<div class="ipsQuote_contents ipsClearfix" data-gramm="false">
<p>
The other thing to note is that all the affected exe files show identical modification time and date stamp,
</p>
</div>
To me that sounds significant.
Thinking 'aloud' - If the exe's were being (extensively) modified then I would expect it to take time to resave them, seconds at least to save each one in the new form so they would/should have different timestamps for the modification(s).
So it sounds to me as if maybe something is being changed in the Windows file system, or the MFT, or ???,
(Which again makes me suspect that Registry Cleaning may be involved/behind it).
....but this happens without registry cleaning, just 'Custom Cleaning'. Actually, also on 'Health Check'. But yes, something happens all at the same time.
Perhaps when you have nothing better to do ( ) you could right click on each individual item in the left-hand column of the Windows tab and select analyse ..right-click on the results panel and save to text file.. and then right-click again on the item and select clean.
<div class="ipsQuote_contents ipsClearfix" data-gramm="false">
<p>
I guess that this would be only for the items that I have checked, right?
</p>
</div>
Just another thought about the timestamps - how is your system clock in general? (I'm thinking about the CMOS battery).
PS. while Hazelnut's suggestion should help to narrow down just what section of the cleaning is causing the issue, (if you clean only one section at a time and then check the exes after each one to see if they have been modified), you'll be a good man if you do that testing knowing it will probably mean having to reinstall the affected exes again.
Well I think the clock is ok. How can I check? It sync's with Microsoft every day, doesn't it? But interesting that you mention clocks. I have found that I've had to reset my alarms...I have two or three go off during the day. They were still set in the 'clock' app but I had to save them all again to make them work. And now I see a message in the app that says 'Alarms will sound only when your PC is awake'...with a link to 'Change power settings'.......weird
I've saved all the installation files rather than have to hunt them down again so it's not too big a problem. The irritating thing would be to go through all the testing and nothing happens. But I'll try and make some time in the morning. It would be good to get to the bottom of this.
<div class="ipsQuote_contents ipsClearfix" data-gramm="false">
<p>
<span style="color: rgb( var(--theme-text_color) );"> (if you clean only one section at a time and then check the exes after each one to see if they have been modified), </span>
</p>
</div>
Not a section at a time... I mean each individual box AW7 has ticked
Hmm, interesting observation of Avira, Mind you, my affected exes aren't running.....part from Chrome, and I guess MSEdge in the background. Anyway, I'd better get on with my tests....
Right, I've gone through all the ticked items in turn, analysing and cleaning each with no problem at all. All the programs that were previously affected by custom clean are still functioning, as far as I can tell. I checked the ticked items under the 'Windows' and 'Applications' tab.
That's often the way it goes with testing, what you are looking to replicate doesn't happen.
It does indicate that either:
It isn't CCleaner that is causing the problem.
There's some weird cash between 2 or more of CCleaner's functions, that doesn't show up if you run them alone.
The problem is a intermittent one. (which are always a PITA to track down because they don't happen everytime).
I suppose the next step if you are up for it would be to run CCleaner as normal and see what happens.
(Again you run the risk of having to reinstall your exes again if they do get scrambled).
PS. Nice to have someone who is prepared to do a bit of testing to try and find what is going on, even if we don't seem to be any nearer yet.
I'm also wondering if something that you did as a result of working with AdvancedSetup at Malwarebytes has cleared whatever it was?
I know you didn't do that much, but maybe one of the tools used did something?
No, I didn't do much with AdvancedSetup, just ran a couple more malware hunting programs. Nothing was found. I'll carry on with CC as usual, and maybe take a little more notice of what I do and when, just in case.....
That's about all that you can do if the isue isn't showing anymore.
It is only 3 out of millions of CCleaner users who are reporting this happening, and one of those was for "a friend".
It would be nice to know what it was, but you/we may never discover that.
(We are always a bit cautious with 'me too' type posts, on investigation they are often not the same at all).
Of course all 3 of you could each be seeing something different happening that just sounds/looks a bit similar, and caused by something else but you only notice it after running CC.
You might be surprised how often that happens too.
The most common example is that many people have a corrupted Recycle Bin, but because it doesn't really cause a problem in use they only notice it when they run CCleaner and notice that the contents of the bin keeps growing even though Windows says it's empty. It's a bug in Windows that has been there since XP.
Thanks for all the help so far. Maybe I can provide some more information, even if we don't know exactly what the problem is and whether it's caused by CCleaner at all.
I have logged the cleaning process using the Process Monitor App. All recently used exe files were emptied again while doing a Custom Clean. The changes can be quickly found via Windows Search (see screenshot modified_exe_files.png). As an example, I picked the DropboxThumbnailGenerator.exe file from the Process Monitor log to track the changes. This resulted in the following image (see screenshot proc_mon.png).
The process was like this:
- 20:24: CCleaner (V. 6.02.9938 64bit) was loaded and I started an analysis (Analyze button)
- 20:25: I started the Custom Clean
- Between 20:30 and 20:34 the temporary files were processed and deleted by CCleaner
- 20:30: Finally, the DropboxThumbnailGenerator.exe file has been modified
- 20:34: The cleaning process finished
According to the Process Monitor log, the original DropboxThumbnailGenerator.exe file appears to have been emptied via the System Prozess (ID: 4) immediately before CCleaner handled the temporary DropboxThumbnailGenerator.exe file (sentry_temp). I selected 3 erase cycles which can be seen from the log.
The Process Monitor does not seem to correctly display this probable connection with Avira (since Avira is considered to be deeply embedded in the system and probably redirects certain things). CCleaner would certainly never create or rewrite an exe file.