New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 722886 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug


Show other hotlists

Hotlists containing this issue:
Hotlist-1


Sign in to add a comment

Unable to re-install Chrome after uninstalling on Windows 10

Project Member Reported by ilemos@google.com, May 16 2017

Issue description

<b>Chrome Version       : <Copy from: 'about:version'></b>
URLs (if applicable) :
PT Forum threads:
https://goo.gl/XzoxRg
https://goo.gl/4BUhhC
https://goo.gl/DHM98b
https://goo.gl/YT9Wic

EN Forum threads:
https://goo.gl/TdhydT
https://goo.gl/WV3Lxo
https://goo.gl/G65vfr
https://goo.gl/rqWh31

What steps will reproduce the problem?
(1)Completely uninstall Chrome
(2)Try to re-install it
(3)Observe that the installation setup doesn't open (or opens and closes)

What is the expected result?
To be able to re-install Chrome

What happens instead?
User cannot re-install Chrome

Please provide any additional information below. Attach a screenshot if
possible.
Since May 12, we have been receiving complains from users for not being able to re-install Chrome on their Windows 10 device, after uninstalling it.

Troubleshooting steps tested:
- Cleaning all Chrome related files with external tools (i.e.: iobit and revo uninstaller);
- Installing Chrome offline;
- Installing Beta;
- Installing Canary;
- Installing in safe mode.

One of the users has shared a log on the Forum thread:
https://goo.gl/WV3Lxo

 
Labels: -Pri-3 Pri-1
Cc: erinmcdonnell@chromium.org chrome-conops-escalation@google.com
Cc: erinmcdonnell@google.com
Cc: melodychu@chromium.org
Components: Blink>AppManifest
Labels: Hotlist-ConOps M-58 OS-Windows
Cc: gan...@chromium.org abdulsyed@chromium.org borisv@chromium.org mevissen@chromium.org
+Omaha team members and TPM

Can you help us take a look at these reports? Are there any additional logs we can collect?
Cc: pbomm...@chromium.org ligim...@chromium.org

Comment 9 by borisv@chromium.org, May 17 2017

Owner: sorin@chromium.org
Sorin, can you redirect? I ganesh@ is looped in already.

Comment 10 by sorin@chromium.org, May 17 2017

Cc: sorin@chromium.org
Owner: gan...@chromium.org
If possible can we get these logs from users please :

Omaha log            : C:\programdata\google\update\log
Chrome Installer log : C:\Users\<username>\AppData\Local\Temp\chrome_installer
I tried the following after installing Chrome on a fresh Windows 10 x64 machine:
* Uninstall Chrome. Reinstalling works fine.
* Manually delete the Google folder. Reinstalling works fine.
* Use Revo Uninstaller to uninstall Chrome, and delete all subsequent entries that Revo found. Reinstalling works fine.
* Use MalwareBytes to scan the machine, then uninstall Chrome. Reinstalling works fine.

This is mostly international users that started reporting this starting May 12. And malware is a common theme in many of the reports.

I wonder if this issue has something to do with WannaCry, which started happening around May 12 as well.
Melody, can we ask users to give us a ProcMon log? Here are the steps:

* Download ChromeSetup.exe. Do not run it yet.
* Install ProcMon from https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx.
* Run ProcMon.
* Run ChromeSetup.exe.
* Stop capturing events in ProcMon by switching to ProcMon and hitting Ctrl+E.
* Ctrl+S in ProcMon to save the ProcMon log.
* Send us the procmon log.

Comment 14 by grt@chromium.org, May 17 2017

I've just tried to repro a few ways on my Win10 Creator's Update machine; no dice. Thinking maybe it was related to a non-EN locale, I tried the FR installer -- still worked fine. The next step if we can't get reliable repro steps would be to get Omaha and Chrome logs and/or the ProcMon log as above.
ProcMon is our best bet at this point. The Omaha installer is likely bailing out early (hence the no UI), and the Chrome installer does not get a chance to run.
I am suggesting the ProcMon Log in Spanish Forum : https://goo.gl/4DTR2U , When I get an answer I'll come back
Could be related to the Big Farm Virus:
http://www.tomsguide.com/answers/id-3411812/weird-virus-malware-rid.html

"Basically what it does is install Chrome and Firefox even though I already have both in a different directory, and it slows my PC to a crawl."

and later:

"I think I managed to somehow erase the virus by using Malwarebytes Anti-Rootkit but I cant install google chrome anymore...."
And another fellow apparently has a workaround:

"I had this problem too and maybe i get rid of it. First of all, delete the folders of the FAKE Firefox and Chrome. Then i uninstalled the REAL Firefox and Chrome.
-After i go to the APPDATA folder (Windows key + R -> %APPDATA%), in the folders Local and Roaming i find some files and folders relate to the malwares, like the folder firefox (not Mozilla Firefox), Bagsarah and such.
-On the Folder 'AppData/Local' i cleaned the Folder Temp.
-After all this i executed 'services.msc' (Windows key + R -> services.msc) and find the entry for 'InstallService/firefoxDL' and 'Update Service/firefoxU' (these are the little scumbags that act like the firefox updater to install all the other garbage), then double clicked and deactivate.
-I also run regedit and using the find tool, search and delete all 'firefoxU'(look out to don't delete any firefoxURL) and 'firefoxDL' entry.
-Reboot and reinstalled the Firefox and/or Chrome. Maybe this will help."

Comment 19 Deleted

Hi, An user sent a ProcMon Log in This Post: 
https://productforums.google.com/d/msg/chrome-es/IicU_9wGvzA/TfXVn5s6BAAJ (Answer with Google Drive Link) , Check this please.
I do not see anything useful in that log. Did the user try to run ChromeSetup.exe? ChromeSetup.exe does not show up in the log at all.
Ok. 3 user's sent a ProcMon Log now, check post: https://productforums.google.com/d/msg/chrome-es/IicU_9wGvzA/TfXVn5s6BAAJ , "Jonathan Olarte" , "Julian Laurenzano" and "Eloy Garcia(Log updated)"
Ok, this appears due to a malware infection. Users need to find and delete this key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\Debugger

More details to follow...

Comment 24 Deleted

I got a few hits for IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe, here is the most relevant forum thread:

Malware like MIO.exe, WinSnare, Negerle, BIT.exe, as well as fake Chrome. - Virus, Trojan, Spyware, and Malware Removal Logs
https://www.bleepingcomputer.com/forums/t/646806/malware-like-mioexe-winsnare-negerle-bitexe-as-well-as-fake-chrome/

Comment 26 Deleted

Comment 27 Deleted

+ a couple of others FYI, it looks like some malware is using Image File Execution Options to disable Google Update and (by extension) Chrome installs.

Some ideas:

Could we please ask users to delete the following key and then try running ChromeSetup.exe?:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe

If not, a reasonable suggestion (without endorsing FRST necessarily) would be to have these folks run the Farbar Recovery Scan Tool as per the instructions here:
https://www.bleepingcomputer.com/forums/t/646377/virus-that-keeps-coming-back-installs-firefox-redirects-home-page-etc/

Hi, the users deleted the key and chromesetup.exe was successfully run! It works , Thank's ! 
Good to hear that. Please have the users unshare the log files. Thank you!
Cc: msrchandra@chromium.org nyerramilli@chromium.org
Status: WontFix (was: Unconfirmed)

Sign in to add a comment