CCleaner Locks Up on Temporary Files Delete

CCleaner stops at around 40% in Firefox or Windows temporary files folders.

If left working for a very long time, sometimes it will complete, sometimes not; in the latter case it locks the computer requiring a hard reboot,

This is a recent phenomenon on my XP machine although it was quite common on my Win-7 64-bit machine, but that was cleared by uninstalling Zone Alarm.

Today it locked up on a file askslib.dll in the Windows temporary directory. I rebooted, deleted this file and ran CCleaner again. It found askslib.dll again and locked up on it even though it no longer existed.

What is going on here?

Regards,

:: Cheemag ::

It is believed that you may have an infection.

The following provides more information:

_____

ASKSLIB.DLL has been seen to perform the following behavior:

  • Found on infected systems and resists interrogation by security products
  • Uses low level functions to hide itself from the user and from system/security processes

ASKSLIB.DLL has been the subject of the following behavior:

  • Created as a process on disk

The filename ASKSLIB.DLL was first seen on Mar 19 2008 in the following geographical regions of the Webroot community:

  • Japan on Mar 19 2008
  • Spain on Mar 19 2008
  • Turkey on Mar 16 2011
  • South Africa on Mar 16 2011
  • The United States on Aug 16 2011
  • Egypt on Oct 26 2011

Askslib.dll can also be part of the ask toolbar. Try deleting all temp files from within your browser then try ccleaner again. Also if you have ask toolbar installed consider uninstalling it.

However as SuperFast points out it can also be a symptom of an infection.

Perhaps getting a second opinion on your machine being clean would be a good ide.

See here for info

http://forum.piriform.com/index.php?showtopic=34786

I thought about the Ask toolbar, but after seeing that he said cleaning took so long, & that he deleted it & it came back, I decided to see what else I could find.

When I saw how the file resists removal, I had the hunch that it could be a sign of infection, so I posted that (in case it was the cause of his problem(s).

However, would be good to try what Hazel suggests first, & see if that is the cause.

Askslib.dll can also be part of the ask toolbar. Try deleting all temp files from within your browser then try ccleaner again. Also if you have ask toolbar installed consider uninstalling it.

I don't have the Ask toolbar, despite its determined efforts to install itself.

However as SuperFast points out it can also be a symptom of an infection.

Perhaps getting a second opinion on your machine being clean would be a good idea.

I've run Vipre and Malwarebytes Pro on it and they found nothing.

I'll have a look at that.

Regards,

:: Cheemag ::

I don't have the Ask toolbar, despite its determined efforts to install itself.

I've run Vipre and Malwarebytes Pro on it and they found nothing.

I'll have a look at that.

I'll look for a reliable Web scanner for a third opinion. I also have Bitdefender Internet Security 2013 running and it too found nothing.

I've just been offered CC 3.24.1850 which I downloaded, installed and ran. It took 35 seconds with a one-pass overwrite to clear the

Firefox temporary files. That excessive after light browsing ?

I've noticed that, in that condition, hitting [Cancel] locks the machine, or did yesterday; I didn't try to cancel today.

Regards,

:: Cheemag ::

superfast you need to exercise a lot more caution in the jumping to malware as a cause, time and time again you jump to that conclusion.

First step open Taskmanager and check the processes tab for Firefox.exe or ay other Mozilla programs if they are there kill the processes

next navigate to the location of said .dll file and try to delete it manually

if it won't you can use a unlocking program (such as "unlocker" or nirsoft's OpenwFilesView ) to see what's grabing it

superfast you need to exercise a lot more caution in the jumping to malware as a cause, time and time again you jump to that conclusion.

It may well be. Not saying it is. But sometimes AVG/Avira/Avast/Norton/McAfee/MalwareBytes/Spybot Search & Destroy/Bit Defender/Panda AV/AdAware/Super Antispyware/Auto-Runs & other programs struggle to show there is even an infection, much less try to remove it.

If he has no Ask toolbar installed, I see no reason it may not still be an infection.

I am not saying, of course, that it is one. Just noting that there is the possibility of such, & noting that there is a malware that uses that filename.

I had already concluded earlier from user's prior post that this was not from Ask toolbar being installed, which he seems to verify.

Unlocker, as Nergal stated, is a good utility to run to see if you can delete the file. Instead of using the task manager, you can just select Delete for the action, then select unlock all & let it do it's magic. If it fails to remove the file, it will tell you that it can do so after a reboot when it does so before Windows has fully loaded.

While diagnosing the problem would be far easier should the machine be directly in front of us, we do not have that luxury.

And it may be that some other program uses that library. But the Ask Toolbar & the asklib infection are probably the 2 most well known to use that.

@Super Fast Please see Private Message

CC is still behaving badly.

Today in [Analyse] it stopped at 0% on a file SCC[1].dll which is apparently a Semantic file. It was found in IE's Temp Internet Files folder. I don't use IE !

[Cancel] locked up CCleaner. Used System Explorer to kill CC's process, which it did, but this locked the machine requiring a reboot.

Tried again after reboot. [Analyse] went OK, but [Run Cleaner] locked on SCC[1].dll. Tried to close CC with [X] this time - locked the machine - reboot.

Could this file be active and locked by Windows? In which case, what's it doing in a Temp folder? I haven't tried to delete it yet. It was last modified at 20:20 yesterday. There is one other SCC file on the system, SCCLog.txt in my Local Settings/Temp folder which was last modified at the same time and date.

Examination shows a Symantic file with the clue "http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC/w3i/ENG.SCC.config.txt and mentions Norton. I don't think I have any Symantec stuff on this machine.

Any more thoughts?

The saga continues.

Reboot. I delete SCC[1].dll and the SCC log file. Run CCleaner again. Stops at 31% at SCC[1].dll, which no longer exists. Now while CC hesitates, nothing else can be done on the machine.

Reboot. Check that the SCC files are really gone. Locks up on SCC[1].dll. I'm now malware rescanning.

Symantec / Norton gives protection against malware and is typically part of what you buy with a computer that has Windows Pre-Installed.

Perhaps symantec has been removed - but not completely,

and the bits that remain are still protecting themselves from removal,

and may even consider as malware and attack anything that tries to remove themselves.

Symantec / Norton gives protection against malware and is typically part of what you buy with a computer that has Windows Pre-Installed.

Perhaps symantec has been removed - but not completely,

and the bits that remain are still protecting themselves from removal,

and may even consider as malware and attack anything that tries to remove themselves.

I've never ever had Symantec malware software! Very odd!

I've rescanned three times with three malware tools. The machine is clean.

I notice someone in one of the Bugs threads has had this problem which was traced to Windows Search. If I knew how to disable/delete Windows Search I'd try that to see whether it makes a difference.

None of which explains the Symantec and Ask type..dlls, as I've never had either Ask or anything Symantec on this machine

I can only conclude that, as with my Windows-7 machine, there is a conflict between CCleaner and one of the security programmes.

CC worked properly 5 minutes ago after I'd used the Windows disc cleaning tool.

You could always use the Norton Removal Tool just to be sure

https://www-secure.s...n=1&lg=en&ct=us

If you can find that file in your Temp folder (you'll first need to enable Hidden Files and Folders), then you can upload the single file in question to an online malware scanning service that uses multiple antivirus/antimalware to determine if that's the problem or not.

Here's a few of those free online malware scanning services:

* Jotti - http://virusscan.jotti.org/

* VirScan - http://www.virscan.org/

* VirusTotal - http://www.virustotal.com/

You could always use the Norton Removal Tool just to be sure

https://www-secure.s...n=1&lg=en&ct=us

Doesn't find anything to uninstall - obviously, I've never had Norton.

If you can find that file in your Temp folder (you'll first need to enable Hidden Files and Folders), then you can upload the single file in question to an online malware scanning service that uses multiple antivirus/antimalware to determine if that's the problem or not.

Here's a few of those free online malware scanning services:

* Jotti - http://virusscan.jotti.org/

* VirScan - http://www.virscan.org/

* VirusTotal - http://www.virustotal.com/

There are no files to upload - they've all been deleted.

I'll see what BleachBit makes of it.

There are no files to upload - they've all been deleted.

I'll see what BleachBit makes of it.

Testing today. What it amounts to is: CCleaner cannot delete large files, My test file was VipreRescue.exe 121,147,792 bytes in the Recycle Bin.

Whenever CCleaner was run it choked on this file at the scan stage, While it was stalled there, nothing else could be done on the machine, it could not be halted in Task Manager/System Explorer and a reboot was inevitable.

BleachBit had no problem with that file or any other.

Regrettably I've had to abandon CCleaner.

Regards,

:: Cheemag ::

Not sure what caused it on your machine. Works fine on mine. Doesn't seem to have trouble deleting .ISO image files for test purposes on my 32 Bit 7.

But then, CC may be a different kind of animal on 64 Bit 7.

Do you suppose that you could run CC in debug mode (while trying to delete a large file), & post the logs to assist developers?

I would've theorized bad clusters may cause this, except that Bleachbit had no trouble deleting the file. So, guess there's no need to run chkdsk on your disk.

No problem here deleting an iso file on Win 7 64bit.