[IndyBlue]

Dear GTG,

Help! You are my only hope. I have a Dell PC and am using Windows 10. I have Kaspersky Total Security, and I use Nord VPN for browsing (but it's not on in general). I work from home.

This morning, when I turned on my computer, NordVPN would not log on. It had been working fine for the past week or two after the most recent update, as has everything else.

Then, Chrome completely stopped working. (Edge and Firefox work fine.)

Since I desperately need to do my job, I thought that I would use Edge and Firefox in the meantime. Edge is fine but it won't let me use Teams (although I can use all the other Office apps). I absolutely need Teams for meetings and so on for my job.

Then I thought that maybe I should address the NordVPN problem since their updates have sometimes screwed with my computer in the past. I spent 4 hours with them, and they could not resolve the issue with their own product or with Chrome.

I uninstalled and reinstalled Chrome once, and it still didn't work properly. (During the first attempt, Windows Defender SmartScreen kept preventing me from uploading it, but somehow I managed to get past it. But then Chrome still didn't work.)

Uninstalled Chrome again and tried to reinstall it, but this time, SmartScreen has completely blocked me.

I know that I am presenting myriad issues here, but I have no idea what to do, and I'm feeling hopeless and desperate.

Also, I use my home computer as my work computer (which I'm not really supposed to do), but it has been working fine for over 1.5 years, and I have good security etc. So, I have my work account and my personal account sharing space, but I keep them very separate.

Can anyone help me with these issues? I don't care so much about the NordVPN right now--I'm much more concerned about getting full functionality of Chrome (and with that, Office 365) back.

I'm sorry if I neglected to include any important specs--please let me know what you need.

And thanks in advance for all your help. I'm truly desperate and need to resolve this asap. (I work in emergency management for the pandemic.)

Sincerely,

IndyBlue

 

[Advertisements]

Just checked and Smart Screen does not seem to have a problem with a Chrome download so perhaps you have a bad DNS which is sending you to a fake download site.

 

Search for

cmd

It will find Command Prompt.  Right click on Command Prompt and select Run As Administrator.  Type:

 

nslookup google.com

 

compare the addresses in the answer to:

 

nslookup google.com 8.8.8.8.  They should be the same.

 

Should look something like this:

 

C:\WINDOWS\system32>nslookup google.com
Server:  dns.opendns.com
Address:  208.67.220.220

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4008:815::200e
          142.251.35.238


C:\WINDOWS\system32>nslookup google.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4008:80a::200e
          142.251.35.238

IF they are not the same then your DNS is bad.  You may have an infection on your PC or your router.

 

Check your DNS by typing: 

ipconfig /all

(Hit Enter)

Search the result for DNS Servers

What does yours say?

 

The download link for Chrome is:

 

https://www.google.com/chrome/

 

This should result in a lock icon in front of the URL in your browser.  It should also give you the same page as:

142.251.35.238/chrome

tho the lock will have a line through it.

 

Assuming you are not infected you can turn off Smart Screen and see if that lets you download the install file:

Settings, Update & Security, Windows Security, App & Browser Control.  Click on Reputation-based Protection Settings.  As a test, turn off all settings on this page.  Close settings and restart your browser.

 

Then try to download Chrome using

 

https://www.google.com/chrome/

or

142.251.35.238/chrome  (use this link if you don't get the same answer for both nslookups)

 

 

.  If this allows you to download then save the file, go to the download folder and right click on the file and let Kaspersky scan the downloaded file.  It should have done so automatically but it never hurts to double check.

Assuming Kaspersky is happy with the file :

Then right click on the file and Run As Administrator.

 

If it still doesn't work then try downloading  Revo (The free version)

 

https://www.revounin...-free-download/

 

Download, Save and then go to your Download folder and right click on the downloaded file and Run As Admin.

 

Once you get it installed  and running it will show you a list of installed programs.

 

Click on Google Chrome

Right click and select Uninstall.  Continue.

(Let it create a System Restore point)

Select Advanced then Scan.

Once the scan finishes click on Select All then on Delete (not Next).  Yes.

Once it finishes removing the registry entries it will show you the leftover files from the install.  Click on Select All then Delete.  Yes.

 

Now try downloading the offline version of the Chrome installer:

 

https://www.google.c...e/?standalone=1

 

Go to the download folder and right click on the downloaded  file and Run As Admin.

 

This will give you a completely fresh copy of Chrome without any of your passwords or bookmarks so you may want to let it learn from your current browser.

 

If it still doesn't work I would follow step 3 of the instructions here:

http://www.geekstogo...before-posting/

 

and create a new post in our Malware forum.

http://www.geekstogo...alware-removal/

be sure to include both the FRST and the addition.txt  files that you get from running FRST.  If the files are too large to post you can attach them

 

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.

(repeat if you need toattach a second file)

 

 

 

 

 

 

 

 

[RKinner]

Just checked and Smart Screen does not seem to have a problem with a Chrome download so perhaps you have a bad DNS which is sending you to a fake download site.

 

Search for

cmd

It will find Command Prompt.  Right click on Command Prompt and select Run As Administrator.  Type:

 

nslookup google.com

 

compare the addresses in the answer to:

 

nslookup google.com 8.8.8.8.  They should be the same.

 

Should look something like this:

 

C:\WINDOWS\system32>nslookup google.com
Server:  dns.opendns.com
Address:  208.67.220.220

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4008:815::200e
          142.251.35.238


C:\WINDOWS\system32>nslookup google.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4008:80a::200e
          142.251.35.238

IF they are not the same then your DNS is bad.  You may have an infection on your PC or your router.

 

Check your DNS by typing: 

ipconfig /all

(Hit Enter)

Search the result for DNS Servers

What does yours say?

 

The download link for Chrome is:

 

https://www.google.com/chrome/

 

This should result in a lock icon in front of the URL in your browser.  It should also give you the same page as:

142.251.35.238/chrome

tho the lock will have a line through it.

 

Assuming you are not infected you can turn off Smart Screen and see if that lets you download the install file:

Settings, Update & Security, Windows Security, App & Browser Control.  Click on Reputation-based Protection Settings.  As a test, turn off all settings on this page.  Close settings and restart your browser.

 

Then try to download Chrome using

 

https://www.google.com/chrome/

or

142.251.35.238/chrome  (use this link if you don't get the same answer for both nslookups)

 

 

.  If this allows you to download then save the file, go to the download folder and right click on the file and let Kaspersky scan the downloaded file.  It should have done so automatically but it never hurts to double check.

Assuming Kaspersky is happy with the file :

Then right click on the file and Run As Administrator.

 

If it still doesn't work then try downloading  Revo (The free version)

 

https://www.revounin...-free-download/

 

Download, Save and then go to your Download folder and right click on the downloaded file and Run As Admin.

 

Once you get it installed  and running it will show you a list of installed programs.

 

Click on Google Chrome

Right click and select Uninstall.  Continue.

(Let it create a System Restore point)

Select Advanced then Scan.

Once the scan finishes click on Select All then on Delete (not Next).  Yes.

Once it finishes removing the registry entries it will show you the leftover files from the install.  Click on Select All then Delete.  Yes.

 

Now try downloading the offline version of the Chrome installer:

 

https://www.google.c...e/?standalone=1

 

Go to the download folder and right click on the downloaded  file and Run As Admin.

 

This will give you a completely fresh copy of Chrome without any of your passwords or bookmarks so you may want to let it learn from your current browser.

 

If it still doesn't work I would follow step 3 of the instructions here:

http://www.geekstogo...before-posting/

 

and create a new post in our Malware forum.

http://www.geekstogo...alware-removal/

be sure to include both the FRST and the addition.txt  files that you get from running FRST.  If the files are too large to post you can attach them

 

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.

(repeat if you need toattach a second file)

 

 

 

 

 

 

 

 

[IndyBlue]

Dear RKinner,

Thank you so much for your response! And it's nice to hear from you again! I remember how much you helped me a few years ago.

Here's the data from step one--comparing the two google responses:

Microsoft Windows [Version 10.0.19044.2075]
© Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>nslookup google.com
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4006:80b::200e
          142.251.40.174


C:\WINDOWS\system32>nslookup google.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4006:80f::200e
          142.251.40.174

They look almost the same except that the first address has "80b" and the second has "80f". (Note: As an earlier attempt at fixing this problem, I made a change to Internet Protocol Version 4 (TCP/IPv4) per some fix I found on the internet. I added 8.8.8.8 for the preferred server and 8.8.4.4 for the alternate. Did I unwittingly interfere?)

Then I entered ipconfig /all per your instructions, and this is what I got:

Microsoft Windows [Version 10.0.19044.2075]
© Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : DESKTOP-EL88UDV
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : fios-router.home

Ethernet adapter Ethernet 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-NordVPN Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-2C-60-4C-1E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : fios-router.home
   Description . . . . . . . . . . . : Intel® Ethernet Connection (2) I219-LM
   Physical Address. . . . . . . . . : F4-8E-38-D4-EB-B9
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::4a8:d0f6:2a71:9c9c%13(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.151(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, September 21, 2022 5:53:03 AM
   Lease Expires . . . . . . . . . . : Thursday, September 22, 2022 11:18:28 AM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 687115832
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1F-3C-20-25-F4-8E-38-D4-EB-B9
   DNS Servers . . . . . . . . . . . : 8.8.8.8
                                       8.8.4.4
   NetBIOS over Tcpip. . . . . . . . : Enabled
   Connection-specific DNS Suffix Search List :
                                       fios-router.home

Wireless LAN adapter Local Area Connection* 10:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : E4-A4-71-92-DD-18
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 11:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
   Physical Address. . . . . . . . . : E6-A4-71-92-DD-17
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : fios-router.home
   Description . . . . . . . . . . . : Intel® Dual Band Wireless-AC 8260
   Physical Address. . . . . . . . . : E4-A4-71-92-DD-17
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Before moving on to the next steps, I thought I would wait to see what your take is on the above two results.

Btw, Smart Screen always interferes, no matter whether I turn it on or off. I managed to download Chrome last night but it's not working ("no internet," which I find so strange). I want to wait to hear what you have to say about the above items before proceeding with another Chrome installation attempt.

Looking forward to hearing from you! And thanks again!!

IndyBlue

 

[RKinner]

OK if DNS is good and Chrome will come up then in Chrome click on the three dots in the upper right then Settings,

If it says Syncing to your email address near the top then click on Turn Off. 

 

Click on Systems.

 

Turn off

Continue running background app when Google Chrome is closed

 

Click on Open your computer's proxy settings.  Turn off 

Use Setup Script

Turn off

Use a Proxy Server

Close Settings

 

Go back to Chrome

Scroll down to the bottom of the left column of chrome://settings and click on Extensions  Turn all extensions off.  

 

Close Chrome

 

Search for cmd again and right click on Command Prompt and Run As Admin.  Type:

ipconfig  /flushdns

hit Enter

then type:

netsh  winhttp  reset  proxy

It should say 

 Direct access (no proxy server).

 

 

 

Now type:

netsh  winsock  reset  catalog

hit Enter

netsh  int  ipv4  reset  reset.log

Close all programs and reboot.

 

Bring up Chrome and see if it can get to google.com

 

if not can it get to  142.251.40.174  ?

 

I think Kaspersky has a firewall.  It's possible that for some reason Kaspersky is blocking Chrome.  Don't know much about Kaspersky.  Intrernet says:

To disable the firewall in Kaspersky Internet Security. Click open its Settings. Under Protection settings, you will see the switch to toggle on or off the Firewall. Move the slider to the Off position.

[IndyBlue]

Quick question: what does this mean? "Continue running background app when Google Chrome is closed"

I had already turned off syncing (and now can't turn it back on even if I wanted to since there is no internet for Chrome). I think I already did all the other steps but I will check after you clarify the above sentence. (Sorry for not understanding!)

Thanks!

[IndyBlue]

Wait, I understand now--sorry! I have the "continued running" button selected.

Should I "use hardware acceleration when available"?

[IndyBlue]

I think I'm misunderstanding. Did you mean to turn off continue running background? Sorry! I think that's what you meant, no?

[IndyBlue]

Hi, RKinner,

I did everything you requested and Chrome is still out.

Here are the responses from the CMD commands you advised earlier:

Microsoft Windows [Version 10.0.19044.2075]
© Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>ipconfig  /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\WINDOWS\system32>netsh  winhttp  reset  proxy

Current WinHTTP proxy settings:

    Direct access (no proxy server).


C:\WINDOWS\system32>netsh  winsock  reset  catalog

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


C:\WINDOWS\system32>netsh  int  ipv4  reset  reset.log
Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.

 

I turned off the Kaspersky firewall as well as the Defender firewalls. I have no firewalls running at the moment (which makes me nervous).

I tried to reach google.com and that other address on Chrome, but to no avail. I rebooted again, and tried again.

Should I now try uninstalling/reinstalling Chrome per your instructions above? Should I also temporarily pause Kaspersky Total Security while doing this?

Or should I now take steps to see if there is malware on my computer?

Thank you!!

 

[IndyBlue]

I decided to go ahead and try to uninstall/reinstall Chrome per you directions above. All firewall are off, and yet I get the same messages when I attempt to download. (Please see attachments.)

Then I tried your suggestion of scanning the download file (Kaspersky said it was clean), and I ran it as an Administrator. Didn't get the SmartScreen window but I got the no internet error prompt (which is attached here).

I downloaded Revo (still got the SmartScreen prompt, but it allowed the download to proceed after I hit "Run" [which does not work with Chrome]). Google/Chrome was nowhere to be found, so I had successfully uninstalled it.

Next, I went to the standalone link and was able to install Chrome! However, it still doesn't work. I'm still getting an error prompt (see the "Chrome error" attachment).

I think I now need to follow your step about malware.

(I'm trying to add attachments but it's not working. I know there's a special way to do it here. Will send in next response.)

[IndyBlue]

Here's the Smart Screen prompt.

[IndyBlue]

I forgot how to do attachments and it won't let me paste in screenshots. And I can't find the instructions on how to do it.

[RKinner]

Sorry for not responding earlier but was taking a nap.

 

The option to Continue Running Background Processes pretty much does what it says.  For some reason Chrome thinks it needs to keep running after you close it.  By turning this off we free up CPU time and memory and make it easier to uninstall.

 

Turning off the firewall was just to see if it made a difference.  If it didn't just turn it back on again.

 

Yes.  Try to use Revo to remove all traces of Chrome then reinstall it using the offline version of Chrome.   https://www.google.c...e/?standalone=1

the usual Chrome installer is just a stub.  It is just enough of a program to start the install then it downloads the files it needs. 

If Firefox can't download the offline version of Chrome take a screenshot of the error you get and try again with Kaspersky turned off.  

 

IF that doesn't work I really need the FRST logs to see what is going on.  They don't like me to run then outside of the malware forum but I can ask to have this thread moved to malware by an admin.  I will do that now so you don't have to start a new topic.  Go ahead and post the logs when you get them.  You may have to pause Kaspersky while downloading or running FRST.

 

You appear to be having trouble downloading screenshots.  Remember it is a multistep process.

 

First click on More Reply Options

Then scroll down to where you see

Choose File and click on it.  Point it at the file and hit Open.

Now click on Attach this file.

 

Also you can only post files with extensions like jpg (not png), txt, log or zip.

[IndyBlue]

Thanks for your response! I will run FRST per your instructions.

I tried adding the attachments but the Attach button is dead, and nothing happens when I try the advanced uploader. And they are all jpgs. I'm going to turn my firewalls on now.

I'll reboot and see if I can send the attachments afterwards.

[IndyBlue]

I switched to Edge. And now the Attach This File buttons are live. Here are the four screen shots I mentioned in my previous messages.

I just don't understand why it wouldn't work in Firefox. (That's why I stopped using Firefox a long time ago. Too buggy.)

Attached Thumbnails

• 
• 
• 
• 

[IndyBlue]

I'm going to prepare the FRST logs for you now.