New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 89 users

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Feb 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 2
Type: Bug

Restricted
  • Only users with EditIssue permission may comment.



Sign in to add a comment

NETWORK_FAILED when downloading AdBlock

Reported by crazyske...@gmail.com, Jul 5 2014

Issue description

UserAgent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Steps to reproduce the problem:
1. Go to the AdBlock page on the Web Store
2. Try to download it

What is the expected behavior?
99% of users can download AdBlock.

What went wrong?
Many users have been getting an error: "NETWORK_FAILED".

I have attached a screenshot a user provided us with

WebStore page: https://chrome.google.com/webstore/detail/gighmmpiobklfepjocnamgkkbiglidom

Did this work before? Yes Just over a week ago

Chrome version: 35.0.1916.153  Channel: stable
OS Version: Ubuntu 12.04
Flash Version: Shockwave Flash 14.0 r0

When users try to download AdBlock from our website (uses the extension install API) they get the permissions window, but when they click "Add", nothing happens.
 
whee.png
300 KB View Download
Showing comments 74 - 173 of 173 Older

Comment 74 by Deleted ...@, Sep 9 2014

Running into the same thing. log attached 
net-internals-log.json
1.9 MB Download

Comment 75 by Deleted ...@, Sep 10 2014

Here is a screenshot of my problem. I need it fixed immediately.
Screen Shot of Network_Failed.jpg
332 KB View Download

Comment 76 Deleted

Comment 77 by Deleted ...@, Sep 17 2014

log as per the the thread, cant download extentions
net-internals-log.json
3.0 MB Download

Comment 78 by Deleted ...@, Sep 19 2014

i can confirm this fixed it. https://code.google.com/p/chromium/issues/detail?id=391552#c59

Thanks!

Though i do suggest using the application to search for infected files as mentioned in that post, as the folders were obviously different for me, and it seemed to infect all third party extensions. 

Comment 79 Deleted

Comment 80 Deleted

Comment 81 by ngy...@gmail.com, Sep 20 2014

For those who are still having issues with this, please try re-installing Chrome at https://www.google.com/chrome/

After that, update your antivirus and do a virus scan.

Comment 82 by Deleted ...@, Sep 21 2014

I have tried everything that could possible be done and even tried uninstalling & reinstalling the Google Chrome from the system ...it still does not work...Please help.

Comment 83 Deleted

Comment 84 Deleted

j'ai un problème avec l'installation de l'extension de AdBlock et AdBlock Plus
AdBlock.bmp
4.1 MB Download
Abdock plus.bmp
4.1 MB Download

Comment 86 by Deleted ...@, Sep 24 2014

in reference to post 59, how do you extract these files?
command prompt is not registering Extract as a command, im not sure how to do this task.

Comment 87 Deleted

Comment 88 Deleted

Comment 89 Deleted

Comment 90 Deleted

Comment 91 Deleted

Comment 92 by Deleted ...@, Oct 1 2014

i think this is deliberate fouls from chrome, so chrome should be fixed soon. 
there plenty of people who don't know or doesn't know how to come this forum so think about they can go another browser
Cc: mad@chromium.org
The problem you describe is caused by software that was installed on your computer. Apparently, this software modified your extensions and worse your Chrome binary.

It is difficult for us to fix this if we don't know which program is or was running on your machine. We have people on this topic but it is hard.

What you can try:
1) Uninstall Chrome.
2) Move your Chrome user directory to a different place (rename %USERNAME%\AppData\Local\Google\Chrome\User Data\Default to %USERNAME%\AppData\Local\Google\Chrome\User Data\Default.old).
3) Re-install Chrome.
4) See whether this fixes the problem. If not, the software might still be running in the background and changing your new version of Chrome.

Comment 94 by rob@robwu.nl, Oct 6 2014

Cc: surkov@chromium.org asargent@chromium.org
 Issue 391588  has been merged into this issue.

Comment 95 by rob@robwu.nl, Oct 6 2014

 Issue 418770  has been merged into this issue.

Comment 96 by mad@chromium.org, Oct 7 2014

You can also look through the DLLs in chrome://conflicts and see if something seems odd (or paste the content to this bug so we can look at it). You can also look at the Layered Service Providers table in the chrome://net-internals/#modules page and see if there's anything else than %SystemRoot%\system32\mswsock.dll in there...

Comment 97 by Deleted ...@, Oct 9 2014

What about a complete reformat?

Comment 98 Deleted

Comment 99 Deleted

Comment 100 Deleted

Comment 101 Deleted

Comment 102 by Deleted ...@, Oct 16 2014

RESOLUTION: 
 
1.Uninstall Google Chrome 
2.Reboot your computer 
3.Install Google Chrome
4.Go to extensions and download what u need ! 
In addition to #102:

You need something to get rid of the "epicunitscan.info" malware before reinstalling Chrome. Otherwise later or earlier the malware will change the chrome.dll again and problem goes back.

Unfortunately I am not virus/malware expert and I don't know what AV tool can help with this malware.

Comment 104 Deleted

Comment 105 by rob@robwu.nl, Oct 17 2014

A user sent me a copy of their Chrome 37.0.2062.103 directory, which I've analyzed using xxd, diff, objdump and IDA.
Out of all files in the application directory, only the chrome.dll and chrome_child.dll binaries were modified.
All other files (including the installer) were not modified, so the root cause is probably malware that infects the Chrome binary on the user's computer. There is probably nothing wrong with Google's infrastructure, because the installation files are clean.


In total, there are 5 modifications in chrome.dll and one in chrome_child.dll:
www.googleapis.com/chromewebstore/v1.1/items/verify was replaced with
epicunitscan.info/0chromewebstore/v1.1/items/verify
(see https://cs.chromium.org/kBackendUrl - to bypass the extension validation)

clients2.google.com/service/update2/crx was replaced with
epicunitscan.info/00service/update2/crx (twice)
(see https://cs.chromium.org/kExpectedWebStoreUrl - "The web store url that is the only trusted source for extensions.")
(see https://cs.chromium.org/kGalleryUpdateHttpsUrl - overrides the default update url; this change is also in chrome_child.dll)

(output of objdump -x -D chrome.dll, unified diff)
- 1c6c32f:  0f 94 c0              sete   %al
+ 1c6c32f:  83 c8 01              or     $0x1,%eax
(see https://cs.chromium.org/%22join_status%20==%20::NetSetupDomainName%22 - This is used to suppress update notifications, probably an attempt to keep the user at this old infected version of Chrome)

- 1dcb649:  55                    push   %ebp
- 1dcb64a:  8b ec                 mov    %esp,%ebp
- 1dcb64c:  83 ec 20              sub    $0x20,%esp
- 1dcb64f:  a1 00 25 81 03        mov    0x3812500,%eax
+ 1dcb649:  33 c0                 xor    %eax,%eax
+ 1dcb64b:  c2 08 00              ret    $0x8
+ 1dcb64e:  20 a1 00 25 81 03     and    %ah,0x3812500(%ecx)
I have no idea what the original code does, but this change causes some (security check?) to be skipped.

SHA-256 checksums:
Original (Chrome 37.0.2062.103):
8dbc627efde9ea38dabae39bd4e6edd1e4c9e4de6591ca039e661a8f1e7fea4d  ./chrome_child.dll
e59bd02aadf06bf0d60c8ef1f4b7040e22e2c447823f2665bf655774ccc127a3  ./chrome.dll
787c359946c97c150ff86ce5cd6d4a68e52c8ac70d216bcb09dfc3f7a80dfd24  ./Installer/setup.exe
0ef35ae29ccd173097d1e261d79522737f4c5d3e564291f713906d53cac1a28e  ./chrome.7z

Infected:
cf8a4d96561da909e12f676286ffa799b7a23fb5106c4e68a6e6ca6b7a26342d  ./chrome_child.dll
fdfc6fbd810e8672497ad9fc0f578f6f8d92ce47bc3af36cdd25884f23dba579  ./chrome.dll

Disappointingly, NONE of the malware scanners have picked up the infected files:
https://www.virustotal.com/en/file/fdfc6fbd810e8672497ad9fc0f578f6f8d92ce47bc3af36cdd25884f23dba579/analysis/1413538857/ (chrome.dll)
https://www.virustotal.com/en/file/cf8a4d96561da909e12f676286ffa799b7a23fb5106c4e68a6e6ca6b7a26342d/analysis/1413539728/ (chrome_child.dll)

Hopefully, AV vendor reads this comment and update their signature databases to detect this kind of malware.
I still don't know the origin of this malware. If you are infected with this malware, you could help by sharing information about what you did before you got infected. Either by posting a comment to this issue, or by contacting me at rob@robwu.nl
Follow the directions posted by royalme...@sbcglobal.net i was able to locate all the infected extensions and files and remove this malware. this restored my ability to use the web store. NO scanners or malware or virus will pick this up. if you follow the directions you will be able to restore your browser. its worth the effort. and a big thanks to Royalme
rob@robwu.nl

i noticed that i had an ad based malware bug infect my chrome browser two days ago. not sure where i picked it up but i suspect a torrent. this lead me to these pieces of malware on my system which i removed. VirtualStore, DriverTuner, SShopDrop, Savelots, PC_Booster, DealExpress, AllCheapPrice, and Pricedrop malware bugs. i am not sure which indidual ones were the initial infection and which were subsequent. i only discovered the bug with the extension store when i went to get an adblocker extension to avoid the pop ups. that lead me to this thread where i was able to locate the epicunitscan in my log files. the JSON file looks to be whats allowing it to corrupt various extensions which all needed to be removed and re installed. 
Cc: miket@chromium.org

Comment 109 Deleted

Comment 110 by Deleted ...@, Oct 21 2014

Im having the same issue as everyone else and I can not fix it, I have tried everything that was suggested and it still is not woring for me can someone please help me.

Comment 111 by rob@robwu.nl, Oct 21 2014

I just checked with Michelle, and her problem was not caused by a bug in Chrome or malware, but by a modification of her hosts file.

Use notepad to open %WINDIR%\system32\drivers\etc\hosts

and make sure that you don't see anything like

127.0.0.1   clients1.google.com
127.0.0.1   clients2.google.com
127.0.0.1   clients3.google.com
...

Comment 112 Deleted

Comment 113 Deleted

Comment 114 Deleted

Comment 115 Deleted

Comment 116 Deleted

Deleting "me, too!" comments. If you'd like to express interest in an issue, please star it.

Comment 118 by Deleted ...@, Nov 1 2014

Rob,

I do see those things like

"127.0.0.1   clients1.google.com
127.0.0.1   clients2.google.com
127.0.0.1   clients3.google.com"

What do I do now?

Thanks!

Comment 119 by rob@robwu.nl, Nov 1 2014

#118
1. Open %WINDIR%\system32\drivers\etc\hosts
2. Delete every line that contains something like clients1.google.com
3. Save the file.

As a recap for everyone who does not want to read the whole issue: I have identified two possible causes for "NETWORK_FAILED". One of them is listed above.

The other cause originates from malware that modifies the Chrome binary (see comment 115,  http://crbug.com/391552#c115  for the full analysis). The solution to that problem is to re-install Google Chrome from https://www.google.com/chrome/browser/.

If neither of these solutions solve the issue, send me a mail, then I'll try to help you out.

Comment 120 by Deleted ...@, Nov 1 2014

Hi Rob,

I deleted every line, but when I try to save it, I get a message saying I don't have permission, and that I need to contact the administrator. What should I do now?

Thanks!

Comment 121 by rob@robwu.nl, Nov 1 2014

#120
1. Start notepad.exe as administrator (e.g. Windows + R (run), "notepad.exe")
2. Open %WINDIR%\system32\drivers\etc\hosts
3. Remove every line that contains clients*.google.com and save it.

If you fail at step 1, then you are probably not on an administrator account. Ask the one who manages your computer for help (search on Google if you don't know how to use an administrator account. And NEVER install software that promises to make you admin, you don't need any additional software to use the Windows administrator account).

Comment 122 Deleted

Comment 123 Deleted

Comment 124 Deleted

Comment 125 by Deleted ...@, Nov 4 2014

New report for this problem....

Search Criteria

File name:        *             
Containing text:  epicunitscan  
Look in:          C:\           


Search Statistics

Found:     7 items (81.79 MB)         
Text:      24 hits                    
Searched:  297.485 items (114.36 GB)  
Checked:   361.857 items (114.36 GB)  
Status:    Completed (01:39:50 secs)  


Name             Location                                                            Modified          Size      Type                       Hits 
                                                                                                                                                 
chrome.dll       C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\     27-10-14 02:05:46 29.850 KB Extension de l’application 3    
chrome_child.dll C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\     27-10-14 02:05:47 32.912 KB Extension de l’application 1    
Chrome-last.dmp  C:\Program Files (x86)\Google\CrashReports\                         02-11-14 18:04:40 828 KB    Fichier DMP                14   
Preferences      C:\Users\Laure\AppData\Local\Google\Chrome\User Data\Default\       03-11-14 22:58:59 112 KB    Fichier                    1    
data_1           C:\Users\Laure\AppData\Local\Google\Chrome\User Data\Default\Cache\ 03-11-14 22:58:59 520 KB    Fichier                    1    
data_2           C:\Users\Laure\AppData\Local\Google\Chrome\User Data\Default\Cache\ 03-11-14 22:58:59 4.104 KB  Fichier                    1    
System.evtx      C:\Windows\System32\winevt\Logs\                                    03-11-14 21:32:48 15.428 KB Journaux d’événements      3    

Report generated by Agent Ransack on 04-11-14 02:02:48
SearchResults.txt
42.3 KB View Download
I have deleted all the files, uninstalled chrome, rebooting the computer.
new installation of chrome, installed ADblocker plus (ok it works) BUT, after 3 min. 3 new files nammed... manifest.json

some idea ???

Comment 127 by rob@robwu.nl, Nov 4 2014

#125
You have an old and infected Chrome version (37.0.2062.103), which I have already analyzed in comment 105: https://code.google.com/p/chromium/issues/detail?id=391552#c105. Remove and install Chrome to resolve your issue. Make sure that you get the latest version of Google Chrome from https://www.google.com/chrome/browser.

#126
Contact me if you want me to take a look at your problem via TeamViewer.
@rob for information; i resolve the problem of the reactivation of manifest.json. i have disabled the plugin pepperflash in chrome.

for the epicunitscan same thing, no more traces...

if this way can help you...
pepper-plugin-desactiver.jpg
37.4 KB View Download

Comment 129 Deleted

Comment 130 Deleted

Comment 131 by Deleted ...@, Nov 8 2014

I managed to fix it.

Start > Run > regedit

HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Google > Update

Now, if you see a file that's labeled:

Update{8A69D345-D564-463C-AFF1-A69D9E530F96}

or

Update{8BA986DA-5100-405E-AA35-86F34A02ACBF}

then it means you're being stopped from updating any further. I deleted the value I had (Update{8A69D345 - and so on) and then went to the next step.

1. Go to the Customize button of chrome, right under the X at the top-right corner, the three bars. 
2. Click 'About Google Chrome'
3. 
   A) If it says 'Updates are disabled by Administrator' then open start > run > regedit. Go to the place where the values were located, as I mentioned before, and double click on UpdateDefault (or DefaultUpdate). 

Change the Value Data FROM 0 TO 1. 0 -> 1. Click Ok, and then go back to the 'About Google Chrome' page again and it should start searching for updates, if not, refresh and that should work. It'll take a few minutes and then it will tell you to restore, do so, and there you have it. The latest version of Chrome, and that will have fixed it for you (Hopefully).

   B) If it doesn't say 'Updates are disabled by Administrator', it should just start looking for updates, and after a few minutes, it should give the "restore" option and that will fix it too. 

I hope this helps you guys. I know I went crazy trying to find a fix somewhere, so I collected all I could find and do to give it to you guys so you don't have to go through the same complications and you can go on about your day without frustration. :D

However, if it doesn't fix your problem, I'm really sorry. This is all I've come up with. I wish you luck.

Have a good day!

Comment 132 Deleted

Comment 133 by rob@robwu.nl, Nov 9 2014

#132
Open the task manager (e.g. via the contextmenu on Windows' task bar), kill all processes called chrome.exe, then try to install again.

Comment 134 Deleted

So after a bunch of experimenting I found that Google Sync is in fact syncing the infected extensions. Following the instructions in comment #59, the Chrome reinstall seemed clean at first. However, the moment I logged in to Chrome (initiating the sync), epicunitscan immediately reappeared in my event logs. In the end I had to fully clear Chrome Sync. Instructions:

1. Backup what you need. Backing up bookmarks should be safe (but I have not tested it). Open bookmark manager (Ctrl+Shift+O) and choose Organize -> Export. You could search for epicunitscan in the resulting file to be safe. You cannot back up extensions, because they are now infected. Just remember a list of their names and reinstall (from the clean Chrome Store) after. 

2. Uninstall and nuke everything. Personally, I uninstalled, deleted the C:\Users\UName\AppData\Local\Google\Chrome folder entirely. I also went in to regedit and nuked HKLM\\Software\Wow6432Node\Google\Chrome and only the chrome-related entries under HKLM\\Software\Wow6432Node\Google\Update\{Clients,ClientState,ClientMedium}. This was possibly unnecessary. Revo Uninstaller may have the same effect.

3. Nuke the Google Chrome sync files. Chrome is uninstalled, so use any other internet browser. Go to Google Dashboard and log in: https://www.google.com/settings/dashboard. Scroll down to Chrome Sync. Click Manage Chrome Sync and choose Stop and Clear. 

4. Download a clean chrome installer. I suggest the offline installers, just in case the Google Update installer is infected as well. Link to the offline system-wide installer: http://www.google.com/chrome/eula.html?system=true&standalone=1

5. Install Chrome and log in. This should cause it to sync a new, empty user profile, cleaning out the infected extensions. You can now re-import your bookmarks, and install all of your extensions again from the store. You shouldn't be getting and epicunitscan in your network logs!!


Comment 136 by Deleted ...@, Nov 10 2014

You would also need to do the above on any other computer on which Google Chrome is synced.
Folks, please stop using this issue tracker as a support forum. There is a site that is designed especially for you: https://productforums.google.com/forum/#!forum/chrome. Thank you.
It turns out it was related to the "updates are disabled by the administrator" issue everyone is having.  You have to edit the registry for this to work.  Please follow steps:

1. Press the Windows key + R, type regedit.exe and press Enter 
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\ 
3. Double-click on UpdateDefault or DefaultUpdate 
4. Change the data type 0 to 1 
5. Exit the registry editor and launch Chrome

After I did this, there were no issues with installing and or updating extensions and Chrome.  Hope it helps somebody!!!!
Cc: robertshield@chromium.org

Comment 140 Deleted

Comment 141 Deleted

Comment 142 Deleted

Comment 143 Deleted

Comment 144 by Deleted ...@, Nov 18 2014

I have the same problem, I attached a screen print and a net-internals review.
net-internals-log.json
1.8 MB Download
chrome problem.png
254 KB View Download

Comment 145 Deleted

Comment 146 by Deleted ...@, Nov 21 2014

I read this thread down to # 35.  This is the export requested from my machine which is infected with opicunitscan.
net-internals-log.json.txt
3.4 MB View Download

Comment 147 by rob@robwu.nl, Nov 21 2014

I received the binaries of an infected Chrome 38.0.2125.104 and 38.0.2125.111. The modifications (see attachment) are almost identical to what I have reported in  https://crbug.com/391552#c105 , except the previously mentioned "I have no idea what the original code does" part is not present.

This makes me believe that the chrome binary is infected by a simple search-and-replace, and that the issue could be worked around by changing code in Chromium such that the compiled result does not contain the matching byte sequences. This will only eliminate the symptoms, not the root cause though...

For the record, this particular user allegedly downloaded pacman via a torrent before he got infected. If you are infected as well and you know what you did before you got infected, send me a mail with these details. That will help me with pin-pointing the root cause of this infection.
chrome-38.0.2125.111.diff
1.1 KB Download

Comment 148 Deleted

Comment 149 Deleted

Comment 150 by Deleted ...@, Nov 25 2014

I also face same problem and found this video just toady and it realy help me with this shit add-on problem of Google chrome, in video they show how to fix AdBlock network_failed error
https://www.youtube.com/watch?v=1dq_uurWk3I

Comment 151 Deleted

Comment 152 by Deleted ...@, Dec 2 2014

Fix it http://prntscr.com/5chxju
Cc: battre@chromium.org
Labels: Restrict-AddIssueComment-EditIssue
Owner: asargent@chromium.org
At this point we're pretty sure that this error is primarily caused by malware / unwanted software on your machine actively tampering with the contents of the chrome binary and your user profile directory data. Some of the common ways we see people ending up with this kind of unwanted software is that it is bundled with the install of some other "free" native software like bittorrent clients, download managers, registry cleaners, screensavers, or in non-authoritative installers (eg a skype installer that doesn't come from skype.com). These ride along programs often make money for their authors by changing your chrome new tab page and/or search provider to something you didn't want, installing extensions which inject/replace ads on web pages, etc. So a note on the steps people have posted to fix this: reinstalling chrome seems to be at least a temporary fix, although if you don't remove the unwanted software that tampered with chrome then you may end up having the same problem again. 

There is a pretty limited amount we can do within chrome itself when our code is literally being changed out from underneath us by another program that has the same or greater privilege level as chrome. We are working on a separate experimental unwanted software removal tool (https://www.google.com/chrome/srt) that can fix some problems, but unfortunately I don't think currently fixes this one. Perhaps in the future it will. Any users affected may also want to try contacting vendors of antivirus/antimalware tools you use to see if they can add detection of the kinds of tampering mentioned in comment 105 on this bug. 

I'm going to close comments to non-chromium project memebers on this bug since the appropriate place to have discussions is at: https://productforums.google.com/forum/#!forum/chrome

 Issue 442638  has been merged into this issue.
 Issue 442949  has been merged into this issue.
 Issue 443327  has been merged into this issue.
 Issue 391588  has been merged into this issue.
 Issue 447923  has been merged into this issue.
Cc: chinta@chromium.org ashej...@chromium.org
 Issue 447187  has been merged into this issue.
 Issue 448519  has been merged into this issue.
Cc: tkonch...@chromium.org
 Issue 447850  has been merged into this issue.
Cc: nyerramilli@chromium.org
 Issue 445096  has been merged into this issue.
Labels: -Needs-Feedback
 Issue 449052  has been merged into this issue.
 Issue 460069  has been merged into this issue.
 Issue 461879  has been merged into this issue.
Cc: lottie@chromium.org
 Issue 473716  has been merged into this issue.
 Issue 476858  has been merged into this issue.
 Issue 480641  has been merged into this issue.
 Issue 478180  has been merged into this issue.
 Issue 467574  has been merged into this issue.
Labels: -Cr-Internals-Network
Status: WontFix
Obsolete
Showing comments 74 - 173 of 173 Older

Sign in to add a comment