DANGER: Uninstalling Sync deletes everything on your computer

[Knowbody]

Resilio Sync version: 2.5.9

Windows 10 Pro

What happened: I uninstalled Sync so I can reinstall it as a service. I checked "Delete settings" during the uninstall. It proceeded to delete everything on C: drive.

Except the files currently locked by Windows, all of C:\Users, C:\Program Files, C:\Program Files (x86), C:\Windows, and more are gone.

How do I know it's the culprit? Because I watched Resilio Sync.exe in Task Manager consuming 100% of disk activity on my administrator username, and my available disk space on C: increasing by the GB's in seconds.

Chrome still works because it was open when the mass deletion happened. I don't think my computer can reboot now. Please don't test this bug without a full backup stored somewhere else. 

[Helen]

Sync is a user space application and option "Remove settings" only deletes its storage folder (user's %appdata%\Resilio Sync by default). Sync is not looking at other directories beyond that, especially at Program Files and Windows dirs. 

We will surely investigate this case. How did you install and ran Sync - perhaps, some customized configuration? 

 

[Knowbody]

I installed Sync not as a service. It was running as a user application. I did not change anything in the advanced -> more options. One thing to note is that I use two Windows accounts - one is admin and the other is not. Sync was running on the non-admin account.

Recount: I've had Sync running on this PC since 2016, with about ten A keys. No advanced folders (been using Sync before the name change). I added some encrypted folders (D keys) to Sync about 20 minutes before the incident. After these folders were synchronized, I closed Sync normally via right clicking the icon. I decided to reinstall it as a Windows service. When I uninstalled Sync, UAC prompted for admin escalation (i.e. asked me to enter the password to the admin account). After selecting "Remove settings" and OK the uninstall, the Add or Remove Programs window still showed Resilio Sync as installed for a few minutes (It shouldn't take that long to delete settings.) Then all icons and files on my Desktop were gone. I opened task manager and see Resilio Sync.exe running on my admin account having almost 100% of disk activity. I killed it, but not before it deleted almost everything. 

Are there any specific configuration settings you would like to know? I'll be able to get more information after restoring the backup disk image.

[Helen]

looks like it may happen if one of the registry keys gets either deleted or becomes in any other way unavailable: 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync , param InstallLocation

We'll add some extra checks to avoid cases like this. 

[Knowbody]

I have restored my whole computer from the backup disk image.

The entire registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync if logged in as my admin account, does not exist. However, it exists with the expected contents from the user account that I use to run Sync (because that's how I installed it, as the user).

 

[Helen]

You don't mean that you uninstall the user's app while being logged in as admin, do you? I don't think it's possible. You uninstalled it when logged in as user, right? 

[Knowbody]

8 hours ago, Helen said:

You don't mean that you uninstall the user's app while being logged in as admin, do you? I don't think it's possible. You uninstalled it when logged in as user, right? 

I uninstalled the user's Sync app as the same user. However, there was a UAC prompt that elevated to the admin account. So, yes it is possible 

 

 

 

[Helen]

We've added fixes to this part of code so that it won't happen anymore. 

Sorry that you've encountered it, accept our sincere apologies, and thank you for bringing team's attention to this.