# Chrome seems to be holding bookmarks hostage? **URL:** \ **Category:** Factual Questions\ **Created:** [April 19, 2018, 5:20am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685 "2018-04-19T05:20:41Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![brujaja](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@brujaja](https://boards.straightdope.com/u/brujaja)\ **Post date:** [April 19, 2018, 5:20am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/1 "2018-04-19T05:20:41Z")
One of my clients apparently got some malware somewhere. He pays for a help-desk-type service, and they wound up installing a paid version of Windows Defender which restored function, but completely changed all of his settings, his desktop, etc. Okay, I wasn’t around for any of that. What I tried very earnestly to do for him today is restore his Chrome bookmarks, which disappeared. It was an unbelievable pain, because the “folder options” “view” tab had been not just greyed out, but cleared of any information or buttons, so I couldn’t even see the folder the bookmarks are stored in.(because they are hidden by default) So I had to reboot in safe mode and use the “attrib” command to remove the “hidden” attribute just to look in the folder. I found the “bookmarks.bak” file, dated the day before the disaster, 4 megs so I know it’s the right one. But the plain bookmarks file and the backup file are identical in size. They appear to be exactly the same. I did the filename switch anyway (method for restoring bookmarks from backup), restart chrome, and instead of bookmarks returning there is now a message from chrome saying he has to sign into his google account to retrieve the bookmarks. But he doesn’t have one, never has. He just uses the chrome browser. Decided to try the “forgot your password?” button, went through process, got email with one-time code to sign in, but after entering code, the next message is “we cannot verify that this is your email.” Well of course they can’t, because he has never told them what it was! So now he’s in a **Catch-22 Loop of Doom.** Is there any way out? ---
**Author:** ![DavidwithanR](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@DavidwithanR](https://boards.straightdope.com/u/DavidwithanR)\ **Post date:** [April 19, 2018, 5:59am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/2 "2018-04-19T05:59:43Z")
Can you install a different browser and ask the new one to import from Chrome? ---
**Author:** ![PastTense](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pasttense/32/14550_2.png) [@PastTense](https://boards.straightdope.com/u/PastTense)\ **Post date:** [April 19, 2018, 6:13am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/3 "2018-04-19T06:13:57Z")
> [@brujaja](#): > > One of my clients apparently got some malware somewhere. He pays for a help-desk-type service, and they wound up installing a paid version of Windows Defender which restored function, but completely changed all of his settings, his desktop, etc. Tell us more about this: it sounds similar to the tech support scams: > **[Tech support scammers find new way to jam Google Chrome (updated) |...](https://www.malwarebytes.com/blog/news/2018/02/tech-support-scammers-find-new-way-jam-google-chrome)** > > Update (2018-06-22): The bug was reintroduced in Chrome 67.0.3396.87, but fixed again. Update (2018-02-07): This issue with Google Chrome was reported here and... ---
**Author:** ![brujaja](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@brujaja](https://boards.straightdope.com/u/brujaja)\ **Post date:** [April 19, 2018, 6:22am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/4 "2018-04-19T06:22:36Z")
> [@DavidwithanR](#): > > Can you install a different browser and ask the new one to import from Chrome? Oh, I forgot to mention this. Sorry. He already had Internet Explorer, and I had already installed firefox. Trying to use their import functions results in an offer to import, but only from I.E. Neither of them list chrome as an import source.The bookmark file, oddly enough, has no file format, and firefox is specifically looking for HTML. (it can be opened with notepad.) The export function in chrome appears to be missing. Not just grayed out, gone. :rolleyes: ---
**Author:** ![brujaja](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@brujaja](https://boards.straightdope.com/u/brujaja)\ **Post date:** [April 19, 2018, 6:38am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/5 "2018-04-19T06:38:47Z")
> [@PastTense](#): > > Tell us more about this: it sounds similar to the tech support scams: > [https://blog.malwarebytes.com/malwarebytes-news/2018/02/tech-support-scammers-find-new-way-jam-google-chrome/](https://blog.malwarebytes.com/malwarebytes-news/2018/02/tech-support-scammers-find-new-way-jam-google-chrome/) God, it sure does! I am pretty sure he has an ongoing contract with a tech service of some kind. It looks to me like they may have done a reinstall, the kind that’s overlaid on the existing OS so that things like programs you’ve added on remain. Or maybe it was SFC; I am not conversant with how Windows Defender works. But his desktop was returned to generic & nearly all shortcuts were gone. Another thing I noticed was that no browser of the three would let me download anything. All downloads “failed.” It really was acting just like ransomeware. If the tech was not familiar with this new variant, god knows what kind of unholy hybrid may have been created. When I finally had to leave, firefox had started asking for a password out of the blue. I could only get around that by opening a new window. (the old net zero trick ho ho.) ---
**Author:** ![PastTense](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pasttense/32/14550_2.png) [@PastTense](https://boards.straightdope.com/u/PastTense)\ **Post date:** [April 19, 2018, 7:43am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/6 "2018-04-19T07:43:50Z")
I was wondering about your statement “paid version of Windows Defender”. As far as I know Windows Defender doesn’t have a paid version–it is completely free from Microsoft. While a tech support firm which he has a contract with might probably charge a service charge they would say that. So again this supports the idea of a scam. [https://www.microsoft.com/en-us/windows/comprehensive-security](https://www.microsoft.com/en-us/windows/comprehensive-security) ---
**Author:** ![DavidwithanR](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@DavidwithanR](https://boards.straightdope.com/u/DavidwithanR)\ **Post date:** [April 19, 2018, 9:31am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/7 "2018-04-19T09:31:03Z")
Ugh. Linux systems are very nice these days. Just saying. One downside of Linux: the paid version of Windows Defender definitely won’t run on it. ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [April 19, 2018, 12:21pm UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/8 "2018-04-19T12:21:35Z")
> [@brujaja](#): > > Another thing I noticed was that no browser of the three would let me download anything. All downloads “failed.” That goes with the rest of the damaged profile. His temp & tmp directories now point to non-existent or locked folders. System}Advanced|Environmental variables Where ever that is now. ---
**Author:** ![Jasmine](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jasmine/32/2964_2.png) [@Jasmine](https://boards.straightdope.com/u/Jasmine)\ **Post date:** [April 19, 2018, 12:38pm UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/9 "2018-04-19T12:38:34Z")
> [@DavidwithanR](#): > > Ugh. > > Linux systems are very nice these days. Just saying. > > One downside of Linux: the paid version of Windows Defender definitely won’t run on it. My FOG server is Linux Ubuntu, and I wouldn’t use that instead of Windows for myself for reasons that would take half a page to enumerate. ---
**Author:** ![Flyer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/flyer/32/7298_2.png) [@Flyer](https://boards.straightdope.com/u/Flyer)\ **Post date:** [April 19, 2018, 4:30pm UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/10 "2018-04-19T16:30:55Z")
> [@brujaja](#): > > Oh, I forgot to mention this. Sorry. He already had Internet Explorer, and I had already installed firefox. Trying to use their import functions results in an offer to import, but only from I.E. Neither of them list chrome as an import source.The bookmark file, oddly enough, has no file format, and firefox is specifically looking for HTML. (it can be opened with notepad.) If the problems with the system will still allow you to manually rename the file, you can add an extension to it. Sometimes that is enough to then allow a file to be opened. ---
**Author:** ![Blakeyrat](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Blakeyrat](https://boards.straightdope.com/u/Blakeyrat)\ **Post date:** [April 19, 2018, 11:30pm UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/11 "2018-04-19T23:30:36Z")
If the file is encrypted, as Chrome is suggesting, then you may be out of luck. Chrome stores its bookmarks in a SQLite file. You can find SQLite database browsers online, and see if any of them can open the file and view the bookmarks. Something like [this](http://sqlitebrowser.org/)might do the trick. On another note, based on what you’ve described about the state of this computer, I’d back it all up and do a wipe and reinstall of Windows. Go back to a clean state. (And yes, whoever gave him a “paid” version of Windows Defender must have been pulling some kind of scam, like PastTense says.) God knows what has been done to this poor computer; wipe it and reinstall. EDIT: sorry; the above info is wrong. Chrome’s _history_ file is a SQLite database. Its bookmarks file is a simple JSON file. Any text editor should be able to open and view a JSON file, again, assuming it hasn’t been encrypted in which case all bets are off. ---
**Author:** ![DavidwithanR](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@DavidwithanR](https://boards.straightdope.com/u/DavidwithanR)\ **Post date:** [April 20, 2018, 12:38am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/12 "2018-04-20T00:38:27Z")
People have criticized Microsoft in the past for too often advising wipe and reinstall, but in this case I think not wiping would border on crazy. ---
**Author:** ![Weisshund](https://avatars.discourse-cdn.com/v4/letter/w/ba8739/32.png) [@Weisshund](https://boards.straightdope.com/u/Weisshund)\ **Post date:** [April 20, 2018, 2:16am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/13 "2018-04-20T02:16:32Z")
> [@PastTense](#): > > I was wondering about your statement “paid version of Windows Defender”. As far as I know Windows Defender doesn’t have a paid version–it is completely free from Microsoft. While a tech support firm which he has a contract with might probably charge a service charge they would say that. So again this supports the idea of a scam. [https://www.microsoft.com/en-us/windows/comprehensive-security](https://www.microsoft.com/en-us/windows/comprehensive-security) Maybe this? [https://www.microsoft.com/en-us/windowsforbusiness/windows-atp?&WT.srch=1&WT.mc\_id=AID690518\_SEM\_VlzyOdqV](https://www.microsoft.com/en-us/windowsforbusiness/windows-atp?&WT.srch=1&WT.mc_id=AID690518_SEM_VlzyOdqV) ---
**Author:** ![Weisshund](https://avatars.discourse-cdn.com/v4/letter/w/ba8739/32.png) [@Weisshund](https://boards.straightdope.com/u/Weisshund)\ **Post date:** [April 20, 2018, 2:20am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/14 "2018-04-20T02:20:19Z")
OP Try this to get the JSON into an HTML format to re-import > **[Chrome Bookmarks Recovery Tool](https://rongjiecomputer.github.io/chrome/bookmark-recovery/#windows)** > > Tool to recover your lost Chrome bookmarks ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [April 20, 2018, 8:52am UTC](https://boards.straightdope.com/t/chrome-seems-to-be-holding-bookmarks-hostage/812685/15 "2018-04-20T08:52:22Z")
> [@Weisshund](#): > > Maybe this? > > [https://www.microsoft.com/en-us/windowsforbusiness/windows-atp?&WT.srch=1&WT.mc\_id=AID690518\_SEM\_VlzyOdqV](https://www.microsoft.com/en-us/windowsforbusiness/windows-atp?&WT.srch=1&WT.mc_id=AID690518_SEM_VlzyOdqV) That’s the version of Windows Defender sold to corporations that have hundreds of computers to manage & protect. Not something that a help-desk service would install for an individual user. More likely the “paid version of Windows Defender” is part of the scam.