Unable to update Adblock plus - installer window opens and closes at once

[passbrains]

Adapted from ​https://www.passbrains.com/dashboard/view-ticket.php?ticket_no=AIN-39

Environment

Windows 7 32bit Internet Explorer 11 Russian
ABP version 1.2.636.0

How to reproduce

1. Load IE11 browser with installed ABP
2. Click ABP icon on any browser page
3. Click Check for updates option
4. When "Update Adblock Plus" dialog opens click Yes button
5. See Windows Installer window opens and closes at once
6. Wait 10 minutes to see if installation starts

--> See Installation doesn't start

7. Go to IE browser Settings-> Manage Add-ons
8. Check ABP version and see it is the same - 1.2.636.0
9. Repeat steps 2-3 and see "Update Adblock Plus" dialog opens again, which means previous update fails

Observed behaviour

Unable to update Adblock plus - installer window opens and closes at once.
This bug is strong reproducible.

Expected behaviour

Update should be successful.

[passbrains]

1 - 26 Jul 2014 11:29:47 posted by Yogesh Sharma
This has worked for me. Could you please wait for sometime for the installer to start the installation and check?

2 - 26 Jul 2014 11:58:07 posted by Alexey Filippow
I have been waiting more then hour, installation doesn't start. This bug is strong reproducible for me.

3 - 30 Jul 2014 18:59:35 posted by Alexey Filippow
I have uploaded new video showing this issue. It is still reproducible even after closing and reopening IE 11 browser.

[mapx]

You could try resetting IE
​http://malwaretips.com/blogs/reset-internet-explorer-settings/

then install the old dev version 1.2.636 then test again the updating process

[oleksandr]

This can be reproduced on our test infrastructure on Windows 7 x64 IE 10.

[philll]

Shouldn't this have a higher priority? It likely means users are stuck on old versions..

[oleksandr]

Here is a log from event viewer when this happens:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{000C101C-0000-0000-C000-000000000046}
 and APPID 
{000C101C-0000-0000-C000-000000000046}
 to the user ADBLCK10WIN7641\adblockplus1 SID (S-1-5-21-3635199667-3403465223-258075216-1002) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

This means there's not enough permissions to run the installer. The test machines have quite a bit of stuff installed already: LocalGPO? Internet Explorer Administration Kit? Chef Client? Besides it is not clear what security policies are applied there. We should certainly investigate which security settings are forbidding us to run installer, but I don't think it's a critical issue, since this seems to be and edge case.

[philll]

I agree, I couldn't reproduce it with a local VM.

[davodavo]

This issue has existed for several versions and is 100% reproducible on my Win7 64 bit pro system running IE 11.0.9600.17843 in English.

It shows the same security / permissions issue as noted in comment 7 (oleksandr). When I try to change the permissions on that CLS, regedit says "access denied."

The keys in this CLS are owned by TrustedInstaller, which has full permissions...but unless I change the owner I can't change the permissions. So....I take ownership of the CLS and set admins and my user to have full control. Maybe it will work now...who knows...

[davodavo]

Just did a check with the update as per above, running ABP 1.3.

Instant failure of the installer as before, even though I know own the keys and supposedly have permission. Evidently, Regedit isn't the place to change that. Error message indicates "component services administration tool" can fix this permission issue, but when I run that (control panel>system and security>administrative tools>Component Services) I'm presented with a dizzying array of items that I can't search through. I trudge through it all to see if there's something relevant.

I go to Component Services>My Computer>DCOM+ Config and I find the key for the service that errors-out there. I right-click to find Properties, and the only thing that looks halfway appropriate is the Security tab...and I change the only permission that really is limited (the "configuration permissions") so that the system, administrators, and users have Full Control.

Maybe that will do it...we'll see...

Or maybe I just opened a door for hackers. Who knows.

[davodavo]

Just did a check with the updates as per above, still running ABP 1.3.

Same instant failure, but THIS time I decided to actually read what the event viewer error message said. I know, unrealistic to expect such a thing...but I'm getting bored of this problem.

Turns out it is complaining that the activation permissions, not the general access permissions, were missing.

So I again go to Component Services>My Computer>DCOM+ Config, find the key, and go to properties. I go to the Security tab and I click on the FIRST button (rather than the bottom one) to configure the activation permissions. I add myself to the list, giving myself both local and remote activation rights just for the fun of it.

We'll wait for the next update popup to see what happens now....

[oleksandr]

@davodavo, is you machine a part of ActiveDirectory? Do you have anything special set up as far as permissions go?

[davodavo]

Hi all--
No, my system is not part of active directory and is not part of a policy network at all. It's just a stand-alone machine, running in my home. I do have Pro edition, and some of my directories are encrypted using Windows' EFS. But only user data...I don't think there are any system directories encrypted.
Anyway, the next update cycle came and the installer insta-failed again. Same Event message.
I go back to the component services to make sure that Local Activation is indeed enabled for all users. And it is. So then I go to the Identity tab and try to switch "which user account do you want to use this application" FROM "the system account (services only)" TO my user.
Let's see if that fixes it...we'll know in a few days...

[davodavo]

Googled the error code, and found that there's another level of permissions to investigate. Component Services>Computers>My Computer>Properties>COM Security>Edit Default...and then add NETWORK SERVICES and my own user to the ACL. Click the box to allow "Local Activation". Hit OK twice and close the component services admin tool.
Let's see what demons this lets out of the gates of hell.

[davodavo]

OK, so now it blew up with some entertaining new error messages.
It insta-failed not because of the activation errors described above, but because the MSI services (windows installer) couldn't start (fails with an error code 1297). This is because somehow the installer tried to log in as me, rather than as the system...and my account doesn't have anywhere near the required privileges to run installer-fu. Even if I tried to start the service manually from the services admin component, it blew up with the same error code.
So I switched the installer service's login-as back to the system, and just for fun I allowed it to "interact with the windows desktop."
In addition, I went to Component Services>Computers>My Computer>Properties>Com Security>Access Permissions>Edit Default and added Network Service there (with only local access).
At this point, I'm just opening up doors to see what flies through...would be smarter if I had some advice from AdBlock folks...

[oleksandr]

@davodavo we will look into this, since we do have some environment we can reproduce this on. We do have LocalGPO installed there, so we didn't think it is important enough to fix. How likely do you think it is that before you did any hacks for testing here your system's security settings were messed up?

[davodavo]

This problem started for me last year some time, has never stopped.
Unfortunately, with my last change the following occurred:

• I'm back to the original error message (see comment 7)
• But now, when I open the Component Service manager (even if I start it as an admin), I am not allowed to see or edit *anything* about the properties for that DCOM+ process. (Some other DCOM+ processes are still editable, but not yours.)

So...what should I do? Keep my system in its current state so we can validate any fix? Or just blow away ABP and install the new version?

[oleksandr]

@davodavo, we can't make you wait for the fix, since we are not sure when that will be available yet. We do have a way to reproduce it, so I would recommend you to just go ahead and manually install the latest version. I guess you would still have the same problem with the latest version, so we could still ask you to validate a fix when its ready.

[davodavo]

FWIW, I completely uninstalled adblock plus, then installed the then-latest version.
This morning, for the first time, the system offered the update to a new version...and the install instantly failed as before.
So at least it's consistent ;-)

[davodavo]

In the happy-accident category...
The auto-update installer has been reliably failing to install every time, but for some reason today it actually executed properly. Interestingly, before it did so I got a security pop-up from Windows indicating "are you sure you want to do this..." and when I did the installer just went happily along.
Don't know if this is repeatable, but for the first time ever I got an upgrade to auto-install!