Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"Bad image" files and 0 byte .dll's


  • Please log in to reply
9 replies to this topic

#1 UlteriorModem

UlteriorModem

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:52 AM

Posted 21 September 2017 - 07:08 PM

I have come across an issue on two different laptops.

 

I run some software for astrophotography and one of the 'suites' calls a .bat file on start up. Quite often it fails to start the applet (Cyqwin) with two or three "Bad Image" errors always relating to certain .dll files.

 

I go and look at the .dll files and they state they are 0 bytes in size. I made backup copies of the files and just copying the backup copies over the corrupted ones fixes the issue... for a while. Sometimes a day or two, sometimes an hour or so. Always the same the .dll files are reverted to 0 bytes.

 

I have scanned both machines with Windows Defender, McAffee, Malware bytes in 'normal' and in safe mode. None of them report any suspects on either machine. I also ran Avast on one laptop and it too came up 'clean'.

 

I have tried going through the registry and clearing out any keys to Cygwin and re-installing. Again it works for a little while then later 0 byte files.

 

I am at a loss here and hope someone might be able to help with this.

 

ps; I am new to these forums, I hope that this is the proper sub forum for this sort of issue.

 

Regards, UM

 

Oh yea I guess I should mention this is Windows 10 64 bit


Edited by UlteriorModem, 21 September 2017 - 07:56 PM.


BC AdBot (Login to Remove)

 


#2 UlteriorModem

UlteriorModem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:52 AM

Posted 23 September 2017 - 10:54 AM

So its been a couple of days. No one has come accross this behaviour before?

 

No recomendations on anything else to try?

 

Need addittional information? If so what?

 

Thanks in advance.



#3 zainmax

zainmax

  • Banned
  • 344 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:52 AM

Posted 23 September 2017 - 11:19 AM

There is no reason to doubt that one of your cleaning programs or anti-virus programs will delete those files.
If this is a cleaning program, it helps if you change the installation directory of the program and / or the location of the databases. If it is an antivirus program, helps if to add these files to the list of exceptions or the waiver of this PUP program.
What deletes these files, You must find Yourself. There are many options, but these two are most likely.


#4 UlteriorModem

UlteriorModem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:52 AM

Posted 23 September 2017 - 11:51 AM

Hrm I dont run any 'cleaners' on start up. Just Mcafffee and Malware bytes. I will check them for exceptions.

 

The files are not being deleted rather they are still there but being set to 0 bytes.

 

Always .dll files located in C:/Users/(name)/Appdata/Local/cygwin_ansvr

 

The .bat file that starts ansvr calls on those .dll files and the "Bad Image" error comes up and sure enough they have been set to 0 bytes again.

 

I have tried re-installing the program that uses these .dll files in a different location but the behaviour continues.

 

As I said before I made a backup copy of that directory and simply copying the .dll files from the backup to the directory noted above fixes the problem for a while then again later they get changed to 0 bytes.


Edited by UlteriorModem, 23 September 2017 - 11:52 AM.


#5 zainmax

zainmax

  • Banned
  • 344 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:52 AM

Posted 23 September 2017 - 01:01 PM

There is no matter, when You run the cleaner or cleaners. Any way they when clean what they must clean. 
The second, if file size is 0 (zero), then it is deleted, yes, you may see the empty file with name, but it is already deleted, it do not contain any info no more. It similar like Recycle Bin, it may be full, but after deletion it is empty, but You see the file icon on the same place.
Sorry, me seems, I cannot help You any way, if You don't know such a simple things, like cleaning, deleteting, install to another place, or change data saving location.
Or if I ask, how You clean your computer, You say, don't clean at all. 
Sorry, maybe somebody can help, but I can't. 


#6 UlteriorModem

UlteriorModem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:52 AM

Posted 23 September 2017 - 02:24 PM

I guess I was not clear. I do 'clean' things occassionally using McAffee and scan with Malware bytes. However I do not have anything that automatically runs a 'cleaning' on start up. At least not that I am aware of.

 

I will make an exception rule in Malware bytes and see if that makes any difference.

 

if You don't know such a simple things, like cleaning, deleteting, install to another place, or change data saving location

 

 

I have un-installed, cleaned out the registry, re-installed in different locations several times yet the .dll files continue to be changed to 0 bytes.

 

I thought I had made all that clear.



#7 yoyoyojo

yoyoyojo

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:01:52 AM

Posted 16 October 2017 - 05:03 PM

I am having the exact same issue with bad image errors and zero byte dlls. I am also frustrated by my inability to find a solution or get help.

So far only two applications are impacted. One is a start up app for my keyboard the other is a video game.

Let me know if you find a solution. So far my post on malwarebytes has no replies

#8 Graham906

Graham906

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:52 AM

Posted 17 October 2017 - 05:29 AM

I have the same problem. It is affecting two applications: Memory-Map Navigator 6, and Miktex (a latex distribution). I have Mcafee but not malwarebytes. It seems clear that Mcafee is silently destroying DLLs when they run, although it thinks they are OK if it scans them. See

http://forum.amibroker.com/t/bad-image-0xc000020-error-mcafee-gone-mad/2308

I have put two DLLs for Memory-Map in the exclusions for Real-time scanning which seems to have fixed it (but it was somewhat random, so not certain). I think the longterm solution is to avoid Mcafee.



#9 yoyoyojo

yoyoyojo

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:01:52 AM

Posted 23 October 2017 - 11:29 AM

I can confirm it was McAfee that was doing it.  I had to put quite a few of the Corsair dlls on the exclusion list.  Corsair utility engine is a start-up app.

 

Unfortunately I found very little on the McAfee support site.  I did find one reference to their enterprise edition and their solutions was something to the effect of contact the third party developer for a patch.  Wow can you believe that.  McAfee just gave themselves a pass by blaming everyone else.  

 

So on this thread alone I think we have identified at least  apps that are impacted by this issue.

 

Also read somewhere that this started to occur in August as a result on a MickeySoft Windows 10 update.  This would line-up with my timing of events.

 

Since McAgee doesn't seem too concerned about destroying my applications I think i will be in the market for a new AV solutions.



#10 UlteriorModem

UlteriorModem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:52 AM

Posted 23 October 2017 - 07:25 PM

Sorry I did not get back to this sooner.

 

Also read somewhere that this started to occur in August as a result on a MickeySoft Windows 10 update.  This would line-up with my timing of events​

 

 

This was my experience as well. I never got as far as the exclusion list.

 

I had worked around the issue by making backup copies of the affected .dll files and overwriting the ones that had been changed to 0 bytes. It was a lame stupid kludge but it worked.

 

The issue seems to have gone away now as I have not had to jump through that hoop for a week or two now.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users