lmacri
-
Posts
376 -
Joined
-
Last visited
Posts posted by lmacri
-
-
On 7/19/2018 at 12:10, lmacri said:
Further to my post <here> of 11-Jul-2018 I have additional evidence that CCleaner v5.44 is wiping my system restore points (RPs) on my C:\ drive (but not my D:\ drive)...
Good news. I've been testing 32-bit CCleaner Portable v5.45 since 26-Jul-2018 and so far this latest version hasn't wiped any system restore points (RPs). I have a few more tests to run so I'll post back later if my RPs start disappearing again.
I haven't had any further volsnap errors in my Event Viewer since 10-Jul-2018 (i.e., since I stopped using v5.44) , none of the RPs created on my machine between 11-Jul-2018 and 28-Jul-2018 have been deleted and today's vssadmin list shadowstorage command shows that I've only used ~ 18 GB of the 33 GB max space allotted for RPs.
One thing I did differently this time is that when I unzipped ccsetup545.zip on my USB drive I did not copy over the ccleaner.ini file I was using with v5.44. Instead, I ran CCleaner Portable v5.45 to generate a brand new ccleaner.ini file and then re-configured all my personalized settings from scratch. Is it necessary (or at least a best practice standard) to create a new ccleaner.ini file every time CCleaner Portable is updated? It's difficult for me know if there was a bug in v5.44 that was deleting my RPs and/or the registry keys that were pointing to my RPs when no one from Avast/Piriform has shown any interest in viewing a debug log.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.45.6611 * TreeSize Free Portable v4.1.2.407 -
If the Show CCleaner in the Windows Notification Area setting is disabled in CCleaner Portable v5.45 there is no CCleaner icon displayed in the system tray and no CCleaner application button displayed on the main taskbar when the CCleaner GUI is minimized. As a result, the user is unable to re-open the interface or exit CCleaner. I have a 32-bit OS and cannot confirm if this bug also exists in the 64-bit version of CCleaner Portable v5.45.
To reproduce the problem:
- Start CCleaner Portable v5.45 (I am using the 32-bit version)
- Disable Options | Settings | Show CCleaner in the Windows Notification Area (enabled by default)
- Click the Minimize ("-") button in the top right corner of the CCleaner interface
Result: There is no icon in the system tray or application button on the taskbar and the user is unable to restore the CCleaner GUI and/or exit CCleaner. Process Explorer shows that the ccleaner.exe process is still loaded into memory after the GUI vanishes.
Possible Solution: When the Show CCleaner in the Windows Notification Area setting is disabled in CCleaner Portable, ensure that the CCleaner application button remains displayed on the taskbar (see image below) after the GUI is minimized so that the user still has the ability to Restore / Maximize / Close the application and terminate the CCleaner executable.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * CCleaner Portable 5.45.6611 -
12 hours ago, jagga said:
I have asked this before, but does anyone know if "heartbeat" calls home when using a portable version of CCleaner? And, what if CCleaner (portable) is run while being totally disconnected from the Internet during the run of CCleaner?
Hi jagga:
I normally run the portable version of CCleaner Free on my 32-bit Vista SP2 machine from a USB thumb drive. I've been testing CCleaner Portable v5.45.6611 for a few days and don't see any obvious evidence that the portable version continues to monitor my system after the program is closed. I can't see anything associated with CCleaner in my startup items or Windows Task Scheduler, and I've confirmed that the settings at Options | Monitoring | Enabled Active Monitoring and Options | Settings | Inform me of updates to CCleaner are both disabled by default and remain disabled after CCleaner is closed and restarted and/or my system is re-booted. According to employee Paul Piriform's comment <above> the new "heartbeat" data will not be collected as long as Options | Monitoring | Enabled Active Monitoring remains disabled, and if that's correct then that would suggest that heartbeat data is not being collected on my system with my current settings.
One thing I noticed is that the CCleaner icon shown in the image below appears in my system tray when the CCleaner interface is minimized. If I disable the setting at Options | Settings | Show CCleaner in the Windows notification area (which is enabled by default) that icon does not appear in the system tray when CCleaner is minimized, but unfortunately if you do disable that setting then you have no way of opening the CCleaner interface again and the executable stays loaded in memory as a running process without any way to stop it (unless you kill the process in Task Manager or re-boot your system). I'll have to play around with this setting a bit more but that might be a bug in CCleaner Portable v5.45 that needs to be fixed.
Instead of disconnecting from the internet every time you run CCleaner, it might be easier to create a program rule that will block all incoming and outgoing traffic for the CCleaner executable through your firewall so that CCleaner can't send data back to the Avast/Piriform servers. Unfortunately that would also mean that checks for CCleaner updates probably wouldn't work so you would likely have to download new versions and install them manually. I use the two-way Norton Smart Firewall that comes bundled with my Norton Security antivirus and preventing 32-bit ccleaner.exe traffic through my firewall would be relatively simple:
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * CCleaner Portable 5.45.6611 -
On 7/11/2018 at 08:45, lmacri said:
...I ran CCleaner v5.44 the mornings of 08-Jul-2018 and 09-Jul-2018. I had ~98 GB of used disk space the morning of 10-Jul-2018 but when I checked again in the evening my used disk space had dropped by about 10 GB to 88 GB, there was another volsnap error in my Event Viewer, and the vssadmin list shadowstorage command showed 0 GB of my allotted 33 GB of disk space for restore points (RPs) was being used (i.e., all my RPs had been wiped)....
Further to my post <here> of 11-Jul-2018 I have additional evidence that CCleaner v5.44 is wiping my system restore points (RPs) on my C:\ drive (but not my D:\ drive).
I haven't run CCleaner Portable v5.44 since 10-Jul-2018 and the last volsnap error logged in my Event Viewer occurred 10-Jul-2018 @ 5:49 PM. The Privacy Eraser Portable v4.38 image below shows that the five RPs created for my C:\ drive since that date have not been deleted and the attached .txt file of the output from a vssadmin list shadows command shows that I also have 11 restore points dating back to 02-Jul-2018 for my D:\ drive (i.e., pre-dating the last time the RPs for my C:\ drive were wiped), so it appears that CCleaner Portable is only deleting the RPs for my C:\ drive and leaving the RPs for my D:\ drive (my HP_RECOVERY drive for emergency factory resets) untouched.
lmacri RPs C and D Drive Since 11 Jul 2018.txt
The vssadmin list shadowstorage command shows ~ 10 GB of my allotted 33 GB of disk space is currently being used for RPs on my C:\ drive.
I'm beginning to wonder now if this issue only occurs with 32-bit operating systems or just the portable version of CCleaner. When I update (unzip) a new version of CCleaner Portable on my USB thumb drive I normally copy the ccleaner.ini file from the previous version to the location of the new 32-bit ccleaner.exe executable. Are CCleaner Portable users now required to create a new ccleaner.ini file and re-create all their custom settings every time the product is updated to avoid corruption of the ccleaner.ini file?
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
3 hours ago, nukecad said:
...This thread suggests that a defrag could be doing it: (His particular defragger was Auslogics, but some of the later threads suggest that Windows own defragger can also cause it)...That also suggests that any process moving lots of data around quickly could cause a volsnap error and wipe the RPs..
Hi nukecad:
It's unlikely that disk defragmenters are part of my problem. My automatic Windows disk defrags are disabled and I haven't run a manual disk defrag for several months. Like registry cleaners, I believe that disk defrags do very little to improve system performance and can do more harm than good if they're run indiscriminately.
I'm aware of the known issue with third-party disk defragmenters and system restore points. See my 2014/2015 thread Full Defrag Wipes All Restore Points about Piriform's own Defraggler wiping my system restore points. At that time Piriform Support couldn't replicate the problem on their test system so I stopped using Defraggler for full disk defrags on my Vista SP2 machine and I now use Vista's built-in Windows Disk Defragmenter (WDD) if I need to defrag. As an extra precaution, I always run a thorough Check Disk (chkdsk /r) first before running a WDD defrag just to make sure I don't have any bad sectors on my hard drive. The fact that I've run into a similar problem with volsnap erros and disappearing restore points in the past with another Piriform product makes me even more suspicious that CCleaner is the culprit this time.
What ever other theories you come up with for my disappearing restore points would have to take into account that:
- My latest volsnap errors (and disappearing restore points) only started after a recent CCleaner update.
- I didn't have a volsnap error the entire week I stopped using CCleaner.
- My volsnap errors returned immediately after I resumed using CCleaner.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
Further to my post <here> of 08-Jul-2018, I have more evidence that this problem could be associated with CCleaner v5.44.
I ran CCleaner v5.44 the mornings of 08-Jul-2018 and 09-Jul-2018. I had ~98 GB of used disk space the morning of 10-Jul-2018 but when I checked again in the evening my used disk space had dropped by about 10 GB to 88 GB, there was another volsnap error in my Event Viewer, and the vssadmin list shadowstorage command showed 0 GB of my allotted 33 GB of disk space for restore points (RPs) was being used (i.e., all my RPs had been wiped).
I checked with CCleaner and confirmed that the 7 or 8 RPs that had been created the previous week (i.e., the week I stopped using CCleaner and ran Malwarebytes Threat Scans) had all disappeared, including the latest RP created.
I don't know if it's relevant, but after cleaning my disk with CCleaner on 09-Jul-2018 I used the registry cleaner to remove one orphaned registry entry left over after an uninstall of WinRAR v5.50. As a general rule I don't use any registry cleaners and only used CCleaner's to remove the last bits of WinRAR v5.50 to ensure I had a clean re-install of the new WinRAR v5.60.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
On 7/8/2018 at 20:00, nukecad said:
...This suggests to me that it was Windows 10 that removed it after it became a 'month' old. So my next oldest should dissapear in about 12 days?
I believe that the Windows default for removing old RP's was 90 days. But maybe that has been reduced with Windows 10 Home because it does 'forced' Updates every Patch Tuesday?...
Hi nukecad:
My understanding is that after you enable System Protection in Windows 10:
- A restore point is automatically created whenever user installs a software application, driver, or updates from Windows Update. In addition, Win 10 will automatically create a restore point if a new restore point has not been created for 7 days (see the TechJourney article <here>; the default for my Vista SP2 OS is 24 hours after the last created restore point ).
- System restore points are automatically deleted if they are 17 days old (or older) when Win 10 performs a maintenance routine that runs during system idles (see bumboola's post <here> in the TenForums as well as the AskWoody.com discussion <here>).
This assumes that you allocated enough disk space to store your new restore points when you enabled System Protection on your C:\ drive. The TenForums tutorial Windows 10: Turn On or Off System Protection for Drives in Windows 10 shows the user allocating 4% (10 GB) of their 250 GB hard drive, which might be a good starting point. Once that allocated disk space is used up older restore points will be deleted to make room for new ones. There are additional links at the bottom of that article for related tutorials on how to manage restore points in Windows 10.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
5 hours ago, nukecad said:
...Have you checked your registry to see if there has been a "RPLifeInterval" key created? (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore). If it has been created then it sets the 'age' at which a RP will be removed, the time value is in seconds...
Hi nukecad:
My registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPLifeInterval is set to the Vista default of 4294967295 sec (49701 days or 136 years) per the TechRepublic article Vista's SystemRestore Points Set to Delete After...136 years !!! so I doubt that my Vista SP2 OS is automatically deleting my Restore Points (RPs) because of their age.
Here's an old screenshot I captured back in March 2017 with just a partial list of my RPs showing that it's normal for me to have a dozen or so RPs stored on my hard drive. When I reach Vista's default max 15% disk space allotted for restore points (~33 GB of my 220 GB C:\drive as shown <here> when I run the vsssadmin list shadowstorage command) it's normal for me to see the oldest RP deleted to make room for a new RP. I currently have about 125 GB of free disk space on C:\ so lack of free disk space should not be an issue.
Like the OP sethm1, my issue is not that the oldest system restore point is being deleted. My issue is that every time I see one of these volsnap errors in my Event Viewer (which first appeared in mid-May 2018, around the same time that CCleaner v5.42 was released) every restore point is deleted except the most recent restore point created, as shown <here>.
Extended support for my Vista SP2 OS ended in April 2017 and I'm not receiving regular security updates on Patch Tuesdays anymore (aside from the occasional update for my Windows Defender definition set) so it's also unlikely that a recent update to my OS caused this problem.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
52 minutes ago, sethm1 said:
....How did you add “Scheduled Checkpoint” ?I tried setting up so that a restore point would be created each time I boot up - but cant. Its weird, its as if the system shows Restore points enabled but actually its not.
Hi sethm1:
I have a Vista SP2 OS which automatically schedules the creation of system restore points by default. From my Task Scheduler (Task Scheduler Library | Microsoft | Windows | System Restore):
System Restore is disable on Windows 10 machines by default, and according to the Windows Central tutorial How to Use System Restore on Windows 10 if you enable System Restore on a Win 10 machine "a new restore point will be created automatically when an important system change occur, such as before an installation of a Windows 10 update" .
The Winaero support article Create System Restore Point on Schedule in Windows 10 and the TenForums tutorial How to Automatically Create System Restore Point on Schedule in Windows 10 both have instructions for creating scheduled restore points but please note that you must make an edit in your Win 10 registry before you create the scheduled task in your Win 10 Task Scheduler, so I wouldn't suggest you try this unless you have advanced troubleshooting skills and can undo these changes if anything goes wrong.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
On 7/4/2018 at 08:58, lmacri said:
I found some recent recent volsnap errors logged in my Windows Event Viewer, and according to the StackExchange SuperUser thread volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C: these Event 14 errors occur when there is no space left for shadow copies to function correctly (i.e., current usage has exceeded the maximum space allocated for system restore points)....
Just an update on my testing. I've run four Threat Scans with Malwarebytes Free since 03-Jul-2018 (without running CCleaner v5.44 that entire time) and none of my system restore points created since then have been wiped. I haven't finished my testing yet but it looks unlikely now that Malwarebytes has anything do with my disappearing restore points.
I ran a CCleaner disk clean this morning. I'll wait for a day or so for my Vista SP2 to create a new (scheduled) restore point and see if this generates another volsnap error that wipes my restore points.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
On 7/2/2018 at 10:17, nukecad said:
...There was a new 'Storage Sense' feature introduced with 1709, and some of the features and settings changed with 1803. That may be automatically cleaning your older restore points, among other things....It should be disabled by default, but may have been turned on during the update to 1803...
If it is on then you can change the settings, or turn it off again, in Settings>System>Storage.
Here's an article about it: https://www.guidingtech.com/windows-10-storage-sense-enable/
HI sethm1:
...and further to nukecad's 02-Jul-2018 comment, did you ever confirm that your Win 10 Storage Sense feature is disabled? Version updates in Win 10 (e.g., 1709 to 1803) are especially notorious for changing configuration settings without the users knowledge. Win 8.x and Win 10 users posting in the Norton forum are frequently asked to disable the Fast Startup feature because this hybrid shutdown / boot feature can interfere with the loading of Norton services at boot-up and causes all sorts of odd glitches with Norton security programs (and many other third-party software programs), and it's not unusual for Fast Startup to re-enable itself after a major Win 10 update.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
1 hour ago, sethm1 said:
...Now using Webroot Secure Anyware - as it came with the Best Buy Geek squad 1 yr protection..
Hi sethm1:
The Malwarebytes mbst-clean-results.txt file wasn't the log I was looking for - it looks like you used the Malwarebytes Support Tool to remove Malwarebytes (the Clean button) instead of gathering diagnostic logs (the Gather button). They probably won't be able to do much to help you over in the Malwarebytes forum if you uninstalled their product before gathering Malwarebytes / Farbar Recovery Scan Tool (FRST) diagnostic logs with the Malwarebytes Support Tool but I wouldn't worry about it unless someone in that forum asks for new set of diagnostic logs. I'm not a certified MSCE technician but I'll take a quick look through the system information log you provided above and post back if I notice anything that's an obvious concern.
I don't know much about Webroot SecureAnywhere but the home page at https://www.webroot.com/ca/en/home/products/complete does mention that it comes with a feature called System Optimizer that "also reclaims hard drive space and improves performance by deleting unnecessary files" . You might want to check through your Webroot System Optimizer settings (Advanced Settings | System Optimizer) and then see if you have any Webroot System Optimizer disk cleans scheduled to run automatically (Advanced Settings | Scheduler | System Optimizer or Utilities | System Optimizer | Schedule) that could be wiping your older restore points.
Just an FYI that I visited the FileHippo site today and https://filehippo.com/download_ccleaner/ shows that a new CCleaner v5.44.6577 was released today (04-Jul-2018), but when I checked the official CCleaner release history at http://www.ccleaner.com/ccleaner/version-history it still lists v5.44.6575 (released 26-Jun-2018) as the latest available version. I haven't seen any information yet on why a new v5.44.6577 installer was posted on the Avast/Piriform FTP servers or if the newer version includes a minor bug fix.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
1 hour ago, sethm1 said:
I removed Malwarebytes but still have the problem. I have not yet removed Ccleaner....Created a manual restore point and all seemed fine until the evening. So IS something on the system wiping points out after 6pm or just a big coincidence?
Hi sethm1:
On my system it looks like the restore points are being wiped out the first time my Vista SP2 OS tries to automatically create a scheduled restore point after CCleaner (or Malwarebytes, if it's involved somehow) runs a scan. The creation of that new restore point (and deletion of the older restore points) could happen several hours after CCleaner runs a scan (note the time gaps between my CCleaner/Malwarebytes scans and the volsnap errors in my images <above>). I assume that's why I can still see my old restore points immediately after I've run CCleaner and/or Malwarebytes - because the older restore points aren't purged until my system runs an automated task that tries to create a new restore point. I haven't determined yet if the creation of the new restore point is enough to trigger the deletion of my older restore points or if my system also requires a re-boot before the older restore points are purged to free up allocated disk space.
One question for you. Further to your recent thread Help removing all of Norton I.S. in the Norton forum, did you install a different antivirus recently, and if so do you know know if it has built-in disk cleaning or if the antivirus installer came bundled with some utility like AVG PC Tune-up? The automated reply in post # 2 of your Malwarebytes thread has instructions on how to collected diagnostic logs using the Malwarebytes Support Tool (expand the section titled "If you are having technical issues...") and it would be helpful if you could post the requested mbst-grab-results.zip file in your Malwarebytes thread. I'm subscribed to that Malwarebytes thread so I'll know when you post there, and the Farbar (FRST) diagnostic logs inside that zipped file will show us some of the other third-party software installed on your computer.
EDIT:
...and since you've been running Malwarebytes and SuperAntiSpyware scans recently, do you have any reason to believe that you might have malware on your system that could be deleting your restore points?
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
I found some recent recent volsnap errors logged in my Windows Event Viewer, and according to the StackExchange SuperUser thread volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C: these Event 14 errors occur when there is no space left for shadow copies to function correctly (i.e., current usage has exceeded the maximum space allocated for system restore points).
I also noticed that my recent volsnap errors occurred if my system was trying to automatically create a system restore point on the same dates that I ran a CCleaner disk clean followed by a Malwarebytes Threat Scan. That still points to a problem with either CCleaner v5.44 or MB Free v3.5.1 (or some odd combination of both), but I've been running those two programs in tandem while troubleshooting this past week so I'll have to do more testing to see if I can isolate which program is causing the problem. It still seems more likely to me that there's a glitch in my CCleaner Portable - perhaps a corrupted cleaner.ini file that causes CCleaner to run a Wipe Free Space on my hard drive even when the configuration setting is disabled.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
31 minutes ago, Willy2 said:
...Please do run Antibody's WIZTREE as well (tree view) and make a screenshot of the treeview...
Hi Willy2:
I normally use the portable version of Jam Software's TreeSize Free - hope that's OK. I already checked my System Volume Information folder with that utility and didn't notice anything unusual (besides the fact that it only uses 1.8 GB and I only have the one restore point created 02-Jul-2018 shown <here> instead of my usual 10 or so).
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 -
1 hour ago, Nergal said:
I wasn't referring to the settings but instead in the cleaning tool on the windows tab under the heading advanced, is the checkmark in wipe free space.
Hi Nergal:
Sorry for the misunderstanding. No, Wipe Free Space and all my other Advanced items on the Cleaner | Windows tab are always disabled.
I have a 220 GB C:\ drive with over 130 GB of free disk space, and I use the Vista SP2 default which allocates a max of 15% or 33 GB (0.15* 220 GB) of disk space before it starts overwriting older system restore points. I also have a small 12 GB D:\ drive on my HP computer that's only intended for emergency recovery / factory resets.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 -
52 minutes ago, Nergal said:
To be sure: you don't have wipe free space checked off in ccleaner's windows>Advanced
Hi Nergal:
That might the cause. Both Wipe Free Space Drives (Local Disk C:) and Wipe MFT Free Space have been enabled in my CCleaner Portable v5.44 at Option | Settings. I'll disable those settings and post back if it makes any difference.
I'm not sure how those settings were enabled. I copied over my ccleaner.ini file I was using with CCleaner Portable v5.43 and I'm sure they were disabled before. Is it even normal for Wipe MFT Free Space to delete older system restore points when this setting is enabled?
I also don't have active monitoring or scheduled scanning enabled and Run CCleaner when the computer starts is also disabled, so I'm not sure why simply launching CCleaner Portable v5.44 would wipe my old system restore points, regardless of whether Wipe MFT Free Space was enabled or not.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 -
Hi nukecad:
I saw your post # 11 in sethm1's thread System Restore Points are Missing in the Malwarebytes forum which stated "My feeling is that it's 1803 removing them in the background for some reason" but my post above shows that I have a Vista SP2 OS.
My last MB Threat Scan was run yesterday (02-Jul-2018) @ 7:55 AM and when I opened CCleaner Portable v5.44 today (without running a disk clean) I saw that all but my most recent system restore point has been wiped.
I still don't know why my system restore points are disappearing but it could be happening when:
- I run a MB Free v3.5.1-1.0.365 Threat Scan
- I re-boot and launch CCleaner Portable v5.44
- I go to Control Panel | System and Maintenance | System | System Protection | System Restore and cancel the System Restore after double-checking my available restore points.
- Norton QuickScans or some other third-party automatic scan runs in background
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 -
Hi sethm1:
After reading your post I checked and confirmed that all of my system restore points were recently deleted. Note that my system normally retains around 10 restore points and the oldest usually dates back a few weeks.
I'm not sure which program is responsible since I ran both CCleaner Portable 5.44.6575 and a Malwarebytes Free v3.5.1 Threat Scan on 29-Jun-2018 around 4:20 PM, but every restore point created prior to that CCleaner disk clean and subsequent MB Threat Scan was wiped from my system. My MB scan report for 29-Jun-2018 shows there were no threats detected. My Norton Security antivirus automatically runs a background QuickScan each time my SDS (virus) definitions are updated but there's nothing in my Norton security history to indicate that the QuickScan that ran 29-Jun-2018 @ 10:45 AM detected anything.
Control Panel | System and Maintenance | System | System Protection | System Restore confirms I only have those two newer restore points, so it's not the CCleaner anomaly Andavari mentioned <here> regarding corrupted restore points.
I tried running both CCleaner and a MB Threat scan today (with re-boots after each program was run) and neither removed my two recently created restore points so I can't re-create whatever caused the deletion of all my restore points a few days ago. I also had two Norton QuickScans run on 30-Jun-2018 and those QuickScans haven't touched either restore point.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 -
Martin Brinkmann suggested the following workaround today in his ghacks.net article CCleaner 5.44 Comes with Advertising Popups:
Quote"There is no option in the program to disable the advertising popup. In fact, there is no option at all to prevent this kind of behavior.
What you can do is block CCleaner's Internet access. If you disallow the program to connect to the Internet, for example with TinyWall or Windows Firewall Control, it seems that you won't get the advertising popup.
The one downside to this is that you will have to download new versions manually to install them, at least until the July 7 deadline is reached."
I haven't tried this workaround, but my Norton Smart Firewall provides a simple way to prevent access of the CCleaner executable through my firewall at Settings | Firewall | Program Control:
Kudos to bjm_ for posting a link for Martin Brinkmann's ghacks.net article in the Norton Tech Outpost board and confirming <here> that blocking CCleaner's outbound connections should prevent this annoying pop-up ad.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security v22.14.2.13 * CCleaner Portable 5.44.6575 -
1 hour ago, crizal said:
1. If you uninstall the regular free version of CCleaner and replace it with the portable version, are you still subjected to intrusive pop-ups?
2. Does the portable version notify when a new version is available?
Hi crizal:
Sadly, I just unzipped the CCleaner Portable v5.44.6575 on a USB thumb drive and I'm seeing the same obtrusive pop-up ads in my system tray every time I launch CCleaner Portable.
If you go to Options | Settings in CCleaner Portable you can still enable Inform me of updates to CCleaner, but if you are using the portable version then you are likely only plugging in your USB drive and running CCleaner Portable off your thumb drive when you want to run the occasional disk cleanup. If I want to check for updates with CCleaner Portable I just check manually by clicking the Check for Updates link at the the bottom of the GUI.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security v22.14.2.13 * CCleaner Portable 5.44.6575 -
Just an FYI that CCleaner v5.39.6399 was released today (the version history is posted <here>) and installers for the standard version (ccsetup539.exe) and the portable version (ccsetup539.zip) were both posted at http://www.piriform.com/ccleaner/builds.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.3 * NS Premium v22.11.2.7 * CCleaner Free Portable v5.39.6399 -
1 hour ago, Augeas said:
I might be missing something, but is there a path to the builds page anymore? The only way I can find to access it it by typing in the url directly.
Hi Augeas:
The link https://www.piriform.com/ccleaner/builds still redirects me to the correct page with the latest v5.38 portable and slim versions but I can no longer see any mention of the builds page on the main CCleaner download page at https://www.piriform.com/ccleaner/download below the System Requirements section.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1 * CCleaner Free Portable v5.38.6357 -
2 hours ago, moderation said:
why doesn't piriform use virus total to see what needs to be removed and remove anything that comes up as a potential virus or malware? also, is the slim version still available for download?...
Hi moderation:
VirusTotal.com is simply an aggregate web site that uses the scan engines of ~ 60 popular antivirus scan engines (e.g., McAfee, Norton, etc.) and shows the user how many antivirus programs rate the file as "suspicious" (e.g., a VirusTotal rating of 15/60 means 15 scan engines think the file is suspicious, 45 think it is safe).
Before Piriform releases any new installer they run quality assurance tests, add their digital certificate and provide the SHA-256 / MD5 hash (essentially a digital fingerprint of the file) to antivirus companies like McAfee, Norton, etc. so that they can automatically whitelist the installer as a "safe" file prior to its release. The infected 32-bit ccleaner.exe executable for v5.33 was not caught by Piriform during their quality assurance testing and was not initially flagged by any of the ~ 60 antivirus scan engines used on VirusTotal because Piriform incorrectly certified their v5.33 installer was free of malware. Once the embedded Floxif backdoor trojan was discovered the v5.33 installer was removed from the Piriform download servers and antivirus companies were notified that the installer should be blacklisted, and only then did VirusTotal begin flagging the v5.33 files as suspicious/malicious.
In the past it's always been normal for the slim build of any CCleaner installer to be posted at http://www.piriform.com/ccleaner/builds about a week or so after the standard and portable builds are released, but Avast (who recently purchased Piriform) are "testing" a new policy to delay release of the portable build as well - see the discussion in Special's thread where's the portable version?. As Stephen Piriform noted <here>, both the slim and portable builds for v5.38 were just released today.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1 * CCleaner Free Portable v5.38.6357
Piriform Personal Security Concern with CCleaner Latest v. 5.45.6611
in CCleaner
Posted
Hi jagga:
Just a caveat to my previous post. I just read arensky's 28-Jul-2018 post in Cleaner Free 5.45.6611 64 Bit : Active Monitoring Issue and they noted that the problem with the Enabled Active Monitoring setting re-enabling itself after the program is closed only occurs on their machine with the 64-bit CCleaner (ccleaner64.exe) but not with 32-bit CCleaner (ccleaner.exe). Since I tested with the 32-bit version of CCleaner Portable v5.45 I can't guarantee that a 64-bit version of CCleaner Portable v5.45 would behave the same way and leave Enable Active Monitoring (and hence the new "heartbeat" submissions) disabled like my 32-bit version.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * CCleaner Portable 5.45.6611