Microsoft now detects CCleaner as a Potentially Unwanted Application

[pondus]

Microsoft now detects CCleaner as a Potentially Unwanted Application

https://www.bleepingcomputer.com/news/microsoft/microsoft-now-detects-ccleaner-as-a-potentially-unwanted-application/

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/CCleaner&ThreatID=277099

[exile360]

This ban was due to Microsoft's general stance that Registry cleaners and system optimizers can do more harm than good on Windows systems.

They're preaching to the choir here.  I wish more users were aware of this; I can't count the number of times I've seen someone come here for help with some oddball issue, crash, hardware, or software problem that turns out to be due to their past use of some registry cleaner and/or system optimization tool.  The hardcore OS tweaking days of Windows XP are over and modern operating systems are much better at handling their own maintenance, plus the built in Disk Cleanup (cleanmgr.exe) in Windows is pretty decent for deleting all the temp/junk files that build up over time.

[nukecad]

MS are supposed to have lifted the block now, but some users may still see it flagged as a PUA.

Agreed that the registry cleaner should be removed from CC, (been telling them that for years now), and ostensibly this is why Microsoft say they are/were flagging CCleaner.

It is interesting to note though that the only CCleaner installers they were flagging were the ones that contained bundled offers.
The various (Slim, Pro, Enterprise, etc.) installers that did not contain these offers were not flagged, even though they install the same CCleaner with the same reg cleaner included.

So it appears that MS's real issue is with the installer offers and not the reg cleaner.
(One of the offers is for CCleaner Browser, a Chromium based browser - surely they don't see it as a possible rival to Edge Chromium?)

PS. I can now download and install various CCleaner installer versions without a peep from defender.

Disclosure - Yes I am a moderator on the CCleaner forum, not an employee but as mods we do get some inside information that others don't see.

Edited July 30, 2020 by nukecad

[AdvancedSetup]

Yes, but to be fair this is not the first time. Unfortunately, since Avast bought them there have been at least a few practices that have been questionable or upsetting to users.
If it were just a one-time thing once could overlook or ignore it at this point but it shows a pattern that the company is very much behind finding ways to monetize the program often via negative means.

Part of what Microsoft also doesn't like is the Registry Cleaning by CCleaner - I wrote an article about it 2013 over 7 years ago.
https://forums.malwarebytes.com/topic/126481-do-i-need-a-windows-registry-cleaner/

 

On another note regarding one of their other products, Speccy which also attempts to install CCleaner and add an automated updater (normally might not be bad but typically most helpers and users use it as a one time use and thus adding an update checker simply uses more resources for little reason)

As brought up by @Tarun  in another topic
 

HWInfo64
https://www.hwinfo.com/download/

This is perhaps a much better tool to use than Speccy since Speccy too has offers from Avast

But HWInfo64 also supports this Bios Agent Update site which is even worse in my opinion. The HWInfo64 program is very nice but partnering with this other site does give me great pause.

biosagentplus.com/company/about_us

I may switch over to using HWInfo64 and just add in my canned message not to use the Bios Update icon and ignore the Bios Update site.

 

 

 

 

A couple of other sites wrote about not using or altering how you use it as well last year in 2019 and previously in 2018 as well.

Why You Shouldn’t Download CCleaner for Windows anymore
https://helpdeskgeek.com/free-tools-review/why-you-shouldnt-download-ccleaner-for-windows-anymore/

Here’s What You Should Use Instead of CCleaner
https://www.howtogeek.com/361112/heres-what-you-should-use-instead-of-ccleaner/

Avast (CCleaner, Speccy) Privacy Policy

 

 

 

[nukecad]

Longish post, but I hope that it may show that things here are not simply black/white, good app/bad app.

I agree AdvancedSetup, and as long time users (and forum mods) there we are trying to influence things from the semi-inside where we can. ( To paraphrase - Stood at the tent entrance pissing in).

We have been pressuring to get the offer screens changed and the Reg cleaner removed for a while now. (The reg cleaner should have been long gone).
And it can work, someone there is still listening.

Be sure that we mods there do not hold back when we don't agree with something they are doing, if you could see some of the conversations in the private staff forum there you would appreciate that.
My critical forum posts from before I was a mod are visible to all, under the same username as here, as are my public posts made since. (But I tend to shout louder in the private room).
I believe it was partly my willingness to critise, and my anaylsys of issues, that got me offered moderator status.
We are all volunteer mods and could walk away anytime, but choose to stay, help those users with problems, and put some pressure on the staff/company when they are clearly doing something that is going to be unpopular.
We can't decide which way they go as a company, but as 'trusted' semi-insiders can get our voices heard a bit more than a regular user.

For instance, and relevent here,  after repeated nagging the way offers are presesented in the Standard CCleaner installer was changed, especially by not having them pre-ticked.

However as a 'man in the middle' I find that the reason for Microft's actions also seems to be somewhat unclear.

I should point out that the example given in the MS article linked in the first post here has not been used in CCleaner since the end of February/start of March 2020.
The style of offer that is given in CCleaner standard installer now looks like the clip below, with clear Decline and Accept buttons and no default selection or pre-ticking.
Surely MS knew that before posting their article? If not then their information is months out of date.
Or wasa clip of an outdated offer page posted on purpose to support their article?

I also notice that that MS article had been revised and is now  all about bundled offers, no mention of registry cleaning. (Maybe that outdated image/clip will be removed/changed later?).
BTW. Has anyone noticed MS Defender suddenly flagging any other software that has bundled offers in it's installer, or is it only CCleaner that is being suddenly flagged in this way?

It now does seem possible that an image of the very old style, pre-ticked offer page for Chrome may have been included in the v.569 installer but was not linked to code so was not shown to any downloaders.
I do know the Chrome offer screen in question (and have been very voiciferous against it) BUT it is nothing like the one shown in the MS article either.

Yes, Defraggler, Recuva, and Speccy installers still have very old offer screens as shown in the post above this one, neither of those apps have had an update for a couple of years. (Well before Avast took over).
With such a lack of resources spent on updates to those apps there is speculation on whether the company is still interested in them, or if they will be quietly dropped.
Officially they are still supported, but instead of updates to them there are new products in the pipeline that we know about,  'CCleaner Browser' was one, and 'Kamo' has just been released.
I don't see the point of releasing either one of those myself, and have said so clearly to the Piriform staff.

All in all the way Piriform/Avast is taking their business is different from the past, and many who remember the old CCleaner don't like the new direction and have voiced their opinions and voted with their feet.
But it's their business decision to take, sink or swim.

I'm fairly sure someone at the Piriform staff will see this post, Hi Guys and Gals.

 

Edited July 30, 2020 by nukecad

[Porthos]

14 minutes ago, nukecad said:

Has anyone noticed MS Defender suddenly flagging any other software that has bundled offers in it's installer

I do see many things marked a PUA but do not take notice or test the installers further either on a normal basis unless it is something I am personally interested in installing.

PUA detection is on by default in 2004 and it was not on in the past. It had to be enabled in the registry. So now users are seeing more warnings.

 

 

[Hardhead]

I'm seeing this below plus SmartScreen for Microsoft Store Apps is on too.

[nukecad]

38 minutes ago, Porthos said:

PUA detection is on by default in 2004 and it was not on in the past. It had to be enabled in the registry. So now users are seeing more warnings.

Thanks Porthos and Hardhead, I wasn't aware of that change.

Although I have 2004 and those PUA setting shown in Hardheads screenshot are off, and I didn't turn them off myself.

As an escalation I've just had a user report on the CC forum that his ESET has removed the already installed CCleaner, Defraggler, Recuva, and Speccy from his machine.

As MS were/are saying they are only bothered about the bundled offers in the various installers it does seem a bit of an overreaction for ESET to remove already installed apps.

Looks as if it might be avalanche time for Piriform if other AV's jump on the bandwaggon.

Edited July 30, 2020 by nukecad

[AdvancedSetup]

Agreed, most of us have no say so aside from voicing our opinions to those that might have real say so, myself included.

I understand the need for Advertising and for Partnering and as you've show @nukecad it's good to see that at least a default not being ticked is a good change if they're going to advertise.

 

[Tarun]

I'm glad HWInfo doesn't push that partnership at all, just that one button which I've never pressed until you brought it to my attention.

CCleaner has had issues for years, wish Microsoft left it flagged for the crapware it is.

https://www.lunarsoft.net/featured/infected-ccleaner-downloads-official-servers

I too wrote about how CCleaner has become obsolete. The registry cleaner is snake oil, don't like how they insert a method to skip the UAC check either, that's shady behaviour.

https://www.lunarsoft.net/featured/ccleaner-s-usage-on-windows-has-become-obsolete

[Tarun]

Adding on, let's not forget that avast (who also owns AVG) cannot be trusted either:

https://www.lunarsoft.net/featured/mozilla-pulls-avast-software-addons-for-excessive-tracking

[Hardhead]

16 hours ago, nukecad said:

MS are supposed to have lifted the block now, but some users may still see it flagged as a PUA.

Agreed that the registry cleaner should be removed from CC, (been telling them that for years now), and ostensibly this is why Microsoft say they are/were flagging CCleaner.

It is interesting to note though that the only CCleaner installers they were flagging were the ones that contained bundled offers.
The various (Slim, Pro, Enterprise, etc.) installers that did not contain these offers were not flagged, even though they install the same CCleaner with the same reg cleaner included.

So it appears that MS's real issue is with the installer offers and not the reg cleaner.
(One of the offers is for CCleaner Browser, a Chromium based browser - surely they don't see it as a possible rival to Edge Chromium?)

PS. I can now download and install various CCleaner installer versions without a peep from defender.

Disclosure - Yes I am a moderator on the CCleaner forum, not an employee but as mods we do get some inside information that others don't see.

I seen those settings on the 27th oh this month and manually cut them on myself. I didn’t know about Ccleaner being listed as a PUA by MS until I read about it on Bleeping Computer website. It’s been a very good while since I have used Ccleaner and actually used Bleach Bit when I was running Windows 8.1. As of now I don’t use anything but Windows build cleaning and FRST. 

[nukecad]

I wrote my own batch file for regular cleaning of Firefox plus some Windows and other files, takes about a second to complete.

Then Storage Sense on and a Disc Cleanup once a month.

I still have CC for ocassional cleaning of browsers that I don't normally use, and of course for when helping others on the forum or when testing out bugs.

[exile360]

It would be nice if someone would update a tool like ATFCleaner or TFC for modern Windows.  Just a quick, one-click utility to clean out all the temp junk without risking any harm through over-aggressive cleaning (though cleansing of the MRUs and the like as CCleaner does would be nice too).

[AdvancedSetup]

The FRST program does a pretty decent temp clean up but most people don't want to clean their browsers like that so overkill there, but in reality, even browsers benefit from a good cleaning every once in a while too.

 

Part of my canned message for cleanup I often ask users to run.

 

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

 

 

 

[exile360]

Is the Recently opened files cache the same thing as the MRU (Most Recently Used) lists stored in the registry?

[AdvancedSetup]

Similar, I don't believe it goes through all the MRU lists the Registry has

 

[exile360]

I used to have a batch that did most of this stuff; I might have to dig it up, though it's not exactly Windows 10 ready so I don't know how useful it would be, depending on how much has changed.

[Hardhead]

1 hour ago, AdvancedSetup said:

Similar, I don't believe it goes through all the MRU lists the Registry has

 

That's correct @AdvancedSetup but I use it.😉

I have a copy of Revo and it cleans the MRU but I don't use it anymore.

Edited July 31, 2020 by Hardhead
add last sentence

[Massimiliano]

8 hours ago, AdvancedSetup said:

The FRST program does a pretty decent temp clean up but most people don't want to clean their browsers like that so overkill there, but in reality, even browsers benefit from a good cleaning every once in a while too.

 

Part of my canned message for cleanup I often ask users to run.

 

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

 

 

 

Can you attach screenshots with the correct settings for this cleaning?

So far I have always run FRST only to upload any Logs that may be required here on the forum or in technical support tickets.

Thank you

[AdvancedSetup]

You simply need to create a file named FIXLIST.TXT and save it in the same location as FRST and click on FIX

The file only needs the following entry in it

EmptyTemp:

 

[Massimiliano]

Thank you very much

[Tarun]

On 7/31/2020 at 5:52 AM, nukecad said:

Then Storage Sense on and a Disc Cleanup once a month.

This is all you really need. I typically set Storage Sense to Once a Week when I turn it on for client computers. Disk Cleanup takes care of everything that really should be touched. Leave Delivery Optimization alone if you have more than one PC on your local network, as updates can be shared from an up-to-date PC on the network.

[Porthos]

5 minutes ago, Tarun said:

. I typically set Storage Sense to Once a Week when I turn it on for client computers. Disk Cleanup takes care of everything that really should be touched.

I do the same.

But for the user who does not know about storage sense because it is not on by default they go looking for other software.

I do not worry about every little file I can delete.

[nukecad]

TBH in these days of multi-TB drives a few temporary files and logfiles etc. hanging about is not going to affect anything much.

Browser cookies are a bit of a different question.
But if the user has their browser synced then cleaning those off the local machine is pretty useless anyway because they will just be synced straight back.

There are slow but noticable changes at CCleaner/Piriform away from cleaning Windows/other apps (although CCleaner still does) and more into the region of cleaning/protecting browsers. (I guess that's influence from Avast?)

The CCleaner Browser and the new 'Kamo' anti-fingerprinting product that grew out of it are cases in point, as is the lack of updates for Speccy, Defraggler, and Recuva.
(And those last two can take ages on a multi-TB drive).

The Piriform branding is slowly being dropped in favour of just CCleaner. (The forum website changed a while ago, the 'Pear' logo has just been dropped from CCleaner itself).

Edited August 2, 2020 by nukecad