AJZ2000 0 Posted October 4, 2018 Share Posted October 4, 2018 i have no idea what's going on with my PC but it refuses to install chrome back for some reason. I have no idea what happened but i downloaded something about a month ago now (maybe not but it was sometime in early September) it was either a game or when I was doing stuff with my 3DS but it seemed as if some virus got on my computer and it was messing with chrome and had weird ads and pages popping up but it was removed and any programs i could find that even seemed remotely related to it i removed, as well as chrome just to be completely sure it was all gone. Once i was confident nothing else was happening (that I could notice), i tried to use internet explorer to re download chrome and it wouldn't. I kept getting (and still continue to receive) the message that "your network administrator has applied a Group Policy that prevents installation" even though I'm the administrator of the computer and the ONLY ONE on the computer. So I continued to troubleshoot to see what may fix it, i turned of the firewall and file security and that didn't work, I tried the offline version of chrome and that didn't work, i tried using older versions, the beta version, I tried going into ESET configuration to make sure the file was allowed, restarting my computer, scanning my computer as an admin constantly and finding nothing, I even downloaded Firefox to see if IE was the problem but nothing has worked ever since. I've been constantly checking files to find any signs of viruses and the only thing that has happened that seemed suspicious was that ESET had stopped svchost from opening a couple of threats that i think were websites like 3 times and i checked to see if svchost was located somewhere else but it was in the windows\system32 folder as it was supposed to be. Also one other weird thing that occurred while i was looking for svchost. I assume i typed the folder in wrong at first in the search bar and it wanted to open it in a website browser and in the list of what it asked me what i wanted to open it from, chrome was still listed to open up programs for windows 10, the icon wasn't present but it chrome was still there for some reason. So idk if any of this made sense but if anyone can help me that would be amazing, thank you. P.S. idk if any info is needed for this but i will try my best to fill in any holes i may have left out of provide anything needed, thank you again Link to comment Share on other sites More sharing options...
Administrators Marcos 5,112 Posted October 4, 2018 Administrators Share Posted October 4, 2018 If you have Windows 10 Enterprise, check AppLocker rules if you don't have one which would block a path or publisher: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules Link to comment Share on other sites More sharing options...
itman 1,681 Posted October 4, 2018 Share Posted October 4, 2018 1 hour ago, AJZ2000 said: kept getting (and still continue to receive) the message that "your network administrator has applied a Group Policy that prevents installation" even though I'm the administrator of the computer and the ONLY ONE on the computer. Do you have any other third party security software installed along the lines of OSArmor, etc.? Most of these employ Group Policy to implement their security restrictions. Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 5, 2018 Author Share Posted October 5, 2018 4 hours ago, Marcos said: If you have Windows 10 Enterprise, check AppLocker rules if you don't have one which would block a path or publisher: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules 3 hours ago, itman said: Do you have any other third party security software installed along the lines of OSArmor, etc.? Most of these employ Group Policy to implement their security restrictions. No i don't have Windows 10 Enterprise and i went back and double checked and i don't have any third party security that i saw. ESET and Windows Defender are the only things i have. Link to comment Share on other sites More sharing options...
itman 1,681 Posted October 5, 2018 Share Posted October 5, 2018 13 hours ago, AJZ2000 said: No i don't have Windows 10 Enterprise and i went back and double checked and i don't have any third party security that i saw. ESET and Windows Defender are the only things i have. Are you using any third party software such as OOShutUp10 to modify Win 10 telemetry settings? Like software will often time set Group Policy rules internally to modify Win 10 behavior. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,112 Posted October 5, 2018 Administrators Share Posted October 5, 2018 Maybe a Procmon log with advanced logging enabled generated during an attempt to launch Chrome could shed more light. I assume that temporarily uninstalling ESET wouldn't make any difference,would it? Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 6, 2018 Author Share Posted October 6, 2018 23 hours ago, Marcos said: Maybe a Procmon log with advanced logging enabled generated during an attempt to launch Chrome could shed more light. How do I do that? 23 hours ago, Marcos said: I assume that temporarily uninstalling ESET wouldn't make any difference,would it? I haven't tried this yet should I do this first? Also would you know the safest way to uninstall it without losing the license for my PC? Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 6, 2018 Author Share Posted October 6, 2018 On 10/5/2018 at 9:23 AM, itman said: Are you using any third party software such as OOShutUp10 to modify Win 10 telemetry settings? Like software will often time set Group Policy rules internally to modify Win 10 behavior. Nope i shouldn't, I only have games, emulators, a few tools like Winrar or Handbreak and broadcasting software such as StreamLabs and OBS, but nothing that i think would modify windows 10 settings by setting policy rules Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 6, 2018 Share Posted October 6, 2018 (edited) Hello AJZ...as far as a Procmon log see Marcos' post of 9/11/18 https://forum.eset.com/topic/16750-win64coinminerdn/?tab=comments#comment-82842 As far as uninstalling and re-installing ESET, you should not have any issue with your license. https://support.eset.com/kb2788/?_ref=zap Edited October 6, 2018 by TomFace Link to comment Share on other sites More sharing options...
itman 1,681 Posted October 6, 2018 Share Posted October 6, 2018 I reread your original posting and the fact that Eset is alerting on svchost.exe indicates that malware has installed one or more services or is running itself from task manager which is also a legit Win service. I strongly suggest you do as @Marcos has previous requested and forward the log output of a process monitor session to him. You do this by following the instructions given in this Eset knowledgebase article: https://support.eset.com/kb6308/ Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 6, 2018 Author Share Posted October 6, 2018 3 hours ago, itman said: I reread your original posting and the fact that Eset is alerting on svchost.exe indicates that malware has installed one or more services or is running itself from task manager which is also a legit Win service. I strongly suggest you do as @Marcos has previous requested and forward the log output of a process monitor session to him. You do this by following the instructions given in this Eset knowledgebase article: https://support.eset.com/kb6308/ 3 hours ago, TomFace said: Hello AJZ...as far as a Procmon log see Marcos' post of 9/11/18 https://forum.eset.com/topic/16750-win64coinminerdn/?tab=comments#comment-82842 As far as uninstalling and re-installing ESET, you should not have any issue with your license. https://support.eset.com/kb2788/?_ref=zap thankyou both I just sent the logfiles to @Marcos Link to comment Share on other sites More sharing options...
Administrators Marcos 5,112 Posted October 6, 2018 Administrators Share Posted October 6, 2018 Hello, There's no attempt to run chromesetup.exe logged in the logs you have provided. Please provide ELC logs. Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 6, 2018 Share Posted October 6, 2018 (edited) On 10/6/2018 at 3:00 PM, Marcos said: Hello, There's no attempt to run chromesetup.exe logged in the logs you have provided. Please provide ELC logs. For some reason the ELC link in Marcos' post is not working (at least for me). Here's the KB link https://support.eset.com/kb3466/ Edited October 12, 2018 by TomFace Correted statement. Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 7, 2018 Author Share Posted October 7, 2018 6 hours ago, Marcos said: Hello, There's no attempt to run chromesetup.exe logged in the logs you have provided. Please provide ESET Log Collector logs. how do i do that? I only saw ways to send process log files and boot log files Link to comment Share on other sites More sharing options...
itman 1,681 Posted October 7, 2018 Share Posted October 7, 2018 12 hours ago, AJZ2000 said: how do i do that? I only saw ways to send process log files and boot log files ELC; i.e.Eset Log Collector, is a different Eset utility you have to download and run. See the Eset KB link @TomFace posted for instructions on how to download and run it. Use the default option for log collection since @Marcos didn't specify what logs he wanted. When the utility completes submit the created file to @Marcos as requested. Since the file created might exceed the maximum size allowed for Eset message file attachment, you might have to upload the file to a file sharing site. Then send @Marcos the provided link to the file on the file sharing web site. Link to comment Share on other sites More sharing options...
AJZ2000 0 Posted October 8, 2018 Author Share Posted October 8, 2018 On 10/7/2018 at 9:44 AM, itman said: ESET Log Collector; i.e.Eset Log Collector, is a different Eset utility you have to download and run. See the Eset KB link @TomFace posted for instructions on how to download and run it. Use the default option for log collection since @Marcos didn't specify what logs he wanted. When the utility completes submit the created file to @Marcos as requested. Since the file created might exceed the maximum size allowed for Eset message file attachment, you might have to upload the file to a file sharing site. Then send @Marcos the provided link to the file on the file sharing web site. On 10/6/2018 at 6:29 PM, TomFace said: For some reason the ESET Log Collector link in Marcos' post is not working (at least for me). Here's the KB link https://support.eset.com/kb3466/ thank you i just sent that to @Marcos as well Link to comment Share on other sites More sharing options...
Administrators Marcos 5,112 Posted October 29, 2018 Administrators Share Posted October 29, 2018 Could you confirm that the computer is not in a domain, ie. no group policies are applied? If you create a new administrator account and log into it, are you able to install Chrome then? Also you have One SystemCare PUA installed. Please uninstall it and try again. Link to comment Share on other sites More sharing options...
Recommended Posts