# Chromea.exe error



## weybrew (Sep 22, 2008)

In the past week or so, whenever I first boot I get an error msg (attached) about something called "....\chromea.exe." I've run multiple malware and virus scans and found nothing. And if I search for the full path I get no results. I'd like to know what this file is and what to do about it. Can someone help, please?


----------



## bassfisher6522 (Jul 22, 2012)

The a is what's throwing me, chromea.exe.....nothing pops searching for it.

So, do you use any devices that use Chroma RGB? If so have you uninstalled said device and or software? 

In no to either....then I would uninstall chrome and download a fresh copy and reinstall.


----------



## weybrew (Sep 22, 2008)

Thanks, bassfisher6522, for your reply. I don't know what "Chroma RGB" is so I'm guessing I don't have anything like that installed.

Yeah, I couldn't find anything about chromea either. I'm not a techie, but I've done everything I thought I needed to do. I guess it couldn't hurt to do a uninstall/reinstall. I'll give that a try.

I did do an install of the new Windows Edge browser, but this error notice began before that, I think.


----------



## xrobwx71 (Oct 24, 2019)

Have you uninstalled anything lately?
It's something that was installed and placed in startup and the startup call is still there but the .exe is not. 

Check startups: Open an elevated Powershell:
Copy and paste this into the prompt. Notepad will open. 

*Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List | out-file c:\file.txt
start notepad C:\file.txt*


copy that notepad content in your next post.

Credit for powershell command = @jenae


----------



## weybrew (Sep 22, 2008)

Thanks, xrobwx7. I tried to follow your instructions, but I got the following as attached. As a non-techie, I probably did something incorrectly.


----------



## xrobwx71 (Oct 24, 2019)

Sorry, my instructions were not clear. Hit enter 
Then the notepad should open.
:smile:

Or try this one:
*Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List | out-file $home\file.txt
start notepad $home\file.txt
*

Credit for script @jenae


----------



## weybrew (Sep 22, 2008)

Well, I got the first one to work and the second one took me to the same doc. Hope this is helpful.


----------



## Gary R (Jul 23, 2008)

Let's see what information we can find about this file, and scan it at VirusTotal ....


*Download* *FRST64* to your Desktop.
Double click *Frst.exe* to launch it.
*FRST* will start to run.
When the tool opens click Yes to disclaimer.
Press *Ctrl+y* (Ctrl and y keys at the same time)
A blank randomly named *.txt* Notepad file will open.
Copy and paste the content of the code box below into it ....


```
VirusTotal: C:\Users\weybr\AppData\Roaming\chromea.exe
File: C:\Users\weybr\AppData\Roaming\chromea.exe
```

Press *Ctrl+s* to save *fixlist.txt*
*NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system*
Now press the *Fix* button once and wait.
FRST will process *fixlist.txt*
When finished, it will produce a log *fixlog.txt* in the same folder/directory as FRST64.exe
*Please post the log*



*Next ...*

Let's run a search of your files and registry for Chromea.exe to see what that turns up.


Double click *Frst64.exe* to launch it.
*FRST* will start to run.
When the tool opens click Yes to the disclaimer.
Copy/Paste or Type the following line into the *Search:* box.



> SearchAll: chromea.exe



Press the *Search Files* button.
When finished searching a log will open on your Desktop ... *Search.txt*
*Please post it in your next reply.*


----------



## xrobwx71 (Oct 24, 2019)

This entry here:

Name : chromea
command : C:\WINDOWS\system32\pcalua.exe -a C:\Users\weybr\AppData\Roaming\chromea.exe
Location : HKU\S-1-5-21-4128752341-289325916-689769581-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

pcalua.exe is the Program Compatibility Assistant. "The Program Compatibility Assistant is an automatic feature of Windows that runs when it detects an older program has a compatibility problem." 
SOURCE

The chromea part I'm having a time finding anything on it. I'll do more research and see what I can come up with. In the meantime, sit tight as someone else may chime in as well.

Thanks @Gary R


----------



## weybrew (Sep 22, 2008)

Thanks to Gary R and xrobwx71 for the replies. I'll do a backup and then proceed. Results to follow.


----------



## Gary R (Jul 23, 2008)

It's 05:45 here (GMT+1), and I'm going to be out most of this morning, so it will probably be early afternoon before I get chance to look over any logs you post.


----------



## weybrew (Sep 22, 2008)

Hi, Gary R, sorry for the delay. I hope the attached files are correct. Hope they help...


----------



## Gary R (Jul 23, 2008)

You didn't copy paste the fixlist I gave you in my earlier post ... https://www.techsupportforum.com/forums/f338/chromea-exe-error-1242538.html#post7781000 ... as a result there is nothing in the fixlog you've just attached.



> Fix result of Farbar Recovery Scan Tool (x64) Version: 06-06-2020
> Ran by weybr (10-06-2020 15:07:02) Run:2
> Running from C:\Users\weybr\Desktop
> Loaded Profiles: weybr
> ...




Please try again and this time make sure the fixlist is copied to the open Notepad file before you save it.

No need to run the SearchAll again, the log for that is fine.


----------



## weybrew (Sep 22, 2008)

See if I did it correctly this time...


----------



## Gary R (Jul 23, 2008)

No, you're still doing something wrong, let's see if I can re-write the instructions to get you to do things in a slightly different way, and see if that helps.

So click your *Windows Key + R* to open a *Run* box.
In the *Open:* box type *Notepad* and then click *OK*

An empty Notepad file should open.

Now copy/paste the following into that open Notepad file ...

*VirusTotal: C:\Users\weybr\AppData\Roaming\chromea.exe
File: C:\Users\weybr\AppData\Roaming\chromea.exe*

... check the text above is present, and then Save the open Notepad file, naming it *fixlist.txt* and saving it to the same location as FRST64.exe (in your case to your Desktop).

Once the *fixlist.txt* file is present on your Desktop, open it and check the text is present.

If it is ...

Close the file.

Now Run FRST, and hit the *Fix* button, and wait for FRST to produce a *Fixlog.txt*

Please post it in your next post.


----------



## weybrew (Sep 22, 2008)

OK, Gary R, everything looks like I've done it right, but...


----------



## Gary R (Jul 23, 2008)

OK, from what I can see, you do not have a file present, just a registry entry that's calling it, which is why you're getting the notification.

If we remove the entry, the prompts should stop.

So, can you please run a scan for me with FRST.

Just launch FRST, and then click the *Scan* button.

FRST will scan your machine, and after a few minutes will produce 2 logs ...

*FRST.txt* and *Addition.txt*

Please attach them to your next post.

It's gone Midnight here, so I'm turning in, and it will be morning before I see your reply.


----------



## weybrew (Sep 22, 2008)

requested scans attached...


----------



## Gary R (Jul 23, 2008)

Looking over your logs now. The fix for the chromea entry is fairly simple, but I thought while I've go the logs, it might be worth checking through the logs to see whether there's anything else that looks like it needs attending to.

Back shortly.


----------



## Gary R (Jul 23, 2008)

So, to get rid of the chromea prompt, please do the following ...


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
Press *Ctrl+y* (Ctrl and y keys at the same time)
A blank randomly named *.txt* Notepad file will open.
Copy and paste the following into it ....


```
HKU\S-1-5-21-4128752341-289325916-689769581-1001\...\Run: [chromea] => C:\WINDOWS\system32\pcalua.exe -a C:\Users\weybr\AppData\Roaming\chromea.exe
C:\Users\weybr\AppData\Roaming\chromea.exe
EmptyTemp:
```

Press *Ctrl+s* to save *fixlist.txt*
*NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system*

Now press the *Fix* button once and wait.
FRST will process *fixlist.txt*
When finished, it will produce a log *fixlog.txt* in the same folder/directory as FRST64.exe
*Please post me the log*

*Questions ...*

1. Your log shows you have allowed a couple of sites to send you notifications in Edge ...



> Edge Notifications: Default -> hxxps://struggleville.pushassist.com; hxxps://www.dipyourcar.com


... did you allow them ? _(notifications of this type can be used to hijack your browser)_

2. You have a number of tabs set to open when you startup Chrome ...



> CHR StartupUrls: Default -> "hxxps://www.google.com/?trackid=sp-006","hxxps://episodecalendar.com/en/calendar","hxxps://titantv.com/default.aspx","hxxp://127.0.0.1:32400/web/index.html#!/server/31be208fe3c630a84aa20300bd6ef12f49a2eb6a?key=%2Flibrary%2Fsections%2F368","hxxps://calendar.google.com/calendar/r/week","hxxps://yts.am/browse-movies"


... is this by your design ?

*General Comment ...*

You have a large number of extensions installed in Chrome .... did you install them all yourself ? It is not a good idea to have so many, as they will seriously affect the performance of your browser. I would seriously consider removing all those that you don't frequently use if I were you.

Other than that, I see no obvious signs of infection on your machine, or anything needing any real action taking.


----------



## weybrew (Sep 22, 2008)

Fixlog.txt attached (I hope). Edge notifications have been removed. Chrome startup are my selections. I'll review my Chrome addons per your suggestion.


----------



## Gary R (Jul 23, 2008)

OK, the registry entry calling *chromea.exe* has been successfully removed, and the file is not present on your machine, so you shouldn't get prompted about it any more.

To "uninstall" FRST and remove all its files, please do the following ...


Rename *FRST64.exe* to *Uninstall.exe*
Double click on *Uninstall.exe* to launch it.
Your computer will reboot, and on reboot will remove FRST and all its files.


If you have any problems with the instructions above, please let me know, or if there's anything else I can help with. If not, then I think we're finished, and you can mark this topic as resolved.


----------



## weybrew (Sep 22, 2008)

Most Ecxellent! And I can't thank you enough for walking me through this fix. I must admit that I didn't understand some of what we were doing, but usually I can follow directions. You have been most patient. THANKS SO MUCH.


----------



## Gary R (Jul 23, 2008)

You're welcome. :thumb:

Glad to be able to help.


----------

