CCleaner Locks Up on Temporary Files Delete

[Cheemag]

CCleaner stops at around 40% in Firefox or Windows temporary files folders.

 

If left working for a very long time, sometimes it will complete, sometimes not; in the latter case it locks the computer requiring a hard reboot,

 

This is a recent phenomenon on my XP machine although it was quite common on my Win-7 64-bit machine, but that was cleared by uninstalling Zone Alarm.

 

Today it locked up on a file askslib.dll in the Windows temporary directory. I rebooted, deleted this file and ran CCleaner again. It found askslib.dll again and locked up on it even though it no longer existed.

 

What is going on here?

 

Regards,

 

:: Cheemag ::

[Super Fast]

It is believed that you may have an infection.

The following provides more information:

_____

 

ASKSLIB.DLL has been seen to perform the following behavior:

• Found on infected systems and resists interrogation by security products
  
• Uses low level functions to hide itself from the user and from system/security processes
  

ASKSLIB.DLL has been the subject of the following behavior:

• Created as a process on disk
  

The filename ASKSLIB.DLL was first seen on Mar 19 2008 in the following geographical regions of the Webroot community:

• Japan on Mar 19 2008
  
• Spain on Mar 19 2008
  
• Turkey on Mar 16 2011
  
• South Africa on Mar 16 2011
  
• The United States on Aug 16 2011
  
• Egypt on Oct 26 2011
  

[hazelnut]

Askslib.dll can also be part of the ask toolbar. Try deleting all temp files from within your browser then try ccleaner again. Also if you have ask toolbar installed consider uninstalling it.

 

However as SuperFast points out it can also be a symptom of an infection.

 

Perhaps getting a second opinion on your machine being clean would be a good ide.

 

See here for info

 

http://forum.piriform.com/index.php?showtopic=34786

[Super Fast]

I thought about the Ask toolbar, but after seeing that he said cleaning took so long, & that he deleted it & it came back, I decided to see what else I could find.

When I saw how the file resists removal, I had the hunch that it could be a sign of infection, so I posted that (in case it was the cause of his problem(s).

 

However, would be good to try what Hazel suggests first, & see if that is the cause.

[Cheemag]

Askslib.dll can also be part of the ask toolbar. Try deleting all temp files from within your browser then try ccleaner again. Also if you have ask toolbar installed consider uninstalling it.

 

I don't have the Ask toolbar, despite its determined efforts to install itself.

 

However as SuperFast points out it can also be a symptom of an infection.

 

Perhaps getting a second opinion on your machine being clean would be a good idea.

 

I've run Vipre and Malwarebytes Pro on it and they found nothing.

 

See here for info

 

http://forum.pirifor...showtopic=34786

 

I'll have a look at that.

 

Regards,

 

:: Cheemag ::

[Cheemag]

I don't have the Ask toolbar, despite its determined efforts to install itself.

 

I've run Vipre and Malwarebytes Pro on it and they found nothing.

 

 

I'll have a look at that.

 

I'll look for a reliable Web scanner for a third opinion. I also have Bitdefender Internet Security 2013 running and it too found nothing.

 

I've just been offered CC 3.24.1850 which I downloaded, installed and ran. It took 35 seconds with a one-pass overwrite to clear the

Firefox temporary files. That excessive after light browsing ?

 

I've noticed that, in that condition, hitting [Cancel] locks the machine, or did yesterday; I didn't try to cancel today.

 

Regards,

 

:: Cheemag ::

[Nergal]

superfast you need to exercise a lot more caution in the jumping to malware as a cause, time and time again you jump to that conclusion.

First step open Taskmanager and check the processes tab for Firefox.exe or ay other Mozilla programs if they are there kill the processes

next navigate to the location of said .dll file and try to delete it manually

if it won't you can use a unlocking program (such as "unlocker" or nirsoft's OpenwFilesView ) to see what's grabing it

[Super Fast]

superfast you need to exercise a lot more caution in the jumping to malware as a cause, time and time again you jump to that conclusion.

 

It may well be. Not saying it is. But sometimes AVG/Avira/Avast/Norton/McAfee/MalwareBytes/Spybot Search & Destroy/Bit Defender/Panda AV/AdAware/Super Antispyware/Auto-Runs & other programs struggle to show there is even an infection, much less try to remove it.

 

If he has no Ask toolbar installed, I see no reason it may not still be an infection.

I am not saying, of course, that it is one. Just noting that there is the possibility of such, & noting that there is a malware that uses that filename.

I had already concluded earlier from user's prior post that this was not from Ask toolbar being installed, which he seems to verify.

 

Unlocker, as Nergal stated, is a good utility to run to see if you can delete the file. Instead of using the task manager, you can just select Delete for the action, then select unlock all & let it do it's magic. If it fails to remove the file, it will tell you that it can do so after a reboot when it does so before Windows has fully loaded.

 

While diagnosing the problem would be far easier should the machine be directly in front of us, we do not have that luxury.

 

And it may be that some other program uses that library. But the Ask Toolbar & the asklib infection are probably the 2 most well known to use that.

[Nergal]

@Super Fast Please see Private Message

[Cheemag]

CC is still behaving badly.

 

Today in [Analyse] it stopped at 0% on a file SCC[1].dll which is apparently a Semantic file. It was found in IE's Temp Internet Files folder. I don't use IE !

[Cancel] locked up CCleaner. Used System Explorer to kill CC's process, which it did, but this locked the machine requiring a reboot.

 

Tried again after reboot. [Analyse] went OK, but [Run Cleaner] locked on SCC[1].dll. Tried to close CC with [X] this time - locked the machine - reboot.

 

Could this file be active and locked by Windows? In which case, what's it doing in a Temp folder? I haven't tried to delete it yet. It was last modified at 20:20 yesterday. There is one other SCC file on the system, SCCLog.txt in my Local Settings/Temp folder which was last modified at the same time and date.

 

Examination shows a Symantic file with the clue "http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC/w3i/ENG.SCC.config.txt and mentions Norton. I don't think I have any Symantec stuff on this machine.

 

Any more thoughts?

[Cheemag]

The saga continues.

 

Reboot. I delete SCC[1].dll and the SCC log file. Run CCleaner again. Stops at 31% at SCC[1].dll, which no longer exists. Now while CC hesitates, nothing else can be done on the machine.

 

Reboot. Check that the SCC files are really gone. Locks up on SCC[1].dll. I'm now malware rescanning.

[Alan_B]

Symantec / Norton gives protection against malware and is typically part of what you buy with a computer that has Windows Pre-Installed.

 

Perhaps symantec has been removed - but not completely,

and the bits that remain are still protecting themselves from removal,

and may even consider as malware and attack anything that tries to remove themselves.

[Cheemag]

Symantec / Norton gives protection against malware and is typically part of what you buy with a computer that has Windows Pre-Installed.

 

Perhaps symantec has been removed - but not completely,

and the bits that remain are still protecting themselves from removal,

and may even consider as malware and attack anything that tries to remove themselves.

 

I've never ever had Symantec malware software! Very odd!

 

I've rescanned three times with three malware tools. The machine is clean.

 

I notice someone in one of the Bugs threads has had this problem which was traced to Windows Search. If I knew how to disable/delete Windows Search I'd try that to see whether it makes a difference.

 

None of which explains the Symantec and Ask type..dlls, as I've never had either Ask or anything Symantec on this machine

 

I can only conclude that, as with my Windows-7 machine, there is a conflict between CCleaner and one of the security programmes.

 

CC worked properly 5 minutes ago after I'd used the Windows disc cleaning tool.

[hazelnut]

You could always use the Norton Removal Tool just to be sure

 

https://www-secure.s...n=1&lg=en&ct=us

[Andavari]

If you can find that file in your Temp folder (you'll first need to enable Hidden Files and Folders), then you can upload the single file in question to an online malware scanning service that uses multiple antivirus/antimalware to determine if that's the problem or not.

 

Here's a few of those free online malware scanning services:

* Jotti - http://virusscan.jotti.org/

* VirScan - http://www.virscan.org/

* VirusTotal - http://www.virustotal.com/

[Cheemag]

You could always use the Norton Removal Tool just to be sure

 

https://www-secure.s...n=1&lg=en&ct=us

 

Doesn't find anything to uninstall - obviously, I've never had Norton.

[Cheemag]

If you can find that file in your Temp folder (you'll first need to enable Hidden Files and Folders), then you can upload the single file in question to an online malware scanning service that uses multiple antivirus/antimalware to determine if that's the problem or not.

 

Here's a few of those free online malware scanning services:

* Jotti - http://virusscan.jotti.org/

* VirScan - http://www.virscan.org/

* VirusTotal - http://www.virustotal.com/

 

There are no files to upload - they've all been deleted.

 

I'll see what BleachBit makes of it.

[Cheemag]

There are no files to upload - they've all been deleted.

 

I'll see what BleachBit makes of it.

 

Testing today. What it amounts to is: CCleaner cannot delete large files, My test file was VipreRescue.exe 121,147,792 bytes in the Recycle Bin.

 

Whenever CCleaner was run it choked on this file at the scan stage, While it was stalled there, nothing else could be done on the machine, it could not be halted in Task Manager/System Explorer and a reboot was inevitable.

 

BleachBit had no problem with that file or any other.

 

Regrettably I've had to abandon CCleaner.

 

Regards,

 

:: Cheemag ::

[Super Fast]

Not sure what caused it on your machine. Works fine on mine. Doesn't seem to have trouble deleting .ISO image files for test purposes on my 32 Bit 7.

 

But then, CC may be a different kind of animal on 64 Bit 7.

 

Do you suppose that you could run CC in debug mode (while trying to delete a large file), & post the logs to assist developers?

 

I would've theorized bad clusters may cause this, except that Bleachbit had no trouble deleting the file. So, guess there's no need to run chkdsk on your disk.

[hazelnut]

No problem here deleting an iso file on Win 7 64bit.

[Alan_B]

Testing today. What it amounts to is: CCleaner cannot delete large files, My test file was VipreRescue.exe 121,147,792 bytes in the Recycle Bin.

I suggest that was a possibly a totally false verdict based upon an unsuitable test subject.

The purpose of VipreRescue.exe is to deal with malware and it probably defends itself against attack by malware.

 

Perhaps it deferred to your authority and allowed you to move itself into the Recycle Bin,

but perhaps whilst in the Recycle Bin it still maintained self protection, or was still under Windows ACL protection it had previously instigated.

Thus it might still resist attack by malware - or anything that acted like malware by trying to delete it,

i.e. it might allow you to delete itself to recycle bin, or delete to oblivion, if it recognises your authority,

but it might not recognize your authority when delegated to CCleaner for the attack.

 

In post #6 you referred to using "one-pass overwrite".

That could be another complication - i.e. if something was still "protecting" against deletion by malware,

it SHOULD recognize your authority if YOU delete it,

it MIGHT recognize your authority delegated to CCleaner for direct deletion, but not "indirect removal" via one-pass overwrite.

 

An ISO is a good test subject.

An EXE is a very bad test subject - Windows likes to make backup copies for restore points and previous versions.

[Cheemag]

Not entirely true to say it won't delete large files. I tried again today with non-exe and isos in the Recycle Bin. it deleted them all without problems.

 

I'm running XP-Pro x86 SP-3 on the machine in question, not Windows-7 64-bit.

 

I noticed that, in Settings\Advanced (Windows\Temp & Recycle Bin) was set to delete only files older than 24 hours. But what is 'older than 24 hours'? From deletion date or creation date? Despite that setting it went ahead today with today's test deletions, although the files themselves would have been days or months old.

 

Nonetheless, even if set not to delete files <24hrs old, it should not have choked on a large new file, it would have skipped it.

 

I'll continue to test.

 

Regards,

 

Cheemag

[Cheemag]

 

I'll continue to test.

 

I reinstalled CCleaner. Put some smallish files in the Recycle. It deleted them without problems.

 

I put a largish .exe file (15GB) in the Recycle. Locks up. Reboot. Put a directory and a few more small files in the Recycle. CCleaner locks up on the first file in the bin, the directory.

 

Reboot. Put the large exec back in. Disable Local Area Connection. Switch off all the security. Run CCleaner - locks up.

 

I must make the point that, if I delete the file it locks up on (at the command promt), after the reboot, as far as CCleaner is concerned that file is still there in the same directory - be it the Recycle Bin or elsewhere - when I run CCleaner again, although it's been deleted completely from the system. This is totally weird behaviour !

 

Regards,

 

:: Cheemag. ::

[hazelnut]

You say .iso's delete okay so could your security software be checking the .exe file as you are deleting it? (just a wild thought, perhaps disable security software as a test for an .exe deletion))

[Cheemag]

You say .iso's delete okay so could your security software be checking the .exe file as you are deleting it? (just a wild thought, perhaps disable security software as a test for an .exe deletion))

 

Done that in my last test. It still locked up with Bitdefender I.S. 2013 switched out.

 

Anyway - I may have found the problem, all goes well if I revert to normal delete without the overwrite.

 

Which must mean that, effectively, that facility cannot be used with CCleaner. I'll leave CCleaner on the system for now, Perhaps you could address this problem or at least test for it as a bug (?)

 

Regards,

 

:: Cheemag ::