NzbDrone.exe & nzbdrone.console.exe i deleting itself?

Sonarr version (exact version): The latest one
Mono version (if Sonarr is not running on Windows):
OS: Windows 10
((Debug logs)) (posted to hastebin or similar): hastebin.com/ewanalarej.tex
Description of issue (if you think you’ve found a bug please include steps to reproduce):

Yesterday I noticed that Sonarr wasn’t starting from localhost:8989 as it normally does. I then tried to start it through it’s shortcut, but nothing happened. I went into my c:\programdata\nzbdrone\bin folder and I notice that nzbdrone.exe and nzbdrone.console.exe is 0 bytes. Very strange. I download a fresh copy from sonarr.tv and when I install it it gives me a message that sonarr is currently updating or installing (cant remember which) and it says to reboot my computer so I do. After the computer is started up Sonarr doesn’t start so I check the \bin folder again and those files are still 0 bytes.

I then use the installer of the freshly downloaded copy to install it again. Things are looking good. A command window opens up and it says stopping nzbdrone, uninstalling it. Ok, so after it’s done I run the installer again and then it successfully starts sonarr and opens up my webinterface. It then starts to update (not the program, but updating tv shows). It’s doing it’s business, but only on 1 tv show. Then after a couple of minutes it says that the frontend is not responding and there’s a reload button. I click it and “problem loading page”. I check the \bin folder again and the same thing happened. The 2 files has 0 bytes.

At this point I’m thinking it could be a virus of some sort, but my updated antivirus software doesn’t complain and to be sure I just scan my disk. Nothing is found.

I’m hoping that the logs can show me what happened and hopefully how to fix it, but I need someone to take a look at it and tell me if they see anything weird.

Sounds like your Anti-virus is detecting those files incorrectly as possibly containing a virus, its definitely a false positive, try adding an exception for those files.

I thought so too but thats not it. I’ve added an exception to those files and even disabled the antivirus, but as soon as I run nzbdrone.exe, the file becomes 0 bytes. nzbdrone.console.exe hasnt been changed though (still).

Here’s the latest log after I installed Sonarr again and ran nzbdrone.exe (which made the file 0 bytes again):

http://hastebin.com/esaqejowuv.tex

Nothing in Sonarr has the ability to do that, especially since to itself the file is locked and why there is a separate updater application to perform the update (if that was happening there would be a log trail).

Log file indicates issue with Windows Defender.

Interesting. Why is Windows Defender creating havoc when I have another antivirus package installed? Disabled WD through group policy and restarting computer. Hopefully that will be it.

We actually discovered it yesterday when a user was having problems with the sonarr service not starting.
Look at the log file, notice that it takes seconds for each line in that file? Normally that’s less than one second total! The user noticed Windows defender using cpu, and added an exception… voila, problem went away.

So it’s probably a bug in Window Defender, but we haven’t had the chance to look into it.

So this is weird. After I restarted the computer, I ran the installer for Sonarr yet again and Sonarr seemingly started well starting an RSS Sync. I was suspicious that it took a long time so I refreshed the localhost:8989 and sure enough. Sonarr was gone. I checked the \bin folder again and nzbdrone.exe was again 0 bytes.

I then went to run Windows Defender where I got this message (as seen in the attached pic).

So Windows Defender can’t be doing this. Here’s the latest logs: http://hastebin.com/rusetajoso.tex

well, it’s starting up alot faster now, so it did something. :wink:

either way, you gotta figure out what other process is modifying those files.

Hmm yeah, any Windows app or feature I can use to help me with that?

I would start with the Resource Monitor in the Task Manager (if that’s still called the same in Win10).
If that fails I would normally go straight to procmon, but that’s an advanced tool, not suitable for everyone.

1 Like

Thanks! I’ll give it a try

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.