Jump to content

MBARW Blocks CCleaner64.exe during a CCleaner cleaning run


Recommended Posts

Malwarebytes Anti-Ransomware Beta 2 has been released, download or update now!

(If you have MBARW installed it should prompt to update)


Malwarebytes Anti-Ransomware (BETA) 0.9.5


• Improved rules to prevent false positives on legitimate software

Issues Fixed:

• Fixed issue that interfered with proper detection of latest CryptoWall 4 variant

Link to post
Share on other sites

I received the same FP mentioned by others here, however I have discovered an additional issue. It appears that MBARW and CCleaner64.exe are at a stalemate at the moment as CCleaner64.exe remains in memory while MBARW's UI remains unresponsive as it is unable to quarantine the file. I have received no prompt for a reboot and the tray notification remains. Clicking on the 'Close' button at the bottom of the notification has no effect and the same is true for the white 'X' at the top of the notification. I am able to launch the main UI of MBARW, however the 'Stop Protection' button took several minutes to respond and disable protection, after which the tray notification still remains though I was then able to use the 'Close' button in the notification.

At this point CCleaner64.exe still remains in memory as it is unable to proceed with clearing my temp files. I attempted to cancel the cleaning by launching the CCleaner UI, however it appears to have no effect.

I imagine I will have to reboot to resolve this or at the very least manually kill CCleaner64.exe.

I'm running build of MBARW BETA. I will provide the requested logs and files shortly once I've dealt with the hung CCleaner64.exe process and rebooted to determine the outcome of the detection event.

Link to post
Share on other sites

As promised, here is the data. A few more items of note. First, I do not know, but depending on how this application was whitelisted to prevent detection it might have failed because I am using the portable version of CCleaner which is stored in and runs from a custom location on my PC (not on my system drive, not in a program files directory).

Second, I was actually unable to zip copies of MBARW's files until exiting the application (to get its ProgramData folder) and then manually terminating its copy of MBAMService.exe via Task Manager (to get its logs folder as it did not terminate itself when I disabled protection and used the 'Exit' function in the tray).

Also, after reboot the file was not in quarantine (quarantine remained empty) and the file remained intact in its original location (X:\CCleaner). I suspect this is because of the issues I raised in my first post regarding the stalled state of the two applications and the actions I took in order to get past it (disabling protection etc.).

Please let me know if there is any further data, information or steps you require of me.

edit: One additional item of note. I checked and discovered that I'm actually running version 5.13 (the last version released prior to the latest) of CCleaner if that makes any difference (probably so since the binaries are different between releases).


Malwarebytes Anti-Ransomware.zip


Link to post
Share on other sites

I believe I figured out what happened to make MBARW behave differently than expected. I had a PUP installer sitting in one of my temp folders which was detected by ESET (the AV I use). Once I finally killed MBARW and allowed CCleaner to run to completion it triggered a detection in ESET for the PUP installer so it was likely ESET making this detection while CCleaner was trying to work and while MBARW was trying to kill and remove CCleaner64.exe that caused the stalemate event.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.