Instalation problem -Remove JetBrains products by System
Hello.
I would like to share my experience with JetBrains products running on NT Win 11.
As a high-level and low-level (select Security) programmer, I know that Windows 11 has a certain problem in some versions.
After running the .EXE/.DLL file, Windows deletes the file on its own in certain cases.
After building in VS . EXE/DLL, this manifests itself in such a way that after launching/loading .EXE/.DLL, Windows will in some cases delete the file on its own. If it is a DLL, it will also delete the .EXE source in which the DLL is loaded.
It's some kind of binary check by the system before loading, even TLS, I'm guessing Linker and some kind of checking. The entire check and deletion takes less than a second.
I have Defender and related features disabled and bypassed, but the entire check and deletion of the binary source takes less than a second, while with resident detection, the times are over 5 seconds for
memory integrity check.
The JetBrains installation has the same problem. When I run the installation file, not only does the OS delete it, but after running it in the Opera browser, it deletes the entire browser folder. The behavior is identical—checking the binary trace and deleting
the source in which it is handled (Opera).
I am attaching the log from JetBrains:
2026-01-23 08:03:07.716 +01:00 [INF] Moving 'C:\Users\Admin\AppData\Local\JetBrains\Toolbox\bin.tmp' -> 'C:\Users\Admin\AppData\Local\JetBrains\Toolbox\bin'
2026-01-23 08:03:07.718 +01:00 [ERR] Exception
System.IO.IOException: Přístup k cestě C:\Users\Admin\AppData\Local\JetBrains\Toolbox\bin.tmp byl odepřen.
v System.IO.Directory.InternalMove(String sourceDirName, String destDirName, Boolean checkHost)
v Toolbox.Installer.ExtractProgressViewModel.<Extract>d__9.MoveNext()
--- Konec trasování zásobníku z předchozího místa, ze kterého byla vyvolána výjimka ---
v System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
v System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
v Toolbox.Installer.ExtractProgressViewModel.<FinishedAsync>d__7.MoveNext()
--- Konec trasování zásobníku z předchozího místa, ze kterého byla vyvolána výjimka ---
v System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
v System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
v Toolbox.Installer.MainWindow.<ShowPages>d__4.MoveNext()
2026-01-23 08:03:07.721 +01:00 [ERR] currentUnhandledExceptions
Access-Denied excp. does not always mean a rights problem. In the OS, we distinguish between situations where applications try to move/copy a module that no longer exists at the time of processing the content in memory. Access Denied is identical to the reason for failure.
I would argue that Win. 11 performs some kind of check on the JetBrains module, deletes the module, and the entire installation fails.
OS version:
Edice Windows 11 Home
Verze 25H2
Datum instalace 30.09.2025
Build operačního systému 26200.7623
Prostředí Balíček prostředí funkcí systému Windows 1000.26100.275.0
The behavior of the installation is identical for both .exe installers and JetBrains ToolBox.
请先登录再写评论。
You’ve noticed a serious issue on certain Windows 11 builds where running newly compiled EXE or DLL files results in the OS immediately deleting them, even with Defender and related protections disabled. In your experience as a programmer, it feels like Windows is performing an internal binary integrity check before execution, and in some cases it removes not only the DLL or EXE being loaded but also the parent process that handled it.
Thank you for sharing these detailed observations and logs. The issue you’re experiencing is related to a known problem: https://youtrack.jetbrains.com/issue/TBX-15075.
Our team is actively working on a fix, you can upvote and track the issue by starring it.
Best regards,
Uros Glogovac
IntelliJ Support
Thanks for the answers.
The error is not in permissions or an antivirus issue. The system in a certain version does some kind of integrity check before running the binary code, but I don't know in detail what it is. There will be no problem in the JetBrains product either, the installer will start, extract components that the system removes with this check and the installer only works with file locations that no longer exist. I use NT API, WIN32, Zw, IAT/INLINE, the security check is not always identical and is unpredictable. Be sure to focus on the complete build settings /C++/C#/ Linker, SD, etc. It will be either a NT Win.11 platform issue or a VS problem - if you use it to build the kernel.
The build problem may also relate to checking the resource data, if JetBrains includes PE resources, I would definitely check this as well.
.Best regards.
I reinstalled the system to an older version and the JetBrains problem disappeared.
I recommend focusing on the following things when compiling the JetBrains kernel:
DIF (Debug Information Format), SDL Check, Basic Runtime Check (BRC), Security Check (/GS), Conformance Mode Optimization - COMDAT Folding, Manifest & Resources Configuration.
With C++, the appropriate cross-check is bypassed, but I still have no idea what´s Win 11 checking. Unfortunately, the problem persists with current versions of Win. 11 from the official MS website. I used an older build of Win. 11 for the reinstall.
C:\Users\Admin\AppData\Local\JetBrains\Toolbox\bin.tmp Is a folder.
Its or copied module does not exists inside.
The whole problem starts in this folder. Before the InternalMove(String sourceDirName, String destDirName, Boolean checkHost) method or in it, some .exe/.dll/pe binary must try to be loaded, from this folder, which is not yet there, or copying the current module from this folder..
Take a look at the last binary load before/in this method inside the folder or the current copying module and focus on the configuration above when building this part of the JetBrains kernel. Please, sent this response to your developing colleagues, thanx.
Cheers.