Go Back   Tech Support Forum > Microsoft Support > Windows 10 Support

User Tag List

Chromea.exe error

This is a discussion on Chromea.exe error within the Windows 10 Support forums, part of the Tech Support Forum category. In the past week or so, whenever I first boot I get an error msg (attached) about something called "....\chromea.exe."


Like Tree4Likes
Reply
 
Thread Tools Search this Thread
Old 06-05-2020, 06:54 AM   #1
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



In the past week or so, whenever I first boot I get an error msg (attached) about something called "....\chromea.exe." I've run multiple malware and virus scans and found nothing. And if I search for the full path I get no results. I'd like to know what this file is and what to do about it. Can someone help, please?
Attached Thumbnails
Click image for larger version

Name:	error1.PNG
Views:	17
Size:	93.7 KB
ID:	325926  
weybrew is offline   Reply With Quote
Sponsored Links
Advertisement
 
Old 06-05-2020, 08:50 AM   #2
TSF Moderator
Hardware Team
 
bassfisher6522's Avatar
 
Join Date: Jul 2012
Posts: 2,385
OS: Windows 10 Pro



The a is what's throwing me, chromea.exe.....nothing pops searching for it.

So, do you use any devices that use Chroma RGB? If so have you uninstalled said device and or software?

In no to either....then I would uninstall chrome and download a fresh copy and reinstall.
__________________
bassfisher6522 is offline   Reply With Quote
Old 06-05-2020, 10:12 AM   #3
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



Thanks, bassfisher6522, for your reply. I don't know what "Chroma RGB" is so I'm guessing I don't have anything like that installed.

Yeah, I couldn't find anything about chrome a either. I'm not a techie, but I've done everything I thought I needed to do. I guess it couldn't hurt to do a uninstall/reinstall. I'll give that a try.

I did do an install of the new Windows Edge browser, but this error notice began before that, I think.
weybrew is offline   Reply With Quote
Sponsored Links
Advertisement
 
Old 06-05-2020, 12:06 PM   #4
Registered Member
 
xrobwx71's Avatar
 
Join Date: Oct 2019
Location: Panama City Beach, Florida, USA
Posts: 145
OS: Windows 10 Pro 2004

My System


Have you uninstalled anything lately?
It's something that was installed and placed in startup and the startup call is still there but the .exe is not.

Check startups: Open an elevated Powershell:
Copy and paste this into the prompt. Notepad will open.

Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List | out-file c:\file.txt
start notepad C:\file.txt



copy that notepad content in your next post.

Credit for powershell command = @jenae
xrobwx71 is offline   Reply With Quote
Old 06-05-2020, 12:54 PM   #5
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



Thanks, xrobwx7. I tried to follow your instructions, but I got the following as attached. As a non-techie, I probably did something incorrectly.
Attached Thumbnails
Click image for larger version

Name:	chromea1.PNG
Views:	15
Size:	16.6 KB
ID:	325928  
weybrew is offline   Reply With Quote
Old 06-05-2020, 01:04 PM   #6
Registered Member
 
xrobwx71's Avatar
 
Join Date: Oct 2019
Location: Panama City Beach, Florida, USA
Posts: 145
OS: Windows 10 Pro 2004

My System


Sorry, my instructions were not clear. Hit enter
Then the notepad should open.


Or try this one:
Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List | out-file $home\file.txt
start notepad $home\file.txt


Credit for script @jenae
xrobwx71 is offline   Reply With Quote
Old 06-05-2020, 01:56 PM   #7
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



Well, I got the first one to work and the second one took me to the same doc. Hope this is helpful.
Attached Files
File Type: txt chromea2.txt (5.3 KB, 12 views)
weybrew is offline   Reply With Quote
Old 06-05-2020, 02:58 PM   #8
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



Let's see what information we can find about this file, and scan it at VirusTotal ....
  • Download FRST64 to your Desktop.
  • Double click Frst.exe to launch it.
  • FRST will start to run.
    • When the tool opens click Yes to disclaimer.
      • Press Ctrl+y (Ctrl and y keys at the same time)
      • A blank randomly named .txt Notepad file will open.
      • Copy and paste the content of the code box below into it ....
      Code:
      VirusTotal: C:\Users\weybr\AppData\Roaming\chromea.exe
      File: C:\Users\weybr\AppData\Roaming\chromea.exe
      • Press Ctrl+s to save fixlist.txt
      NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
      • Now press the Fix button once and wait.
      • FRST will process fixlist.txt
      • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
      • Please post the log

Next ...

Let's run a search of your files and registry for Chromea.exe to see what that turns up.
  • Double click Frst64.exe to launch it.
  • FRST will start to run.
    • When the tool opens click Yes to the disclaimer.
    • Copy/Paste or Type the following line into the Search: box.
    Quote:
    SearchAll: chromea.exe
    • Press the Search Files button.
    • When finished searching a log will open on your Desktop ... Search.txt
    • Please post it in your next reply.
xrobwx71 likes this.
__________________
Gary R is offline   Reply With Quote
Old 06-05-2020, 02:59 PM   #9
Registered Member
 
xrobwx71's Avatar
 
Join Date: Oct 2019
Location: Panama City Beach, Florida, USA
Posts: 145
OS: Windows 10 Pro 2004

My System


This entry here:

Name : chromea
command : C:\WINDOWS\system32\pcalua.exe -a C:\Users\weybr\AppData\Roaming\chromea.exe
Location : HKU\S-1-5-21-4128752341-289325916-689769581-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

pcalua.exe is the Program Compatibility Assistant. "The Program Compatibility Assistant is an automatic feature of Windows that runs when it detects an older program has a compatibility problem."
SOURCE

The chromea part I'm having a time finding anything on it. I'll do more research and see what I can come up with. In the meantime, sit tight as someone else may chime in as well.

Thanks @Gary R
xrobwx71 is offline   Reply With Quote
Old 06-05-2020, 09:04 PM   #10
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



Thanks to Gary R and xrobwx71 for the replies. I'll do a backup and then proceed. Results to follow.
xrobwx71 likes this.
weybrew is offline   Reply With Quote
Old 06-05-2020, 09:49 PM   #11
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



It's 05:45 here (GMT+1), and I'm going to be out most of this morning, so it will probably be early afternoon before I get chance to look over any logs you post.
__________________
Gary R is offline   Reply With Quote
Old 06-10-2020, 01:04 PM   #12
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



Hi, Gary R, sorry for the delay. I hope the attached files are correct. Hope they help...
Attached Files
File Type: txt Fixlog.txt (333 Bytes, 3 views)
File Type: txt Search.txt (724 Bytes, 2 views)
weybrew is offline   Reply With Quote
Old 06-10-2020, 02:33 PM   #13
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



You didn't copy paste the fixlist I gave you in my earlier post ... https://www.techsupportforum.com/for...ml#post7781000 ... as a result there is nothing in the fixlog you've just attached.

Quote:
Fix result of Farbar Recovery Scan Tool (x64) Version: 06-06-2020
Ran by weybr (10-06-2020 15:07:02) Run:2
Running from C:\Users\weybr\Desktop
Loaded Profiles: weybr
Boot Mode: Normal
==============================================

fixlist content:
*****************
Should be a copy of the Fixlist here if you had copy/pasted it correctly.
*****************


Results of Fixlist would be here if it had been present when the fix was run


==== End of Fixlog 15:07:02 ====


Please try again and this time make sure the fixlist is copied to the open Notepad file before you save it.

No need to run the SearchAll again, the log for that is fine.
__________________
Gary R is offline   Reply With Quote
Old 06-10-2020, 02:55 PM   #14
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



See if I did it correctly this time...
Attached Files
File Type: txt Fixlog.txt (333 Bytes, 2 views)
weybrew is offline   Reply With Quote
Old 06-10-2020, 03:25 PM   #15
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



No, you're still doing something wrong, let's see if I can re-write the instructions to get you to do things in a slightly different way, and see if that helps.

So click your Windows Key + R to open a Run box.
In the Open: box type Notepad and then click OK

An empty Notepad file should open.

Now copy/paste the following into that open Notepad file ...

VirusTotal: C:\Users\weybr\AppData\Roaming\chromea.exe
File: C:\Users\weybr\AppData\Roaming\chromea.exe


... check the text above is present, and then Save the open Notepad file, naming it fixlist.txt and saving it to the same location as FRST64.exe (in your case to your Desktop).

Once the fixlist.txt file is present on your Desktop, open it and check the text is present.

If it is ...

Close the file.

Now Run FRST, and hit the Fix button, and wait for FRST to produce a Fixlog.txt

Please post it in your next post.
__________________
Gary R is offline   Reply With Quote
Old 06-10-2020, 03:43 PM   #16
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



OK, Gary R, everything looks like I've done it right, but...
Attached Thumbnails
Click image for larger version

Name:	Gary_R_2.PNG
Views:	2
Size:	61.7 KB
ID:	325994   Click image for larger version

Name:	Gary_R_3.PNG
Views:	3
Size:	238.8 KB
ID:	325996  
Attached Files
File Type: txt Fixlog.txt (702 Bytes, 3 views)
weybrew is offline   Reply With Quote
Old 06-10-2020, 04:24 PM   #17
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



OK, from what I can see, you do not have a file present, just a registry entry that's calling it, which is why you're getting the notification.

If we remove the entry, the prompts should stop.

So, can you please run a scan for me with FRST.

Just launch FRST, and then click the Scan button.

FRST will scan your machine, and after a few minutes will produce 2 logs ...

FRST.txt and Addition.txt

Please attach them to your next post.

It's gone Midnight here, so I'm turning in, and it will be morning before I see your reply.
__________________
Gary R is offline   Reply With Quote
Old 06-11-2020, 08:51 AM   #18
Registered Member
 
Join Date: Sep 2008
Posts: 63
OS: Win 10



requested scans attached...
Attached Files
File Type: txt FRST.txt (137.0 KB, 2 views)
File Type: txt Addition.txt (43.6 KB, 2 views)
weybrew is offline   Reply With Quote
Old 06-11-2020, 09:07 AM   #19
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



Looking over your logs now. The fix for the chromea entry is fairly simple, but I thought while I've go the logs, it might be worth checking through the logs to see whether there's anything else that looks like it needs attending to.

Back shortly.
__________________
Gary R is offline   Reply With Quote
Old 06-11-2020, 09:48 AM   #20
Moderator
Security Team
 
Gary R's Avatar
 
Join Date: Jul 2008
Location: Yorkshire
Posts: 730
OS: W10, W8.1, Mint Cinnamon 19.2, MX Linux



So, to get rid of the chromea prompt, please do the following ...
  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  • Press Ctrl+y (Ctrl and y keys at the same time)
  • A blank randomly named .txt Notepad file will open.
  • Copy and paste the following into it ....
Code:
HKU\S-1-5-21-4128752341-289325916-689769581-1001\...\Run: [chromea] => C:\WINDOWS\system32\pcalua.exe -a C:\Users\weybr\AppData\Roaming\chromea.exe
C:\Users\weybr\AppData\Roaming\chromea.exe
EmptyTemp:
  • Press Ctrl+s to save fixlist.txt
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
  • Now press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log

Questions ...

1. Your log shows you have allowed a couple of sites to send you notifications in Edge ...

Quote:
Edge Notifications: Default -> hxxps://struggleville.pushassist.com; hxxps://www.dipyourcar.com
... did you allow them ? (notifications of this type can be used to hijack your browser)

2. You have a number of tabs set to open when you startup Chrome ...

Quote:
CHR StartupUrls: Default -> "hxxps://www.google.com/?trackid=sp-006","hxxps://episodecalendar.com/en/calendar","hxxps://titantv.com/default.aspx","hxxp://127.0.0.1:32400/web/index.html#!/server/31be208fe3c630a84aa20300bd6ef12f49a2eb6a?key=%2Flibrary%2Fsections%2F368","hxxps://calendar.google.com/calendar/r/week","hxxps:// yts.am/browse-movies"
... is this by your design ?

General Comment ...

You have a large number of extensions installed in Chrome .... did you install them all yourself ? It is not a good idea to have so many, as they will seriously affect the performance of your browser. I would seriously consider removing all those that you don't frequently use if I were you.

Other than that, I see no obvious signs of infection on your machine, or anything needing any real action taking.
__________________
Gary R is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 04:53 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts