Solved Weird NordVPN windows APP Update links to bizzarre url?

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.

Wallace_n_Gromit

Senior Member

L&LD

Part of the Furniture
And did you install it?

That first part of the URL is already suspicious enough for me to not have proceeded at all.
 

Wallace_n_Gromit

Senior Member
And did you install it?

That first part of the URL is already suspicious enough for me to not have proceeded at all.
No, I did not. As a result can't use my Nordvpn client app since it's been "updated" and won't allow me to go any further without "logging in". I was hoping that that site was a temporary one set up by Nordvpn like a CDN for this "update"

NOTE:

I first noticed this issue on a Widows 10 desktop that I've been troubleshooting today--It wouldn't do certain windows updates anymore. The pop up update showed up and I became wary when I saw that weird Url.

So I went to my primary desktop and went to nordvpn.com to find and download the windows app installer there. Strangely that app installer behaved the same way. So maybe it's legit?

With all this recent activity about supply chain hacks, you just don't know anymore.
 
Last edited:

L&LD

Part of the Furniture
Uninstall it. Reboot the computer. Check the Program Files directories (both of them) for NordVPN installations and completely remove them. Do a full system scan with your AV.

Repeat the full system scan with an online AV scanner that you trust.

Reboot the computer after it is done.

Scan again with a different online AV scanner.

Reboot again and download the official NordVPN program for your computer.

I still would not install until I verified from the NordVPN website that the file you downloaded is from them, and is the latest too.
 

ColinTaylor

Part of the Furniture
If you Google that domain name you'll see it's been discussed occasionally for a few years now. From what I can make out it looks to be legit (I see it when my NordVPN client starts up). I think it's used when the client verifies your account details.
 

Wallace_n_Gromit

Senior Member
Uninstall it. Reboot the computer. Check the Program Files directories (both of them) for NordVPN installations and completely remove them. Do a full system scan with your AV.

Repeat the full system scan with an online AV scanner that you trust.

Reboot the computer after it is done.

Scan again with a different online AV scanner.

Reboot again and download the official NordVPN program for your computer.

I still would not install until I verified from the NordVPN website that the file you downloaded is from them, and is the latest too.
Wow, very thorough. Concerning your last point: I'm trying to get a phone number for nordvpn/ start a chat session to see what they know about this. I think I'm pretty careful about my security but something like this happens and my hackles go up. :eek:
 

Wallace_n_Gromit

Senior Member
If you Google that domain name you'll see it's been discussed occasionally for a few years now. From what I can make out it looks to be legit (I see it when my NordVPN client starts up). I think it's used when the client verifies your account details.
Hey ColinTaylor, I was hoping you would chime in. I know you use Nordvpn from your prior posts.

The whole update GUI had changed and had never required logging into a Web session on a browser. Have other Nordvpn users, updating recently seen this?

Note: It is a bit enlightening what I'm reading about "https://auth.zwyr157wwiu6eior.com" after a duckduckgo search.
 
Last edited:

ColinTaylor

Part of the Furniture
Hey ColinTaylor, I was hoping you would chime in. I know you use Nordvpn from your prior posts.

The whole update GUI had changed and had never required logging into a Web session on a browser. Have other Nordvpn users, updating recently seen this?

Note: It is a bit enlightening what I'm reading about "https://auth.zwyr157wwiu6eior.com" after a duckduckgo search.
Just checked for updates on my client and it says this:
What's new:
• Fixed: Anti-proxy. Logging in to the NordVPN app will work smoothly even if you're using a browser proxy extension. We can all get along.
More about NordVPN 6.34:
We took up a challenge of telling you what's new in 40 seconds. Go!
New: From now on, you'll be logging in with your Nord Account – we'll take you to your browser to log in and then take you back to the app. If you ever decide to expand your protection beyond VPN, your Nord Account will work like magic when getting on board with other Nord Security products.
• Better: In addition to Windows 8.1 and Windows 10, split tunneling is now available on Windows 7 too.
• Fixed: Anti-splitter. This bug no longer gets in your way when using split tunneling.
• Fixed: The internet thief. Sometimes, it would stealthily do the mischievous work under the hood to leave you without an internet connection. Well, no more.
• Fixed: Fencer. This bug no longer prevents apps from accessing the IP address 127.0.0.1 with VPN disabled through split tunneling.
40 seconds. Nailed it.
 

Nebulaz

Occasional Visitor
I can also confirm, that my nord client pushed me to "zwyr157wwiu6eior.com". And Yes searching the site has brought up some interesting reads.
 

Wallace_n_Gromit

Senior Member
I can also confirm, that my nord client pushed me to "zwyr157wwiu6eior.com". And Yes searching the site has brought up some interesting reads.
I typically ignored the window that popped up (like I do with EULA's) when Nordvpn was announcing new updates (with explanations of updated features/fixes) and merely clicked on the "update" button on my first two Desktops.

On my 3rd desktop (which I just booted up recently and was offered the NordVPN update), I carefully read what the update consisted of and confirm what ColinTaylor and you yourself discovered.
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top