[KingZero]

Hi, since yesterday google shows that I'm from Netherlands - that means pages are automatically in Dutch, ads are in Dutch and google searches are in Dutch (searches are ok, unless I'm logged out of my google account). Almost every device connected to my router has the same problem (2 phones seems to be ok. 2 computers and 2 other phones are not ok).

I have checked my location with mylocation.org and it has correct IP Address, as well as location(Poland). Google on the other hand shows Netherlands, but ip address is correct (shows IPv6 tho).

Also my router disconnected once yesterday and twice today. All disconnections required me to restart the router as it wouldn't connect again otherwise.

I'm not using any VPN - although FRST shows that I have Betternet VPN extension which I have removed long time ago. I don't thing this might be an issue as other devices aren't and weren't using it, but have the same problem.

I have been thinking if it could be a virus, so I did a deep scan with AVG on my computers, but it didn't find anything, same for Malwarebytes and F-Secure Router Checker. I'm attaching logs from FRST.

I have also done a factory reset on my router, but it didn't help. I've called my ISP and he didn't know what could be wrong there, but he did some reset on his end which also didn't help.

I don't know what else could I do to try and fix this. Any help will be appreciated.
My router model: Arris TG3492LG

 

[Gary R]

Sounds more like your Google account has been compromised than that you have an infection on your computer.

Secure a hacked or compromised Google Account - Google Account Help

If you notice unfamiliar activity on your Google Account, Gmail, or other Google products, someone else might be using it without your permission. If you think your Google Account or Gmail have been h

support.google.com

There's no obvious signs of an active infection in your FRST logs, though there are a lot of things that could probably do with "tidying up" and a few Chrome entries that I can't find any reliable information for.

I would also advise removing AVG, Mirosoft Defender is IMO a better product, and is better integrated into your OS, and therefore causes fewer problems.

If you do decide to remove AVG, don't use the onboard uninstaller as it does not do a very good job. Just let me know, and I'll advise you further.

So .... what I suggest is that you first investigate your Google account using the information provided in the link I posted above, and if that doesn't resolve things, then we'll deal with the "inconsistencies" in your FRST logs, and see whether that helps or not.

 

[KingZero]

Following steps in provided link didn't help. I've setup 2-factor authentication for my account, changed password and looked for any strange activity but there wasn't anything strange.

About AVG - yes, I would like to remove it from my PC, didn't know that onboard uninstaller isn't a good option to do that.

 

[Gary R]

Before attempting to remove AVG, please save any open work, and then create a System Restore Point.

How to Create System Restore Point in Windows 11/10

You can manually create System Restore point at any time in Windows 11/10 and also setup your device to create automated System Restore points.

www.techbout.com

Once that's been done, then to remove AVG from your computer, please follow the instructions for using AVG Remover in the following article ....

Download AVG Removal Tool 2020 to Remove All AVG Products From PC

Looking for AVG Removal Tool? Download AVG removal tool 2020 to remove all Avg products from PC. AVG uninstaller removes products like AVG Free Antivirus.

techreviewpro.com

Once AVG has been removed, Microsoft Defender should automatically switch on to protect your machine.

Next ....

Please run a new scan with FRST and attach the new Frst.txt and Addition.txt in your next reply.

 

[KingZero]

Ok, here is another log without AVG.
Today I also had my router replaced, because of the notorious disconnects, it didn't help with the Netherlands location tho.

 

[KingZero]

Update: When I try to enter BIOS settings or start in Safe Mode my screen goes black and I can't do anything. I'm rarely doing it but I remember that it worked the last time I did.
Also my graphic card fans goes crazy every several seconds when I have mid-heavy process running.

 

[Gary R]

Looking over your latest logs now. Dependent on how many items I need to research, this might take a while. I'll be back as soon as I've finished.

 

[Gary R]

Please do the following ....

• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
• Press Ctrl+y (Ctrl and y keys at the same time)
• A blank randomly named .txt Notepad file will open.
• Copy and paste the following into it (don't include Code: ) ....

HKLM\...\Run: [AVGUI.exe] => "C:\Program Files\AVG\Antivirus\AvLaunch.exe" /gui
HKLM-x32\...\RunOnce: [AvgRemover] => C:\WINDOWS\system32\avgremoverx.exe /run_number=2 /max_runs=2 /ndis_nextstep=4 /norestart /selfremove
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR Notifications: Default -> hxxps://csgofloat.com; hxxps://dom2novost.ru; hxxps://mail.google.com; hxxps://steamcommunity.com; hxxps://www.funzug.com; hxxps://www.resist-temptation.com
CHR HomePage: Default -> hxxp://mysearch.avg.com?cid={683ACC00-44AF-491D-A546-476481ABECC9}&mid=999f2de6482b47d3b95602ac1590246a-c5a25f5602b5d352358c50a09864849491025e84&lang=pl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2013-12-20 18:54:52&v=17.2.0.38&pid=safeguard&sg=&sap=hp
CHR Profile: C:\Users\rados\AppData\Local\Google\Chrome\User Data\Guest Profile [2021-04-15]
CHR Profile: C:\Users\rados\AppData\Local\Google\Chrome\User Data\System Profile [2021-04-14]
2021-04-16 12:00 - 2021-04-16 12:00 - 004146112 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgremoverx.exe
2021-04-16 12:00 - 2021-04-16 12:00 - 000000000 ____D C:\Program Files\Common Files\AVG
2021-04-15 16:34 - 2021-04-15 16:34 - 014354752 _____ (AVG Technologies CZ, s.r.o.) C:\Users\rados\Downloads\avgclear.exe
2021-04-15 16:04 - 2021-04-15 16:28 - 000000000 ____D C:\AVG_Remover
2021-04-15 16:03 - 2021-04-15 16:03 - 007986864 _____ ( ) C:\Users\rados\Downloads\AVG_Remover.exe
2021-04-14 09:30 - 2021-04-14 09:30 - 000259344 _____ (AVG Technologies CZ, s.r.o.) C:\Users\rados\Downloads\avg_antivirus_free_setup (2).exe
2021-04-12 23:03 - 2021-04-12 23:03 - 000259344 _____ (AVG Technologies CZ, s.r.o.) C:\Users\rados\Downloads\avg_antivirus_free_setup (1).exe
2021-04-16 09:32 - 2020-09-15 10:11 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVAST Software
EmptyTemp:
Hosts:
Cmd: ipconfig /flushdns

• Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

Next ....

Please remove the following Chrome Extensions ....

CHR Extension: (VPN Free - Betternet Unlimited VPN Proxy) - C:\Users\rados\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjknjjomckknofjidppipffbpoekiipm [2021-04-10]
CHR Extension: (Program uruchamiajacy aplikacje dla plików z Dysku (od Google)) - C:\Users\rados\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2021-01-23]
CHR Extension: (Platnosci w sklepie Chrome Web Store) - C:\Users\rados\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]
CHR Extension: (Chrome Media Router) - C:\Users\rados\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-03-04]
CHR HKU\S-1-5-21-2701041560-1222528715-2855617920-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]

See .... How to Remove Chrome Extensions (Fully) • Productivity Portfolio

 

[KingZero]

Extensions removed. I'm attaching a fixlog

 

[Gary R]

Any improvement ?

Question .... does Google still see you as being from the Netherlands ?

If Google still thinks you're in the Netherlands, run a search and if Google is determining your location from your IP address, then at the bottom of the results page it will say something like ....

United Kingdom
Basingstoke - From your Internet address - Use precise location - Learn more

(By the way, I'm not from Basingstoke, that's just an example)

If you don't see that, then your location is being determined by something else.

Google uses a number of things to determine your location ....

Understand & manage your location when you search on Google - Android - Google Search Help

When you use Google, like with Maps, Search or Gemini, your current location is used to give you more helpful results. For example, if you search for coffee shops, you’re likely searching for coff

support.google.com

 

[KingZero]

In the incognito mode:
Netherlands, Nederland - Gebaseerd op je internetadres - Precieze locatie gebruiken - Meer informatie

In normal mode:
Netherlands, (PostCode), Katowice, Poland - From your places (Home) - Use precise location - Learn more

Edit:
It's kinda strange that in normal mode it shows Netherlands as well as Poland at the same time.

 

[Gary R]

From everything I've seen so far, your problem appears to be with your Google account, either from the settings that you are using, or some malfunction within Google's software.

I see no evidence in any of the logs that you've posted that your problem is being caused by an infection on your computer.

Google problems are not my area of expertise, to be honest I neither have a Google Account, nor do I use Google as my search engine (far too invasive for my liking).

So all I can suggest is that you post for help on Google Account Support ...

Google Account Community

... since they are most likely to be able to resolve your problem.

 

[KingZero]

Ok, thank you so much for your time and trying to help, I really appreciate that

I've just solved issues with black screen and my GPU fans. Here are solutions that worked for me in case anyone falls into the same problem:

For black screen I've just detached my VR headset(for you it might be other external device). I'm not sure why, but probably this device was detected as a main screen.

For fans going crazy and jumping from 50% to 100% RPM every several seconds - I've mounted a support under the GPU that holds it. It is a support that comes with the GPU and it is highly recommended to use it as the GPUs are quite heavy these days. It helped me and it helped my friend some time ago when he wrote to MSI for a solution and that was the first thing they have told him to do.
I didn't mount the support before as I didn't know how and couldn't find any information about it, so I just thought it was a visual addon only.

The only problem left is the location issue, which now after solving the rest of the issues it may seem more like a bug than virus. Every problem happening in this short period of time was just unfortunate series of events.