Jump to content

CCleaner corrupting program files [Avira issue]


AW7

Recommended Posts

  • Moderators
31 minutes ago, hazelnut said:

Not a section at a time... I mean each individual box AW7 has ticked

Yes, loose language on my part.

I meant treat each tick as an individual 'section' and after doing each one then check if the exes have been altered, then back and di the next tick.

(Due to the nature of the issue I'd probably start with the ones ticked in 'System', then in  'Advanced', and work on from there).

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Hmm, interesting observation of Avira, Mind you, my affected exes aren't running.....part from Chrome, and I guess MSEdge in the background. Anyway, I'd better get on with my tests....

Link to comment
Share on other sites

Right, I've gone through all the ticked items in turn, analysing and cleaning each with no problem at all. All the programs that were previously affected by custom clean are still functioning, as far as I can tell. I checked the ticked items under the 'Windows' and 'Applications' tab.

 

A

Link to comment
Share on other sites

  • Moderators

That's often the way it goes with testing, what you are looking to replicate doesn't happen.

It does indicate that either:

  1. It isn't CCleaner that is causing the problem.
  2. There's some weird cash between 2 or more of CCleaner's functions, that doesn't show up if you run them alone.
  3. The problem is a intermittent one.  (which are always a PITA to track down because they don't happen everytime).

I suppose the next step if you are up for it would be to run CCleaner as normal and see what happens.
(Again you run the risk of having to reinstall your exes again if they do get scrambled).

PS. Nice to have someone who is prepared to do a bit of testing to try and find what is going on, even if we don't seem to be any nearer yet.
I'm also wondering if something that you did as a result of working with AdvancedSetup at Malwarebytes has cleared whatever it was?
I know you didn't do that much, but maybe one of the tools used did something?

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

No, I didn't do much with AdvancedSetup, just ran a couple more malware hunting programs. Nothing was found. I'll carry on with CC as usual, and maybe take a little more notice of what I do and when, just in case.....

Link to comment
Share on other sites

  • Moderators

That's about all that you can do if the isue isn't showing anymore.

It is only 3 out of millions of CCleaner users who are reporting this happening, and one of those was for "a friend".
It would be nice to know what it was, but you/we may never discover that.

(We are always a bit cautious with 'me too' type posts, on investigation they are often not the same at all).

Of course all 3 of you could each be seeing something different happening that just sounds/looks a bit similar, and caused by something else but you only notice it after running CC.

You might be surprised how often that happens too.
The most common example is that many people have a corrupted Recycle Bin, but because it doesn't really cause a problem in use they only notice it when they run CCleaner and notice that the contents of the bin keeps growing even though Windows says it's empty. It's a bug in Windows that has been there since XP.

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Thanks for all the help so far. Maybe I can provide some more information, even if we don't know exactly what the problem is and whether it's caused by CCleaner at all.

I have logged the cleaning process using the Process Monitor App. All recently used exe files were emptied again while doing a Custom Clean. The changes can be quickly found via Windows Search (see screenshot modified_exe_files.png). As an example, I picked the DropboxThumbnailGenerator.exe file from the Process Monitor log to track the changes. This resulted in the following image (see screenshot proc_mon.png).

The process was like this:
- 20:24: CCleaner (V. 6.02.9938 64bit) was loaded and I started an analysis (Analyze button)
- 20:25: I started the Custom Clean
- Between 20:30 and 20:34 the temporary files were processed and deleted by CCleaner
- 20:30: Finally, the DropboxThumbnailGenerator.exe file has been modified
- 20:34: The cleaning process finished

According to the Process Monitor log, the original DropboxThumbnailGenerator.exe file appears to have been emptied via the System Prozess (ID: 4) immediately before CCleaner handled the temporary DropboxThumbnailGenerator.exe file (sentry_temp). I selected 3 erase cycles which can be seen from the log.

Hope this is helpful.

modified_exe_files.png

proc_mon.png

Link to comment
Share on other sites

It really looks like Avira is the culprit after all!

Another well-known cleaning tool also has a corresponding issue report:
https://github.com/bleachbit/bleachbit/issues/1378

Avira includes a program file called "SentryEye.exe", which is probably responsible for the "C:\Windows\Temp\sentry_temp" folder.

If this folder is excluded, the issue can probably be prevented. See this earlier post:
https://community.ccleaner.com/topic/63148-apps-dont-work-anymore-after-temporary-files-were-cleaned/

 

The Process Monitor does not seem to correctly display this probable connection with Avira (since Avira is considered to be deeply embedded in the system and probably redirects certain things). CCleaner would certainly never create or rewrite an exe file.

Link to comment
Share on other sites

  • Moderators

Thanks @APMichael, you have save me a bit of work.

I was just checking out those Avira entries myself (in particular that software updater) and coming to a similar conclusion.

@AW7 Are you also running Avira?

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

  • Moderators

This behaviour has also been reported at Avira's forum 5 days ago:
https://support.avira.com/hc/de/community/posts/8243246193169-Avira-is-deleting-all-my-exes

(Oops, APMichael had already posted that above).

Just in case you missed it in APMichael's link the fix/workaround in CCleaner is:

Go to Options>Exclude and exclude "C:\Windows\Temp\sentry_temp"

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Michael, Ronster and all, many, many thanks for getting to the bottom of all this. Yes, to confirm, I use Avira, and interstingly, I don't use it on my laptop, which hasn't caused me any grief. The question I ask myself now is whether it's time to dump Avira.

But it's great to have this community, isn't it?

A

Link to comment
Share on other sites

  • Moderators

It does make you wonder just what Avira have done (and how) so that deleting their temporary files, from a Windows temporary folder, modifies/wipes programme executables?

It's definitely not something that anyone would expect to happen.

EDIT- I think that I've possibly worked out what they are doing. (I could be wrong but it would explain why the exes get wiped if you clear that Temp folder).
If I am right then it's a half-baked safety/protection measure that isn't 'safe' at all the way they have done it, as we can see.
(I might check/test my idea later, but not on this laptop I'm not putting Avira on here).

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Now then, Advanced Setup found a temp msedge folder on my machine that they couldn't understand. Didn't have such a thing on their win 10 or win 11 machines. Is this something to with it all? Whilst browsing I recall seeing old_msedge.exe in there, but now it's empty.

A

Link to comment
Share on other sites

  • Moderators

It may have something to do with it, and it would fit with my suspicion.

But there again as you say it contained 'old_msedge.exe' it may have been to do with an Edge update, so you could roll back if needed/wanted?
Or it may even have been the old non-Chromium MS Edge? MS only started fully removing that recently.

I'll re-read your thread at Malwarebytes to see what he said about it.

Edit, nothing there in your thread it must have been in a PM, it's not important.
PS. I've let AdvancedSetup know what we have found here about Avira.
 

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Hmm, this is getting more complicated. I did wonder, I noticed that my temp/sentry_temp folder hadn't been cleaned and there were files in there from 2013. There again, I added the exception, ran CC and all was fine. That said, I had the msedge.exe.exe popup again......which may be something completely unconnected.

Link to comment
Share on other sites

  • 1 year later...
  • Moderators

If you read through the above thread you will see that the problem discussed here was caused by Avira Antivirus.

It was NOT caused by CCleaner or any other cleaner, it was caused by Avira and showed up when you used any cleaner.

AFAIK it was fixed in Avira. (Altough there is always a possibility that the error in Avira has crept back in again)

If you are using Avira then what version number do you have?

IF you are not using Avira then you have a different issue to the one in this thread.
In that case please start your own thread giving more deatils of exactly what you are doing/seeing, including what Windows you are using and what antivirus
 

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.