Dave_Munday

This problem appears to be resolved. Ensure that your software (Norton LiveUpdate, CCleaner, etc.) is up-to-date. CCleaner should not need to be added to Norton's list of exclusions. Any further SONAR reports should be reported to Norton. Blobbycat. SONAR is Norton's heuristic and behavioural detector used to detect zero day exploits. Gold star to Norton for detecting the issue and for resolving it!

Whilst Norton state that this is a known-good program, they are still investigating the cause of the SONAR report as several users have reported and continue to report the same issue; myself included.

Prompt response from Norton's False Positive team. "Our investigation shows that the software you submitted is known-good and as such does not trigger any detections ... A possible reason for this could be that the status of your software changed automatically between the time of your submission and now ... Please note that whitelisting can take up to 24 hours to take effect."

As stated in my original post, this has been reported as a potential False Positive to Norton. I shall not add it as a Norton exclusion until I am assured that it is a False Positive.

I have used Norton Internet Security and CCleaner FREE for some years without problems. I use secure 3-pass cleaning on CCleaner. Since updating CCleaner64.exe to v5.25.5902 (64-bit) I have received several SONAR responses that I suspected were FALSE POSITIVES. These occurred on 23/12/2016 @ 10:24, 25/12/2016 @ 11:20, 25/12/2016 @ 22:30, 01/01/2017 @ 17:28, 02/01/2017 @ 14:10, 04/01/2017 @ 20:40 and 06/01/2017 @ 13:01 (all times GMT). No Threat name was shown. Subsequent running of CCleaner did not result in a SONAR report. However, today (07/01/2017 @ 15:28) SONAR reported CCleaner64.exe again (see attached file) but showed the Threat name of "SONAR.cryptlk.AF!g12", a member of the cryptolocker family. I noticed that SONAR responded whilst checking Google Chrome's cookies. A subsequent run of CCleaner did not result in a SONAR report. I have checked my computer and cleared all cookies from Chrome and Firefox, which I also use. SONAR indicates that CCleaner64 contains malware. I have also advised Norton of this report.