<triage> Could you please advise on the issue that you are observing?

Major problem is that google play apps keep loading on my machine.  I have a malware gallery app that loads images and have been corresponding with others on chromeos-support@google.com.  I have a version of google hangouts that after viewing with google developer program, appear to be the malware version from my hacked nexus phone I got rid of a year ago.

These are the items that seem to the the cause of going to google hangouts and finding 300+ people that are following me, including celebrities, government officials, lady gaga as well and google founders. My setting were to allow no one to contact me except people in my circles, but the screen with those settings are  whited out. My google drive apps also contain malware and though I have everything encrypted with a **separate pass phrase**, and **sync only bookmarks**, the google drive and google play apps all seem to load on my chrome books and in-fact are propagating to all my google accounts, including my children and work.  

I audited my sons account last night and he has the same android playstore junk on his chromebooks.  I am only set as the recovery email.  Some of the apps seem to be from my original galaxy 4 from several years ago--  But I don't understand why these don't go away.

Regarding the google hangouts loading on the machine----  Which does not actually show as an app, I found the following line items that look very suspicious to me.  Also noticed, the app stops the serviceworker if it notices that google dev is running.

--------
These are snippets of code that struck me out as not being quite right.  But you folks are a better judge that I am:

I sincerely apologize for the length of this message plus any info that is irrelevant.   I am trying very hard to help myself.  It is clear to me this is a google play hangout.  When I call the single contact I have left on G+ this app loads no matter what.  Going through this I found my google hangouts loads chats first, then hangouts and then seems to load all the people I have blocked. I kind of figured lady gaga wasnt really following me. :) It also stops the service worker if it notices google developer is running.  I can send screen shots if you would like.   After the weird hangouts code, I attached an analysis of what is currently loading stock on my chromebook as of tuesday-  it seems to think my chromebooks are phones, except with the most recent change, if it found an equivalent app on the chromestore it loaded that. (Except google drive apps loaded no matter what and they are VERY OLD)  The chromestore versions (or at least what is loading on all my chrome books are between 6 month and 2.5 years older than what is on android.  That does not seem right. 

This is the code I found running for google hangouts.  Thank you folks for your help.



https://clients6.google.com/rpc/plusi?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=json

Request URL:https://clients6.google.com/rpc/plusi?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=json
Request Method:POST
Status Code:200 
Remote Address:216.58.193.78:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
access-control-allow-credentials:true
access-control-allow-origin:https://hangouts.google.com
access-control-expose-headers:Cache-Control,Content-Encoding,Content-Length,Content-Type,Date,ETag,Expires,Pragma,Server,Vary,X-Google-GFE-Backend-Request-Cost
alt-svc:quic=":443"; ma=2592000; v="39,38,37,35"
cache-control:no-cache, no-store, max-age=0, must-revalidate
content-encoding:gzip
content-length:134
content-type:application/json; charset=UTF-8
date:Thu, 24 Aug 2017 01:14:08 GMT
etag:"1kh-2sIO8KHsRJAxZOzmWhmUv70/2ShavSSdhZGDCrxBP4hb5VUF994"
expires:Mon, 01 Jan 1990 00:00:00 GMT
pragma:no-cache
server:GSE
set-cookie:SIDCC=AA248bdHsqAJzGqnvTaBN24Ssc4an-LFHM-KQSM6NVkuOrzIoRa--cLrzAh5ckbvMW7851RpDaLLdsLUMCZ2pQ; expires=Wed, 22-Nov-2017 01:14:08 GMT; path=/; domain=.google.com; priority=high
status:200
vary:Origin
vary:X-Origin
x-content-type-options:nosniff
x-frame-options:SAMEORIGIN
x-xss-protection:1; mode=block
Request Headers
:authority:clients6.google.com
:method:POST
:path:/rpc/plusi?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=json
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en
authorization:SAPISIDHASH 1503537247_c07fccc98bac91ab359020bd0530980932eb6ebd
content-length:179
content-type:application/json
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; SIDCC=AA248bfiKjany4iMQ2pNMKMnT9vk3N0nOZKp7LygGTf5QvrA7itkitCj9jaEibSjXyxwQ-JAg4i-0ysDpSxokA
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
key:AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk
alt:json
Request Payload
view source
{method: "plusi.ozinternal.loadblockedpeople", id: "getBlockedUsers", apiVersion: "v2", jsonrpc: "2.0",…}
apiVersion
:
"v2"
id
:
"getBlockedUsers"
jsonrpc
:
"2.0"
method
:
"plusi.ozinternal.loadblockedpeople"
params
:
{includeChatBlocked: true, includeProfileInfo: "MEMBER_ID_ONLY"}
Name


https://clients6.google.com/voice/v1/users/@me/account?checkHangoutsCallingPermission=false&key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson

origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
checkHangoutsCallingPermission:false
key:AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk
locale:en
alt:protojson

----

:authority:clients6.google.com
:method:OPTIONS
:path:/chat/v1/presence/querypresence?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=protojson
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en-US,en;q=0.8
access-control-request-headers:authorization,content-type,x-goog-authuser
access-control-request-method:POST
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
Query String Parameters
view source
view URL encoded
key:AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk
alt:protojson


-----

content-type:application/binary
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; SIDCC=AA248bdV4RAiICuSKNLrclKk6rUw11709LsAEwrEKN8SrjiryoWj_duN9c3n9Oyq6cr55pEn5OrMlLDCEXB0sw
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
format:json
u:0
authuser:0
Request Payload
 ‹ e(žYÿÍ’ÑJÆ0…ß%ס$Ͳ´Ï’¿ " /æ Å÷_§EÆPü7†, ‡^œž~'Ô qú Ç?Äa˜áñùíõe¨‡ž  aŽ! ”æùTÈšc0  (« - •Ð XIT,vb©ƒv·el ü+t—x2´„7 ž–¹ >=ŒïC Ø:[w.¥q x­Æ®:Õ±3:9›V¬;‰ ó ˆã âx”Ø„Où7ÿ·ãJ¬×ßqÁob•œ2ü û“P™  b &K 
---------------------------------


user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-clientdetails:appVersion=5.0%20(Linux%3B%20Android%206.0%3B%20Nexus%205%20Build%2FMRA58N)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F60.0.3112.80%20Mobile%20Safari%2F537.36&platform=Linux%20x86_64&userAgent=Mozilla%2F5.0%20(Linux%3B%20Android%206.0%3B%20Nexus%205%20Build%2FMRA58N)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F60.0.3112.80%20Mobile%20Safari%2F537.36
x-goog-authuser:0
x-goog-encode-response-if-executable:base64
x-javascript-user-agent:google-api-javascript-client/1.1.0
x-origin:https://hangouts.google.com
x-referer:https://hangouts.google.com
x-requested-with:XMLHttpRequest
Query String Parameters
view source
view URL encoded
key:AIzaSyAfFJCeph-euFSwtmqFZi0kaKk-cZ5wufM
alt:json
Request Payload
view source
{jsonrpc: "2.0", apiVersion: "v2", method: "plusi.ozinternal.readfeatureditems",…}
apiVersion
:
"v2"
id
:
"GetFeaturedPhotos-7"
jsonrpc
:
"2.0"
method
:
"plusi.ozinternal.readfeatureditems"
params
:
{itemMask: {metadata: {ownerRef: {}}, itemType: {photo: {image: {}}}, photosProductUrls: {}},…}


----------------------


Request Headers
:authority:clients6.google.com
:method:POST
:path:/chat/v1/presence/querypresence?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=protojson
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en
authorization:SAPISIDHASH 1503537274_12abc173fedae4716aa57c3592125a54c6baac5a
content-length:171
content-type:application/json+protobuf
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; SIDCC=AA248bfswJzcQmFDdikw13_X51ZwQDruxpI8wjQSvrNaRvguqd9kL074iXKBht1DtR_sz7rLYTouJWsAH5OrPw
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
key:AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk
alt:protojson
Request Payload
view source
[,…]
0
:
[[44, 3, "chat_frontend_20170818.08_p0", 1503084873], ["lcsw_hangouts_FEB09D0D", "F99C5C542694675C"],…]
1
:
[["109165162807308502054"], ["103949692908730383386"]]
2
:
[2, 3, 10]


------------------

account?checkHangoutsCallingPermission=false&key=A…rkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson
log?format=json&authuser=0
plusi?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=json
plusi?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=json
log?format=json&u=0&authuser=0
data?ds.extension=116208916&f.sid=-645583955553132…08&soc-platform=1&soc-device=1&_reqid=362349&rt=c
querypresence?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=protojson
querypresence?key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&alt=protojson
rpc?key=AIzaSyAfFJCeph-euFSwtmqFZi0kaKk-cZ5wufM&alt=json
Inline image 2fw_NdmxETD5r6bWovOGA8mq3eJqFiOMT8TXEtg2KBle4UKqHbY…o0KFo5Skxk13vGKKkw01QLVc-nU=w1920-h1080-p-k-nd-no
Inline image 1yO_Wb4S6CLSGR8pyhxZqaxGsl9WFmeAwm-n0xT3FaiIC2Cw5cpthmjk=w256-h256-p-k-nd-no
request
--------------------------------

Request Headers
:authority:play.google.com
:method:POST
:path:/log?format=json&u=0&authuser=0
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en-US,en;q=0.8
authorization:SAPISIDHASH bc26e1268d956863ce43acc701cfc3cd21ba4953
content-encoding:gzip
content-length:196
content-type:application/binary
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; SIDCC=AA248bdV4RAiICuSKNLrclKk6rUw11709LsAEwrEKN8SrjiryoWj_duN9c3n9Oyq6cr55pEn5OrMlLDCEXB0sw
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
format:json
u:0
authuser:0
Request Payload
 ‹ e(žYÿÍ’ÑJÆ0…ß%ס$Ͳ´Ï’¿ " /æ Å÷_§EÆPü7†, ‡^œž~'Ô qú Ç?Äa˜áñùíõe¨‡ž  aŽ! ”æùTÈšc0  (« - •Ð XIT,vb©ƒv·el ü+t—x2´„7 ž–¹ >=ŒïC Ø:[w.¥q x­Æ®:Õ±3:9›V¬;‰ ó ˆã âx”Ø„Où7ÿ·ãJ¬×ßqÁob•œ2ü û“P™  b &K 

----

https://www.gstatic.com/_/boq/_/js/k=boq.PlusappPushNotificationsServiceWorker.en.bQks3pbpYhQ.O/m=base/rt=j/d=1/rs=AGLTcCOCyI88yLvMcU9pJieqKdMC1Nrfbw

---

referer:https://1.client-channel.google.com/client-channel/client?cfg=%7B%222%22%3A%22hangouts%22%2C%226%22%3A%22StartPage%22%2C%227%22%3A%22chat_frontend_20170818.08_p0%22%2C%228%22%3Afalse%2C%2213%22%3Afalse%7D&ctype=hangouts&xpc=%7B%22cn%22%3A%229WXKRyrqBn%22%2C%22tp%22%3Anull%2C%22osh%22%3Anull%2C%22ppu%22%3A%22https%3A%2F%2Fhangouts.google.com%2Frobots.txt%22%2C%22lpu%22%3A%22https%3A%2F%2F1.client-channel.google.com%2Frobots.txt%22%7D
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
x-origin:https://hangouts.google.com
Query String Parameters
view source
view URL encoded
ctype:hangouts
prop:StartPage
appver:chat_frontend_20170818.08_p0
gsessionid:B5bN7b-Sp7jZSI1_6Z5S81agUxG_Zklh
VER:8
RID:rpc
SID:D35F112566B73C9E
CI:0
AID:145
TYPE:xmlhttp
zx:ecdc48nxli26
t:1

------------

https://clients6.google.com/voice/v1/users/@me/account?checkHangoutsCallingPermission=false&key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson

Request URL:https://clients6.google.com/voice/v1/users/@me/account?checkHangoutsCallingPermission=false&key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson
Request Method:OPTIONS
Status Code:200 
Remote Address:216.58.193.78:443
Referrer Policy:no-referrer-when-downgrade

Request URL:https://clients6.google.com/voice/v1/users/@me/account?checkHangoutsCallingPermission=false&key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson
Request Method:OPTIONS
Status Code:200 
Remote Address:216.58.193.78:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
access-control-allow-credentials:true
access-control-allow-headers:authorization,x-goog-authuser
access-control-allow-methods:DELETE,GET,HEAD,PATCH,POST,PUT
access-control-allow-origin:https://hangouts.google.com
access-control-max-age:3600
alt-svc:quic=":443"; ma=2592000; v="39,38,37,35"
cache-control:no-cache, no-store, max-age=0, must-revalidate
content-length:0
content-type:application/octet-stream
date:Thu, 24 Aug 2017 01:14:05 GMT
expires:Mon, 01 Jan 1990 00:00:00 GMT
pragma:no-cache
server:GSE
status:200
vary:Origin
vary:X-Origin
x-content-type-options:nosniff
x-frame-options:SAMEORIGIN
x-xss-protection:1; mode=block
Request Headers
:authority:clients6.google.com
:method:OPTIONS
:path:/voice/v1/users/@me/account?checkHangoutsCallingPermission=false&key=AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk&locale=en&alt=protojson
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en-US,en;q=0.8
access-control-request-headers:authorization,x-goog-authuser
access-control-request-method:GET
origin:https://hangouts.google.com
referer:https://hangouts.google.com/webchat/load?prop=StartPage&pvt=AMP3uWadxd9Qj_M3-eCgvT-8pXUgR4ZB3VEyRv_1MR3DS4Zry9Dj8D-YYOzlQHr6cmBtP_UBITzsL2wWm0joBJN3VAbqbP8H3Q&fc=https://hangouts.google.com&ds&hl=en&zx=0.5824961943289051
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
Query String Parameters
view source
view URL encoded
checkHangoutsCallingPermission:false
key:AIzaSyBokvzEPUrkgfws0OrFWkpKkVBVuhRfKpk
locale:en
alt:protojson
-----

user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0
Query String Parameters
view source
view URL encoded
format:json
authuser:0
Form Data
view source
view URL encoded
[[1,null,null,null,null,null,null,null,["en-US","chrome","60.0.3112.80"],null,[null,"9592.71.0",3,null,"en",5]],407,[["1503537245038",null,[],null,null,null,null,"[300,1503537245038000,\"!KCulKwpCz-JwxY0q79REUVtjIlva-vgCAAABy1IAAAAgCgA367baXPz3g4qozNTmAODSVBGHEhTWPdhuyoy22a2BO5rOMEdC1qrYGPebDUuIL3iTRXzmP416dpkA6d6C695SVXnMZrl9VhhRmoGW9D5gouVCPvyshSwcorkDNDMW2ABrhEeXdOVm2IuUTzn_RCudOuJUWQZx-RoTgH4PRRWHNXH7ATWw66BTBeLbizv7u6mN50PMSPNvVZZrXjeqbFNPJuSD6jUWShcGeFwYdUjTpwUQBKsRJgdxSDbtZlz0QX1v0LdjLy2hvk0Tvgy9zXfVF2Bw13ezmcQv9JPUl4oVnrbWcqHWisnUme3Ub9XgQdUSsbpQGDvgV_xJc-TWIdWuRw7DMs0Kx3pAyVwGAoA8cowY5rdNefcE9rq5ZYzGkn5QBUNd\",877606322]",null,null,null,null,null,null,null,null,null,null,null,[]]],"1503537245038",[],null,null,null,null,null,null,null,null,0]:
authorization:SAPISIDHASH bc26e1268d956863ce43acc701cfc3cd21ba4953
content-length:760
content-type:application/x-www-form-urlencoded;charset=UTF-8
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; SIDCC=AA248bcWupfKrkZxdxEdNSgptwnlHUJJBHvHlIGdRpA04rervc9Up_9hCjRZa2ONDE0ScVcqRbcF6b4i_aWTuQ
origin:https://hangouts.google.com
referer:https://hangouts.google.com/
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0

--------------

Request URL:https://play.google.com/log?format=json&authuser=0
Request Method:POST
Status Code:200 
Remote Address:172.217.3.174:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
access-control-allow-credentials:true
access-control-allow-headers:X-Playlog-Web
access-control-allow-origin:https://hangouts.google.com
alt-svc:quic=":443"; ma=2592000; v="39,38,37,35"
cache-control:private
content-encoding:gzip
content-length:114
content-type:text/plain; charset=UTF-8
date:Thu, 24 Aug 2017 00:29:03 GMT
expires:Thu, 24 Aug 2017 00:29:03 GMT
server:Playlog
set-cookie:SIDCC=AA248bcIVlD299hCArV38AVVYNuYVeWLaLfO0VunVj7u5kRBGq4L1rok53hh85YU7-lRadHviGDin5VrZAwEfA; expires=Wed, 22-Nov-2017 00:29:03 GMT; path=/; domain=.google.com; priority=high
status:200
x-frame-options:SAMEORIGIN
x-xss-protection:1; mode=block
Request Headers
:authority:play.google.com
:method:POST
:path:/log?format=json&authuser=0
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:en-US,en;q=0.8
authorization:SAPISIDHASH bc26e1268d956863ce43acc701cfc3cd21ba4953
content-length:760
content-type:application/x-www-form-urlencoded;charset=UTF-8
cookie:NID=110=vaEKMEe60B3B_FBqj65rQiYDZ4_7FIl7p3f5x5pH0wIgwJ48qfOWPWTlCY8j38UG9UGhbE-njWKWrwSBhFwSy-TNWtjyHZkvGKgOUnesToqKP5NEIhRkeX0knXTaTflM_OmjKTZe7yBqtGB1hibEW4WI4wL9PYo4inJ9ZAk7bdc1Zvi-CaWKxaI0yaYkMuL34movK4JBoaTIrREgN679N2k5JH_JyXWQJkNP8CALD_H7; SID=FQXo0R-Uk8SnYdDJNPBNMJy1W_U6kV_xRfEDnxtlwG2C6FlTZf2zaOsfydVBUkuZOc6UFA.; HSID=A7tWr7krh9SUIgkcm; SSID=A05oK-dZOuxtzuTQy; APISID=Toja6ZU7nUMgR-kB/AluS7g4upHDNFoV2r; SAPISID=n5uEGTshuhCjfVIu/Am_RN9aVl1_OQw7R_; CONSISTENCY=AKJVzcqNhr7WMcH9s9V78p9z9aL7cLbAjTgVm3sLkpyz90mqsK0_MPp4637CqdzJWw8u305Jke1ZzB5gvNnwUmACjpKPxYWFXjP2zvZ8sebHPUdiD5fixhbdvTkR7PqCzyShydcrsS0m; SIDCC=AA248bcTpiSS-1fw-ORhEwEI32NzAfNkru6SjXRx-s1W01AopdCwq4LRTkOzpfsibefnybLtL7lqpx6qz-7w-w
origin:https://hangouts.google.com
referer:https://hangouts.google.com/
user-agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.80 Mobile Safari/537.36
x-goog-authuser:0

------
**********************************************************************

this was sent in email to bob on chromeos
-------------------------------------------------------------------
This report is current as of yesterday and the most current stable release of chromeos.


I was just able to update to the most current chromeos version this morning, but there are several issues still present on this device. The rogue galaxy photo viewer app is still present and I am not certain if there are others.  I have followed the changes you all have made to chromeos as best I could and though I see a few positive signs, the chromebook is still loaded with versions of google apps that vary from 6 months older than current to over 2.5 years old versions. I am puzzled why that is.   One fundamental question I have is which apps should be loaded "stock"?

I had never paid attention to the "get help" app previously, but the description says it manages apps and extensions, and I cannot determine if this is a 'good app' or not.  So here is the inventory I worked on for several hours today, it is a chromebook that was reset and power washed 3 times....  Please note the apps all loaded despite my custom sync phrase. I still have google play apps, and I have apps that don't seem to exist elsewhere on google, and google drive downloaded its malware apps also, despite my custom sync passphrase.
 
So it seems many of the apps that are loaded are extremely old, and even do not exist on google. To me that appears to be what was last loaded was when I had the android phone.  The phone was malicious and force paired with a mac, arp cache poisoned my network and horrible changes were happening constantly. Bob, this was when I first met you, I also has a project FI phone in an attempt to get away from this but they hacked the FI phone even worse.

Please see the chromelogs I posted a years ago under corinaaurdal@gmail.com that were closed as "wont fix".  This was why I got rid of my android phone, but the hackers are still present.  I will send another post about that to advise you--  I know the hackers can see my email and react to it, and I don't want to overshare, but I have found some additional news.

I also used google developer to go through the hangouts loaded on the machine and confirmed its malware and will send you the proof.  I assume you all must know this already and perhaps I must be wasting my time.  I tried for several hours to use css to bet to the screen where we could say only allow google contacts to contact my, by there is js and I am not fluent in that.

I'm just trying to get out of this hellhole and pray that someone on the otherside is reading this and actually cares.

Best Regards,
Corina Wilson

Mom of 3
Proud Geek
Woman who is still fighting hackers after 4.5 years
Mill Creek, Washington.
------------------------------------------------------------------


As Freshly Installed Apps Powerwashed (3x) on stable channel v60.0.3112.112 (Official Build) (64-bit) Tuesday 8/29

On Chromebook only:

Chrome /no version

Webstore /no version  >> did find extension 1.2.4 from July 24 2013 from chromium

HP /v1.3 >> did not show when I searched my apps, but I found it buried in chromestore, was not on my initial list of apps though it said was added on the front of the  listing in chromestore

Get Help /no version---  didn't come up anywhere

Calculator /v2.1.11 --only on chromestore updated 5-16-16

Google Photos /v1.0 updated 7-15-16 not on android according to chromestore, however I found it on google play no version listed, and it says its istalled but no devices present, upodate was Aug 28, 2017, one year later in development than what is on this chromebook.

Files /no version  ---  cannot find

--------------------------------

Chrome Remote DESKTOP /v61.03163.20  updated 8-22-17 Chromestore says also on android..  Should this be installed by default on my cb?  It has been from the start.

Camera /v4.7.0 found buried in chromestore updated 6-25-17  I don't think many people use this.  Should it be installed on my cb by default? It has been from the start.

-----------------------------------------------------


Gmail /v8.1 updated 8-29-15. Chromestore says also on android. On google play, it's the same version, says it's installed but I have no devices. Android version is 2 years later in development 8-24-2017.

Google Calendar /v4.5.1 updated 1-6-16.  Chromestore says also on android.. On google play, it says it's installed but I have no devices. Android version is 1 year later in development 8-28-2017.

Google Maps /v5.4.1 updated 9/17/15. Chromestore says also on android. On google play, it says it's installed but I have no devices. Android version is 2 years later in development 8-25-2017. Interestingly maps nav and transit says its installed, and doesnt mention I have no devices

Google Drive /v14.1 updated 4-16-16. Chromestore says also on android.  On google play, it says it's installed but I have no devices. Android version is 1.5 years later in development 8-25-2017.

Google+ /v1.5.1.1209 updated 12/9/15. Chromestore says also on android.  On google play, it says it's installed but I have no devices. Android version is 2.5 years later in development  8-28-2017.

You Tube /v4.2.8 updated 9-24-15.  Chromestore says also on android. On google play, it says it's installed but I have no devices. Android version is 2 years later in development, 8-29-2017. 

Google Play Music /v5.5 updated 6-28-16.  Chromestore says also on android. one year later in development at v7.11.5115-1.U updated aug 28, 2017. 

Google Play Books /v1.1.14 Updated 2-8-17. Chromestore says also on android.  On google play, it says it's installed but I have no devices. Android version is 6 months later in development 8-2-2017.

Google Keep notes and lists /v3.1.17351.1128 updated 8-28-17. Chromestore says also on android. This one looks like it might be okay.  The name is different (android doesnt say notes and lists, but it was updated Aug 29, 2017.

Google Play Movies /v1.629.0 updated 9-22-16 offered by google play- but it doesnt say also on android in the chromestore.  I checked google play and the android version was updated Aug 1, 2017, so the playstore version is one year ahead in development.

---------------------------------------------------
ARE THESE APPS being autoloaded on my chromebook despite my secondary encrypted password?   I do not sync anything except bookmarks due to being in the hacked state I am in.  I don't sync apps, settings, extensions, and I disconnect drive.  I rarely connect google drive to my chromebook, as I'm trying to keep 300 trolls out of my stuff.

Google Forms /no version on cb found version on chrome store but does not show as installed on this chromebook.   updated 9-9-2015 by drive.google.com

Google My Maps /no version on cb  -- cannot find on chromestore.  Found on google play, it's a version from May 5, 2016  Says it requires android. Does not show as installed, never the less it's on my chrome book under every single gmail account I have.  apps-help@google.com

Google Sites /no version on cb   Shows on chromestore as v9.04 but does not look like my icon.  offered by sites.google.com

Google Drawings /no version on cb  Shows on chromestore, but not as installed.   Asks if I wish to add to chrome.  By drive.google.com

Google Docs /v0.9 found this buried in chromestore and did not show on "my apps offered by drive.google.com and updated 2-5-15

Google Sheets /v1.1 found this buried in chromestore and did not show on "my apps offered by drive.google.com and updated 2-6-15

Google Slides /v0.9  found this buried in chromestore and did not show on "my apps offered by drive.google.com and updated 2-6-15


--------------------------------------------------------
Other issues with google play apps


https://play.google.com/store/apps/dev?id=5700313618786177705  
I have no idea how I got to this url, but inspecting apps installed on google play a couple apps went straight here.  is this googles dev-id?


https://play.google.com/store/apps/details?id=com.facebook.katana
beta version of fb  Email android-support@fb.com
-------------------------------------

Please let me know if you have any advice for me on the current age of the apps on my chromebook for corina.wilson@gmail.com or any suggestions on how to repair this.  I have looked all over and cant uninstall the drive apps.  there is no option.  I am not sure where to turn.

Best regards,
Corina

Just an fyi of a new issue that has returned, print to pdf will only print one page.  I just scrapped my 4th inkjet printer when I found it acting funny a couple months back---  (thinking brutal kangaroo as per wikileaks and I tossed EVERYTHING including all usbs early July) and have a new printer waiting when it's safe...

Perhaps I should send a new log...  Please advise.  I just bought a new Chromebook and see it takes about 22 circle revolutions to power-wash the new Chromebook, but the 3 existing Chromebooks I have power-wash in less than .5 of a second and less than 1/2 of a single circle.  I have been hacked and it has been ongoing.  And someone is adding my gmail accounts to apple and microsoft and my microsoft accounts to gmail and apple and adding all as aliases to yahoo, and even UA arts.  I am having to go back 20 years and audit all my kids accounts, but the end result is they are adding malware to the accounts the create, and as they are aliases, they propagate from account to account via one drive, google drive and icloud.  I have sent in files syncing from Facebook and windows malware all hidden on google drive.  I have shut down my face book account due to this. I can't get the attention of a real person to help me there.