Please register or login. There are 0 registered and 1078 anonymous users currently online. Current bandwidth usage: 326.30 kbit/s October 22 - 09:38pm EDT 
Hardware Analysis
      
Forums Product Prices
  Contents 
 
 

  Latest Topics 
 

More >>
 

    
 
 

  You Are Here: 
 
/ Forums / General Technology /
 

  Google Earth unsolicited download to system temp directory 
 
 Author 
 Date Written 
 Tools 
Dr. Peaceful Jun 21, 2012, 06:45pm EDT Reply - Quote - Report Abuse
Private Message - Add to Buddy List Replies: 2 - Views: 5194
I've been puzzled by this issue for a while now. Searching the web for solution didn't come up with much. I am wondering if anyone here has experienced the same problem before, OR has any clue to the cause of the problem and/or method to fix it.

Here are the detail descriptions of the problem:
1. Once or twice a day, an unrequested download seemingly from Google Earth is placed into the system temp directory of my computer. Actual path is: "c:\windows\temp\._msige61\program files\Google\Google Earth\plugin\", always the same. The download would be over 500 files and 120 MB in size. The largest I've seen is over 160 MB.

2. I used CCleaner, that's how I noticed the size and location of the unrequested download. CCleaner can clean the entire download without any problem. But the next day, the download would come back, and doesn't matter where I plug into the Internet.

3. I do have Google Earth 6.2 installed. The download above seems to be for version 6.1, older than what I have. Manually clicking the update menu item in Google Earth, would result in saying "no update available this time".

4. I've disabled all Google Update services. I've scan through all startup processes and running processes, but none are related to Google, as far as I can tell.

5. I have 3 browsers: IE9, FF13, Chrome19. No Google related plug-ins for IE9. FF13 has Google Earth 6.2 Plug-in and Google Update 1.3 (disabled). Chrome also has Google Earth 6.2 Plug-in and Google Update 1.3 (disabled). I've disabled both Google Update Plug-ins above and as well as the Google Update system services, but the download above would still come back!

6. I've suspected the download is from either a virus or malware. But scans from AVG and Malwarebytes came up with nothing!

7. I've suspected corrupted installation of Chrome or Google Earth. Uninstall and reinstalled both, but the download still comes back!

8. Fortunately, this has only affected 1 of my PCs. No other PC has experienced the same behavior.


So as you can see, I've tried everything that I can think of. I am out of ideas. Please help! Any idea is welcome, thanks!


Want to enjoy fewer advertisements and more features? Click here to become a Hardware Analysis registered user.
Afrow UK Jun 21, 2012, 07:04pm EDT Reply - Quote - Report Abuse
Private Message - Add to Buddy List  
>> Re: Google Earth unsolicited download to system temp directory
Install Fiddler and see what comes up.

I like: Programming, Gym, University
Music: House, Dubstep, D&B, Trance, Metal
Dr. Peaceful Jun 22, 2012, 03:47am EDT Reply - Quote - Report Abuse
Private Message - Add to Buddy List  
>> Re: Google Earth unsolicited download to system temp directory
Some updates, I've caught one of these downloads in progress. Now I am more convince this may actually be legit Google "business". ;) Thanks for the suggestion of Fiddler, but I do have a software firewall, which I use to monitor some of the traffics. Only the legit program (as far as I know) are allow through, so that decrease the chances of something not legit to download something into my PC.

Anyway, I've caught a download in progress going into Program Files\Google\Update\Install\{ [some hash key here] }\GoogleEarth-Win-Bundle-[version number].exe This file is only 16MB in size, so doesn't take long to be downloaded.

The time stamp for the creation of the above folder and the time stamp for the creation of Windows\Temp\._msige61\ was about the same. The size for the contents in the "._msige61" folder is ~110MB. Around the same time, in the Event Viewer, items for gupdate and gupdatem appeared.

Manually invoked the GoogleEarth-Win-Bundle executable (yeah, I took my chances ;) ), result in the same "._msige61" folder & content under my user's temp folder ( Users\[username]\AppData\Local\Temp\._msige61\ ). Also ~110MB in size. This confirmed that the 16MB executable unpacked into ~110MB of files by itself.

The installation went into an interactive setup, which allowed me to select options and hit next for more steps. I didn't continue the installation process, but it did seem to be a legit installer program.

Google is known to use the following for updating their software in a PC.
1 executable: Program Files\Google\Update\GoogleUpdate.exe
2 services: gupdate (GoogleUpdate.exe /svc) and gupdatem (GoogleUpdate.exe /medsvc)
2 schedule tasks: GoogleUpdateTaskMachineCore and GoogleUpdateTaskMachineUA

The part that beats me is that I've deleted both schedule tasks and stopped both services above, how in the world would they "reactivate" itself and continue to download stuffs? Also, as you can see, the installer does not have a good cleanup function, it left you a whole dump (> 100MB) of temp files!


Write a Reply >>


 

    
 
 

  Topic Tools 
 
RSS UpdatesRSS Updates
 

  Related Articles 
 
 

  Newsletter 
 
A weekly newsletter featuring an editorial and a roundup of the latest articles, news and other interesting topics.

Please enter your email address below and click Subscribe.