ozzeD / omaha

Automatically exported from code.google.com/p/omaha
Apache License 2.0
0 stars 0 forks source link

Won't Uninstall #44

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
I installed the Google Earth plugin to view something in a website and then 
uninstalled it shortly afterwards. However, Google Update which supposedly 
should uninstall itself has stayed on my system all day, even after multiple 
restarts. How do I manually remove it from my computer? This is tantamount to 
malware.

Original issue reported on code.google.com by DanielCo...@gmail.com on 23 Sep 2012 at 12:28

GoogleCodeExporter commented 9 years ago
Please run regedit and navigate to the following key:

On 32-bit Windows: HKEY_LOCAL_MACHINE\Software\Google\Update\Clients
On 64-bit Windows: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Google\Update\Clients

You should see a set of subkeys under Clients\, each named with a GUID.  How 
many of these do you see, and what are their names?  (Ideally, you should only 
see one, starting with "{430FD4D0".)

Original comment by ryanmyers@google.com on 24 Sep 2012 at 7:30

GoogleCodeExporter commented 9 years ago
Aside from the one you stated, there is another called 
{8A69D345-D564-463c-AFF1-A69D9E530F96}

Original comment by DanielCo...@gmail.com on 24 Sep 2012 at 11:41

GoogleCodeExporter commented 9 years ago
That is the key for Chrome.  Did you ever have Chrome installed at one point?

Original comment by ryanmyers@google.com on 24 Sep 2012 at 11:53

GoogleCodeExporter commented 9 years ago
No, never. I only use Firefox.

Original comment by DanielCo...@gmail.com on 25 Sep 2012 at 12:45

GoogleCodeExporter commented 9 years ago
Okay.  I'm not sure why there's a Chrome key there -- I'll check with the Earth 
guys to make sure they're not accidentally adding that during their 
install/uninstall.

In the meantime, delete the {8A69 key from Google\Update\Clients, so that only 
the {430F key is present.  This will tell Google Update that it's the only 
product left on the system, and it will uninstall itself at the next background 
update check.  

Background update checks take place every five hours.  If you don't want to 
wait, you can do the following to make it instant: 

1) In the Registry, delete the LastChecked value from Google\Update.
2) Navigate to Control Panel\Administrative Tools\Scheduled Tasks, find the 
GoogleUpdateTaskMachineUA job, and run it.

Original comment by ryanmyers@google.com on 25 Sep 2012 at 1:05

GoogleCodeExporter commented 9 years ago
Ping -- let us know if this worked (or didn't work) for you :)

Original comment by ryanmyers@google.com on 25 Sep 2012 at 7:45

GoogleCodeExporter commented 9 years ago
Yes this worked. Thank you.

Original comment by DanielCo...@gmail.com on 25 Sep 2012 at 11:58

GoogleCodeExporter commented 9 years ago

Original comment by ryanmyers@google.com on 26 Sep 2012 at 7:16

GoogleCodeExporter commented 9 years ago
I installed Google Drive a few weeks ago and uninstalled it shortly thereafter. 
 Google Update kept buzzing my firewall and never did uninstall itself.  After 
reading this issue, I also found the aforementioned 
{8A69D345-D564-463c-AFF1-A69D9E530F96} registry key and am about to delete it.

Furthermore, I found HKLM/Software/Google/Chrome and 
HKLM/Software/Google/Google Toolbar registry keys.  I likewise have never 
installed Chrome, and neither have I installed the Google Toolbar.

Could this be a bug in Google Update itself -- calling RegCreateKeyEx instead 
of RegOpenKeyEx to read these registry keys?  Or were these keys inadvertently 
created by the Google Drive installer?

Original comment by kwood...@telusplanet.net on 6 Dec 2012 at 9:09

GoogleCodeExporter commented 9 years ago
Google Update doesn't care about any keys other than those under Google\Update, 
for the most part.  I've reviewed our registry code, just in case, and don't 
see any issues of this nature.

Original comment by ryanmyers@google.com on 6 Dec 2012 at 7:27

GoogleCodeExporter commented 9 years ago
Just to add my penny to the subject, as Google search landed me here.

A something like 2 years old installation of Windows 7. Used to have for few 
months after that installation Chrome (uninstalled it quickly), later no Google 
product, and about a year ago I've installed Google Earth. I've uninstalled 
that too, like 5 months ago. Recently, I've changed Windows system firewall to 
Comodo. Thanks to that I've spotted, that Google Update is still running, and 
regularly connecting to the internet. I've blocked it a month ago. Today I'm 
checking the log, and the little bastard tried to connect to the net like 20 
times... I know why so many times - was checking different ports.

tl;dr All Chrome and Google Earth unistalled long ago, Google Update still 
running.
There's a bunch of entries in the registry under Google (Google Toolbar, Nav 
Client, No Chrome Offer until. No Toolbar offer until (probalby left after some 
bundles) and few more).
In the Update/Clients section:
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0xxx}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345xxx}

So, I'll:
allow GU to access internet in Comodo
remove that 8A69 key
try to launch GU manually

after some time I'll check if it will not be running again, and if the Google 
folder on C drive will disparager too.

Original comment by Jan.Ha...@gmail.com on 6 Dec 2012 at 8:22

GoogleCodeExporter commented 9 years ago
Ok, I'll report if it dodn't work, but for now... I think it's working. After 
deleting the key from the registy, as well as the last update check value, I 
went to the task manager, and launched what was asked. I was waiting for Comodo 
to ask me wheter I'm allowing GU to connect to the net. Did not happen. BUT, 
when I'm checking:C:\Program Files\Google
only empty CrashReports remains. Earlier there was a folder with Google Update 
there, si I believe it worked. I'm not seeing google update in task manager 
either.

Original comment by Jan.Ha...@gmail.com on 6 Dec 2012 at 8:35

GoogleCodeExporter commented 9 years ago
Last entry from me. The Google/Update in regedit disappeared, so I'm now sure 
it had worked. Now in Google/ there's only
/Google Toolbar - I'm not using it, but probably something tried to install it 
in a bundle with a free program
/Nav Client
/No Chrome offer until (that's from Avast, and probably is resposnible for 
offering Chrome installation)
/No Toolbar offer (Microsoft?, does not matter).

Thank you for help, everything is fine now.

Original comment by Jan.Ha...@gmail.com on 6 Dec 2012 at 8:45

GoogleCodeExporter commented 9 years ago
The thing about the Windows registry is that anything can access any part of 
it, so it's entirely possible that these rogue registry entries weren't created 
by any Google product.

3rd-party installers that bundle Google products may be prime suspects -- as 
suggested by Jan -- but there's no way to pin down the guilty product short of 
inspecting the registry before and after a particular program is installed.

Thanks for the quick responses, Ryan!  Your tips have helped us out!

Original comment by kwood...@telusplanet.net on 8 Dec 2012 at 6:34

GoogleCodeExporter commented 9 years ago
Had exactly the same issue after installing Google Earth with the additional 
reg key {8A69D345-D564-463c-AFF1-A69D9E530F96} left behind in 
Google\Update\Clients. Deleted this key as suggested and Google Update was 
uninstalled.  Seems unbelievable to me that it would be so difficult to remove 
a process.  A program that installs a service without permission that runs 
constantly in the background, that does not get removed after an uninstall of 
original product.  That can only be removed by registry editing?  If anyone 
other than Google produced this software I would be concerned........

Original comment by frozenre...@gmail.com on 8 Jul 2013 at 2:26