Strange behavior when running behind the "Hotspot Shield" VPN app.

[BehzadV]

Hey,
So i had chocolatey install elixir (choco install elixir) on my windows, when I noticed this in the logs:

2017-05-12 19:46:49,855 [INFO ] -   Software installed to 'C:\Program Files (x86)\Hotspot Shield\'

I was running the Hotspot Shield VPN application during installation.
Also, the Hotspot Shield directory (C:\Program Files (x86)\Hotspot Shield) is void of any elixir related files.

Here is the last parts of the log:

2017-05-12 19:46:49,795 [DEBUG] - Attempting to create directory "C:\ProgramData\chocolatey\.chocolatey\Elixir.1.4.2".
2017-05-12 19:46:49,823 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\Elixir.1.4.2\.version".
2017-05-12 19:46:49,826 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\Elixir.1.4.2\.sxs".
2017-05-12 19:46:49,830 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\Elixir.1.4.2\.pin".
2017-05-12 19:46:49,834 [DEBUG] - Sending message 'HandlePackageResultCompletedMessage' out if there are subscribers...
2017-05-12 19:46:49,838 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\lib\Elixir\.chocolateyPending".
2017-05-12 19:46:49,843 [INFO ] -  The install of elixir was successful.
2017-05-12 19:46:49,855 [INFO ] -   Software installed to 'C:\Program Files (x86)\Hotspot Shield\'
2017-05-12 19:46:49,866 [DEBUG] - Attempting to delete file "C:\Users\Behzad\AppData\Local\NuGet\Cache\Elixir.1.4.2.nupkg".
2017-05-12 19:46:49,958 [WARN ] - 
Chocolatey installed 2/2 packages. 0 packages failed.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).
2017-05-12 19:46:49,971 [DEBUG] - Sending message 'PostRunMessage' out if there are subscribers...
2017-05-12 19:46:49,978 [DEBUG] - Exiting with 0

Maybe an issue only related to logging?

[ferventcoder]

There is some detection going on

Normally we'd say this was a packaging issue, but this looks like a possible issue with Chocolatey.

Can you provide the contents of C:\ProgramData\chocolatey\.chocolatey\Elixirxxxx\.registry (xxxx relates to the current version) if it exists?

[BehzadV]

@ferventcoder Thank you for the follow up. This is the ".registry" file in the mentioned directory:

<?xml version="1.0" encoding="utf-8"?>
<registrySnapshot xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <user>S-1-5-21-364970951-3033375923-1392635927-1001</user>
  <keys>
    <key installerType="Msi" displayName="Hotspot Shield 6.5.1" displayVersion="6.5.1">
      <RegistryView>Registry32</RegistryView>
      <KeyPath>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield</KeyPath>
      <DefaultValue />
      <InstallLocation><![CDATA[C:\Program Files (x86)\Hotspot Shield\]]></InstallLocation>
      <UninstallString><![CDATA[msiexec.exe /x {AF599C42-A2E5-4251-B7EE-4925B177BB96} /L*V C:\Users\Behzad\AppData\Local\Temp\HSS-6.5.1-install-plain-773-plain.exe.log]]></UninstallString>
      <HasQuietUninstall>false</HasQuietUninstall>
      <Publisher><![CDATA[AnchorFree Inc.]]></Publisher>
      <InstallDate />
      <InstallSource><![CDATA[]]></InstallSource>
      <Language />
      <Version />
      <VersionMajor>6</VersionMajor>
      <VersionMinor>5</VersionMinor>
      <SystemComponent>true</SystemComponent>
      <WindowsInstaller>false</WindowsInstaller>
      <NoRemove>false</NoRemove>
      <NoModify>false</NoModify>
      <NoRepair>false</NoRepair>
      <ReleaseType />
      <ParentKeyName />
    </key>
  </keys>
</registrySnapshot>

[ferventcoder]

@BehzadV and this was just due to running the program, not installing/upgrading it at the same time (or letting it auto-upgrade)?

[BehzadV]

Well,
Before this, I already had installed Elixir using the installer provided by their website. Elixir 1.4 came out and I wanted to upgrade to it. So I decided to use chocolatey. I typed choco install elixir and the rest has already been mentioned.

[ferventcoder]

I'm talking about the Hotspot VPN, not Elixir. The registry snapshot is taken prior to install and after install. The before and after are compared to produce this .registry file. If anything else was installing/upgrading (even automatically in the background), then it would also be captured. It appears this is what may have happened.

Since this publisher notes a log location for uninstall, it is likely they have one on your system for any installs they do as well. You may want to look around and review to see if the timing for the package install in c:\ProgramData\chocolatey\logs matches the timings of the any changes that may have occurred with Hotspot.

[BehzadV]

Actually, now that I look in C:\ProgramData\Chocolatey\logs\chocolatey.log, this has also happened during python2's installation as well:

2017-04-27 21:15:22,100 [DEBUG] -  Found 'C:\ProgramData\chocolatey\lib\python2\python2.nupkg'
  with checksum 'CE54FA363D21585F559700A724A95C7A'
2017-04-27 21:15:22,100 [DEBUG] -  Found 'C:\ProgramData\chocolatey\lib\python2\python2.nuspec'
  with checksum '029204A44123F1625D54C643CFFEF224'
2017-04-27 21:15:22,116 [DEBUG] -  Found 'C:\ProgramData\chocolatey\lib\python2\tools\chocolateyInstall.ps1'
  with checksum '80620D47CBE8C20E41632904C3F6BDF7'
2017-04-27 21:15:22,132 [DEBUG] - Attempting to create directory "C:\ProgramData\chocolatey\.chocolatey\python2.2.7.13".
2017-04-27 21:15:22,178 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\python2.2.7.13\.version".
2017-04-27 21:15:22,196 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\python2.2.7.13\.sxs".
2017-04-27 21:15:22,201 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\python2.2.7.13\.pin".
2017-04-27 21:15:22,201 [DEBUG] - Sending message 'HandlePackageResultCompletedMessage' out if there are subscribers...
2017-04-27 21:15:22,201 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\lib\python2\.chocolateyPending".
2017-04-27 21:15:22,216 [INFO ] -  The install of python2 was successful.
2017-04-27 21:15:22,216 [INFO ] -   Software installed to 'C:\Program Files (x86)\Hotspot Shield\'
2017-04-27 21:15:22,232 [DEBUG] - Attempting to delete file "C:\Users\Behzad\AppData\Local\NuGet\Cache\python2.2.7.13.nupkg".
2017-04-27 21:15:22,247 [WARN ] - 
Chocolatey installed 1/1 packages. 0 packages failed.

[BehzadV]

Also, apparently Hotspot doesn't keep a file log of its happenings (C:\Program Files (x86)\Hotspot Shield\log has no files in it). Obviously, Hotspot has no entry in C:\ProgramData\chocolatey\.chocolatey\ either.
Looking through the windows events for MSI installers, I can see python2 getting installed by chocolatey. But there is no entry about Hotspot nor about Elixir.

[ferventcoder]

Now this is making me wonder - some packages have queried WMI Win32_Product to see if they were already installed, which is especially bad as it causes Windows Installer to reconfigured every MSI installed application. More details at #396

I wonder if either of these packages were doing something similar. Without the full log, I have no idea what version of Chocolatey you have installed nor the environment it is installed in. Please provide that full output log so we can get an awareness of those aspects. Thanks!