Hi all
Version 3.08 of CCleaner...
If I select "Tools | Startup" the following files are added to the root of drive C:.... "ntuser.dat" and "ntuser.dat.LOG"
This is not a big issue, and the files can be deleted. The issue started with this version of CCleaner.
Windows XP 32 bit, Service Pack 3
I was not able to replicate this issue using Windows 7 SP1 64bit
Tools => Startup is heavily involve in the Registry.
"ntuser.dat" and "ntuser.dat.LOG" are updated either before or after a shut-down reboot,
and also when you do "heavy lifting" in the registry.
I do not think they belong in the root of C:\ unless you have a very strange place for your User Profile.
I was not able to replicate this issue using Windows 7 SP1 64bit
On Windows 7 SP1 64bit work correctly.
It 'possible to use %temp% instead of C:\Temp
on
Include1 = PATH | C: \ Temp \ |*.*| RECURSE
Tools => Startup is heavily involve in the Registry.
"ntuser.dat" and "ntuser.dat.LOG" are updated either before or after a shut-down reboot,
and also when you do "heavy lifting" in the registry.
I do not think they belong in the root of C:\ unless you have a very strange place for your User Profile.
My user profile has not been touched since Windows install, and is in the default place for XP.
I simply delete the 2 files.
Confirmed on Windows XP! I have no idea what CCleaner is trying to do here...
35 15:23:19 CCleaner.exe:876 OpenKey HKU SUCCESS Access: 0x2000000
36 15:23:19 CCleaner.exe:876 OpenKey HKCU SUCCESS Access: 0x20019
37 15:23:19 CCleaner.exe:876 CloseKey HKCU SUCCESS
...
95 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
96 15:23:19 CCleaner.exe:876 CloseKey HKCU SUCCESS
97 15:23:19 CCleaner.exe:876 CreateKey HKLM\system\currentcontrolset\control\hivelist SUCCESS Access: 0x2001F
98 15:23:19 CCleaner.exe:876 SetValue HKCU SUCCESS "\Device\HarddiskVolume1\ntuser.dat"
99 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SUCCESS \\??\C:\ntuser.dat
100 15:23:19 CCleaner.exe:876 OpenKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment SUCCESS Access: 0x20019
101 15:23:19 CCleaner.exe:876 QueryKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment SUCCESS Subkeys = 0
...
149 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
150 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
151 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
152 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
...
157 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
158 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
159 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
160 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
...
193 15:23:19 CCleaner.exe:876 OpenKey HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg NOT FOUND
194 15:23:19 CCleaner.exe:876 OpenKey HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder NOT FOUND
195 15:23:19 CCleaner.exe:876 OpenKey HKLM\system\currentcontrolset\control\hivelist SUCCESS Access: 0x2001F
196 15:23:19 CCleaner.exe:876 DeleteValueKey HKCU SUCCESS
197 15:23:19 CCleaner.exe:876 UnloadKey ? SUCCESS
But, I am pretty sure it is failing terribly.
This intrigues me.
I am no expert on the registry but my unqualified thoughts are below.
35 15:23:19 CCleaner.exe:876 OpenKey HKU SUCCESS Access: 0x200000036 15:23:19 CCleaner.exe:876 OpenKey HKCU SUCCESS Access: 0x20019
37 15:23:19 CCleaner.exe:876 CloseKey HKCU SUCCESS
...
95 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
96 15:23:19 CCleaner.exe:876 CloseKey HKCU SUCCESS
A key, or is it the whole Hive, is opened and closed, then it cannot be found, and then it can be closed again.
That smells like XP make random and different decisions for the same action on the same item.
Permissions Issues "Big Style"
97 15:23:19 CCleaner.exe:876 CreateKey HKLM\system\currentcontrolset\control\hivelist SUCCESS Access: 0x2001F
98 15:23:19 CCleaner.exe:876 SetValue HKCU SUCCESS "\Device\HarddiskVolume1\ntuser.dat"
99 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SUCCESS \\??\C:\ntuser.dat
I do not know why but CreateKey has resulted in creating C:\ntuser.dat
149 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
150 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
151 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
152 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
...
157 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
158 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
159 15:23:19 CCleaner.exe:876 OpenKey HKCU NOT FOUND
160 15:23:19 CCleaner.exe:876 LoadKey ? ?Z??`?7?d SHARING VIOLATION \\??\C:\ntuser.dat
...
HKCU cannot be found when trying to open
C:\ntuser.dat has a SHARING VIOLATION.
My guess is that CCleaner expects C:\ntuser.dat to be a consequence of
CreateKey HKLM\system\currentcontrolset\control\hivelist
and afterwards it tries to delete what should have been a temporary file, and fails to succeed.
Permissions Issues "Big Style" ! ! !
My guess is inevitably that Windows Patch updates could be guilty.
It would be informative if the previous version of CCleaner was loaded and used,
and to see if it too now results in an unwanted C:\ntuser.dat.
This will demonstrate whether the latest version of CCleaner is doing something different,
or if it is a change in the system it is running on.
Hi all,
just wished to report: this issue also happened with me after playing around with CCleaner portable 3.8.0.1475.
Long after being done with CCleaner, I stumbled upon ntuser.dat and ntuser.dat.log (which seem to be truncated files) - but in my case these were located on the root of my E:\ drive, and not on C:\ as others have reported. Both files were promptly deleted without issues.
The folder where CCleaner is running from happens to be located under E:\ drive.
Cheers