dennis

There is some clean up that we can do, as well as removing an Edge/Chrome extension, to hopefully resolve the problem
Firstly though could you please check your Downloads folder and remove anything that you do not recognise or are unsure about.
The following open firewall ports were listed.

FirewallRules: [{9F227A5C-B711-4DE9-BE4C-10B7BB2B3A9F}] => (Allow) LPort=80
FirewallRules: [{8196431E-6A4A-4554-B317-63F771DB204B}] => (Allow) LPort=32683
FirewallRules: [{A3196067-8CA4-4A67-BBE3-C6C1CC0950FE}] => (Allow) LPort=32682
FirewallRules: [{6A9D8444-AE76-40AA-A8D5-AF3EA0EBBFE5}] => (Allow) LPort=26822

These may be related to AutoCAD/Autodesk or other genuine programs, so we will not take any action with these, unless you wish to close them on a precautionary basis.

-------------------------------------------------------------------------------------
Could you please run this FRST script next.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
CreateRestorePoint:
CloseProcesses:
File: C:\Users\yibra\AppData\Local\yzsx_zsync_1712421264\zsync_desktop.exe
File: C:\WINDOWS\system32\license.lic
File: C:\WINDOWS\system32\license.sig
Folder: C:\WINDOWS\SysWOW64\XPSViewer
Folder: C:\WINDOWS\system32\ar
Folder: C:\ProgramData\Common
HKU\S-1-5-21-1125619000-792953389-3520311326-1001\...\Policies\Explorer: []
Edge HKLM-x32\...\Edge\Extension: [jaleebmaoohbjjohjlfmihkkopgfibne]
CHR HKLM-x32\...\Chrome\Extension: [fjgncogppolhfdpijihbpfmeohpaadpc] - hxxps://click.endnote.com/extensions/chrome/update-manifest.xml
Task: {FF43FB4E-7D63-45B5-99D8-4745A1FE68FD} - System32\Tasks\WDNA => C:\Users\yibra\AppData\Local\NutCelar\rhc.exe [1536 2023-07-26] () [File not signed] -> C:\Users\yibra\AppData\Local\NutCelar\php.exe index.php
Task: {9869AD6F-57D2-4C6A-A887-E6E56C49D00F} - System32\Tasks\WDNA_LG => Command(1): rhc.exe -> C:\Users\yibra\AppData\Local\NutCelar\php.exe include.php <==== ATTENTION
Task: {9869AD6F-57D2-4C6A-A887-E6E56C49D00F} - System32\Tasks\WDNA_LG => Command(2): rhc.exe -> C:\Users\yibra\AppData\Local\NutCelar\php.exe index.php <==== ATTENTION
2024-04-03 01:36 - 2024-04-06 17:34 - 000000000 ____D C:\Users\yibra\AppData\Local\NutCelar
Task: {ABFA469B-849C-4B2D-8FBB-5ED5F5E93CD4} - System32\Tasks\ScreenShareClientUpdate => C:\Users\yibra\AppData\Local\Temp\ScreenShareClientUpdate.exe  Install (No File) <==== ATTENTION
HKU\S-1-5-18\...\Run: [Norton Download ManagerCCT_CERT_EXPIRY_MITIGATION] => C:\PROGRA~3\Norton\{0C55C~1\NORTON~1.EXE /m /noui (No File)
Task: {45CF73C8-9A94-47C5-8E45-347738A58FC5} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {F149D228-3BEF-4677-BDC7-0B4B070D99FF} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {D1388F80-9948-45B0-9693-44B922BD0202} - System32\Tasks\MSI Task Host - Duet => "C:\Program Files (x86)\MSI\One Dragon Center\Duet\MSI_Duet.exe"  (No File)
Task: {25FE0670-524D-4263-81CA-27EFB478399D} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe  (No File)
Task: {B6575A07-4EE6-4AD8-9D5E-708D53DE8F1B} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-1125619000-792953389-3520311326-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe  /reporting (No File)
ShellIconOverlayIdentifiers: [      .WorkspaceExt0] -> {C568C78A-652C-425B-8E6B-FFA73043302D} =>  -> No File
ShellIconOverlayIdentifiers: [      .WorkspaceExt1] -> {2A6FE247-5DA3-4732-9626-77820518FD77} =>  -> No File
ShellIconOverlayIdentifiers: [      .WorkspaceExt2] -> {FF895810-293B-464A-93F2-82D11E07EEC8} =>  -> No File
FirewallRules: [{91239F7E-80B4-496D-84D9-0A69F848BE2F}] => (Allow) C:\Users\yibra\AppData\Local\Temp\utorrent\utorrent.exe => No File
FirewallRules: [{69321657-A7BD-4358-9187-BC8676BDCAF1}] => (Allow) C:\Users\yibra\AppData\Local\Temp\utorrent\utorrent.exe => No File
FirewallRules: [{4A01E1EE-61AB-41A9-B115-007C85E5F26E}] => (Allow) C:\Users\yibra\Downloads\reiboot.exe => No File
FirewallRules: [{3E8F3176-BF40-4753-B8B3-077AE169BB2B}] => (Allow) C:\Users\yibra\Downloads\reiboot.exe => No File
FirewallRules: [{7C1025E6-C61F-4714-A238-A578CE52297D}] => (Allow) C:\Users\yibra\Downloads\reiboot (1).exe => No File
FirewallRules: [{D1B23D95-5DA9-47E0-9F13-D90A3A15F4E5}] => (Allow) C:\Users\yibra\Downloads\reiboot (1).exe => No File
FirewallRules: [{69A5337D-C8E3-4B30-AEE7-9EC8D5FB2D1E}] => (Allow) C:\Users\yibra\Downloads\icarefone.exe => No File
FirewallRules: [{69E8A764-4411-4BB6-86CB-43CC5D01C0B7}] => (Allow) C:\Users\yibra\Downloads\icarefone.exe => No File
FirewallRules: [{52142D18-5362-4CDF-AB42-185CED6E1F87}] => (Allow) C:\Users\yibra\Downloads\reiboot (2).exe => No File
FirewallRules: [{41498FEA-F32F-44B3-9517-311CB146277D}] => (Allow) C:\Users\yibra\Downloads\reiboot (2).exe => No File
FirewallRules: [{8F1F35DF-D1FE-4B1F-882D-720C713AA9FA}] => (Allow) C:\Program Files (x86)\i4Tools7\libXunlei\Download\MiniThunderPlatform.exe => No File
FirewallRules: [{20887472-1EBA-48E4-9C9A-6DB2FAD76F43}] => (Allow) C:\Program Files (x86)\i4Tools7\libXunlei\Download\MiniThunderPlatform.exe => No File
FirewallRules: [{EC803710-94E9-4073-A353-A825480AC42E}] => (Allow) C:\Program Files (x86)\i4Tools7\extrastools\i4AirPlayer\i4AirPlayer.exe => No File
FirewallRules: [{BB8826F2-268C-4F9A-A898-9B0FF1390256}] => (Allow) C:\Program Files (x86)\i4Tools7\extrastools\i4AirPlayer\airplayer_dlna\DlnaService.exe => No File
FirewallRules: [{84E660BB-ACEE-4EE4-B0C9-B4EE9F32F8F5}] => (Allow) C:\Users\yibra\Downloads\reiboot (3).exe => No File
FirewallRules: [{730BFE5C-DB43-4581-AB33-CA2B8947032B}] => (Allow) C:\Users\yibra\Downloads\reiboot (3).exe => No File
FirewallRules: [{359153DF-385B-411D-9AE8-4162548F85E6}] => (Allow) C:\Users\yibra\AppData\Roaming\uTorrent\uTorrent.exe => No File
FirewallRules: [{686A7D2D-0044-4A95-BA41-23D79FF44918}] => (Allow) C:\Users\yibra\AppData\Roaming\uTorrent\uTorrent.exe => No File
FirewallRules: [{AA8FF777-D6EE-4559-9837-5575DD08914E}] => (Allow) C:\Program Files (x86)\Overwolf\0.243.1.1\OverwolfBrowser.exe => No File
FirewallRules: [{2DBC48BD-BF49-4AC6-86D3-84ECFD06AB10}] => (Allow) C:\Program Files (x86)\Overwolf\0.243.1.1\OverwolfBrowser.exe => No File
FirewallRules: [{26E9748E-88BB-423A-A1A6-48CF655D19E3}] => (Block) C:\Program Files (x86)\Overwolf\0.243.1.1\OverwolfBrowser.exe => No File
FirewallRules: [{AB08BB41-8AAB-4E48-9EA6-C7C32BF64D27}] => (Block) C:\Program Files (x86)\Overwolf\0.243.1.1\OverwolfBrowser.exe => No File
HKU\S-1-5-18\...\Run: [] => [X]
S2 cphs; %SystemRoot%\System32\IntelCpHeciSvc.exe [X]
S2 Killer Provider Data Helper Service; %SystemRoot%\System32\drivers\Intel\Killer\KillerProviderDataHelperService.exe [X]
S3 GENERICDRV; \??\C:\Users\yibra\Desktop\RMA-AUTO5.5\SOFT\CHK\amifldrv64.sys [X]
End::

• Click on the Fix button just once and wait.
• Please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also please advise how your computer is running now.