CCleaner corrupting program files

[APMichael]

3 hours ago, AW7 said:

... Avira Security (free version) ...

It would be really interesting to know which anti-virus software the other affected users are using.

I found the following post in the Avira forum:
https://support.avira.com/hc/de/community/posts/8243246193169-Avira-is-deleting-all-my-exes

Possibly the anti-virus software is also "going crazy" here?

[nukecad]

31 minutes ago, hazelnut said:

Not a section at a time... I mean each individual box AW7 has ticked

Yes, loose language on my part.

I meant treat each tick as an individual 'section' and after doing each one then check if the exes have been altered, then back and di the next tick.

(Due to the nature of the issue I'd probably start with the ones ticked in 'System', then in  'Advanced', and work on from there).

[AW7]

 too late to save my brain, I'm afraid

[AW7]

Hmm, interesting observation of Avira, Mind you, my affected exes aren't running.....part from Chrome, and I guess MSEdge in the background. Anyway, I'd better get on with my tests....

[AW7]

Right, I've gone through all the ticked items in turn, analysing and cleaning each with no problem at all. All the programs that were previously affected by custom clean are still functioning, as far as I can tell. I checked the ticked items under the 'Windows' and 'Applications' tab.

 

A

[nukecad]

That's often the way it goes with testing, what you are looking to replicate doesn't happen.

It does indicate that either:

1. It isn't CCleaner that is causing the problem.
2. There's some weird cash between 2 or more of CCleaner's functions, that doesn't show up if you run them alone.
3. The problem is a intermittent one.  (which are always a PITA to track down because they don't happen everytime).

I suppose the next step if you are up for it would be to run CCleaner as normal and see what happens.
(Again you run the risk of having to reinstall your exes again if they do get scrambled).

PS. Nice to have someone who is prepared to do a bit of testing to try and find what is going on, even if we don't seem to be any nearer yet.
I'm also wondering if something that you did as a result of working with AdvancedSetup at Malwarebytes has cleared whatever it was?
I know you didn't do that much, but maybe one of the tools used did something?

[AW7]

No, I didn't do much with AdvancedSetup, just ran a couple more malware hunting programs. Nothing was found. I'll carry on with CC as usual, and maybe take a little more notice of what I do and when, just in case.....

[nukecad]

That's about all that you can do if the isue isn't showing anymore.

It is only 3 out of millions of CCleaner users who are reporting this happening, and one of those was for "a friend".
It would be nice to know what it was, but you/we may never discover that.

(We are always a bit cautious with 'me too' type posts, on investigation they are often not the same at all).

Of course all 3 of you could each be seeing something different happening that just sounds/looks a bit similar, and caused by something else but you only notice it after running CC.

You might be surprised how often that happens too.
The most common example is that many people have a corrupted Recycle Bin, but because it doesn't really cause a problem in use they only notice it when they run CCleaner and notice that the contents of the bin keeps growing even though Windows says it's empty. It's a bug in Windows that has been there since XP.

[ronster]

Thanks for all the help so far. Maybe I can provide some more information, even if we don't know exactly what the problem is and whether it's caused by CCleaner at all.

I have logged the cleaning process using the Process Monitor App. All recently used exe files were emptied again while doing a Custom Clean. The changes can be quickly found via Windows Search (see screenshot modified_exe_files.png). As an example, I picked the DropboxThumbnailGenerator.exe file from the Process Monitor log to track the changes. This resulted in the following image (see screenshot proc_mon.png).

The process was like this:
- 20:24: CCleaner (V. 6.02.9938 64bit) was loaded and I started an analysis (Analyze button)
- 20:25: I started the Custom Clean
- Between 20:30 and 20:34 the temporary files were processed and deleted by CCleaner
- 20:30: Finally, the DropboxThumbnailGenerator.exe file has been modified
- 20:34: The cleaning process finished

According to the Process Monitor log, the original DropboxThumbnailGenerator.exe file appears to have been emptied via the System Prozess (ID: 4) immediately before CCleaner handled the temporary DropboxThumbnailGenerator.exe file (sentry_temp). I selected 3 erase cycles which can be seen from the log.

Hope this is helpful.

[APMichael]

It really looks like Avira is the culprit after all!

Another well-known cleaning tool also has a corresponding issue report:
https://github.com/bleachbit/bleachbit/issues/1378

Avira includes a program file called "SentryEye.exe", which is probably responsible for the "C:\Windows\Temp\sentry_temp" folder.

If this folder is excluded, the issue can probably be prevented. See this earlier post:
https://community.ccleaner.com/topic/63148-apps-dont-work-anymore-after-temporary-files-were-cleaned/

 

The Process Monitor does not seem to correctly display this probable connection with Avira (since Avira is considered to be deeply embedded in the system and probably redirects certain things). CCleaner would certainly never create or rewrite an exe file.

[nukecad]

Thanks @APMichael, you have save me a bit of work.

I was just checking out those Avira entries myself (in particular that software updater) and coming to a similar conclusion.

@AW7 Are you also running Avira?

[APMichael]

@nukecad You're welcome!

Yes, @AW7 also uses Avira:
https://community.ccleaner.com/topic/63390-ccleaner-corrupting-program-files/page/2/#comment-338240

[hazelnut]

As Avira is owned by NortonLifeLock now along with bullgard -avast- norman and avg. it may end up being a wider problem.

[nukecad]

This behaviour has also been reported at Avira's forum 5 days ago:
https://support.avira.com/hc/de/community/posts/8243246193169-Avira-is-deleting-all-my-exes

(Oops, APMichael had already posted that above).

Just in case you missed it in APMichael's link the fix/workaround in CCleaner is:

Go to Options>Exclude and exclude "C:\Windows\Temp\sentry_temp"

[AW7]

Michael, Ronster and all, many, many thanks for getting to the bottom of all this. Yes, to confirm, I use Avira, and interstingly, I don't use it on my laptop, which hasn't caused me any grief. The question I ask myself now is whether it's time to dump Avira.

But it's great to have this community, isn't it?

A

[nukecad]

It does make you wonder just what Avira have done (and how) so that deleting their temporary files, from a Windows temporary folder, modifies/wipes programme executables?

It's definitely not something that anyone would expect to happen.

EDIT- I think that I've possibly worked out what they are doing. (I could be wrong but it would explain why the exes get wiped if you clear that Temp folder).
If I am right then it's a half-baked safety/protection measure that isn't 'safe' at all the way they have done it, as we can see.
(I might check/test my idea later, but not on this laptop I'm not putting Avira on here).

[AW7]

Now then, Advanced Setup found a temp msedge folder on my machine that they couldn't understand. Didn't have such a thing on their win 10 or win 11 machines. Is this something to with it all? Whilst browsing I recall seeing old_msedge.exe in there, but now it's empty.

A

[nukecad]

It may have something to do with it, and it would fit with my suspicion.

But there again as you say it contained 'old_msedge.exe' it may have been to do with an Edge update, so you could roll back if needed/wanted?
Or it may even have been the old non-Chromium MS Edge? MS only started fully removing that recently.

I'll re-read your thread at Malwarebytes to see what he said about it.

Edit, nothing there in your thread it must have been in a PM, it's not important.
PS. I've let AdvancedSetup know what we have found here about Avira.
 

[hazelnut]

Sentry is Behaviour Blocker Technology developed by Bullguard and acquired by Avira when they bought them.

Avira themselves were then assimilated into the Norton collective.

[AW7]

Thanks for all the help everyone. Things seem to be fine now.

A

[AW7]

Hmm, this is getting more complicated. I did wonder, I noticed that my temp/sentry_temp folder hadn't been cleaned and there were files in there from 2013. There again, I added the exception, ran CC and all was fine. That said, I had the msedge.exe.exe popup again......which may be something completely unconnected.

[hazelnut]

@AW7

Version 104.0.1293.54 of Edge came out of the 11th August