Just recently we uninstalled ccleaner from a few machines. Watching traffic on our firewall, I am seeing two requests for ccupdate10.cab from the machines which we uninstalled cccleaner from. I'm 99.9% certain that this is a file that ccleaner requests. Why is this file still being requested? When looking for piriform traces, I am finding pfBL.dll in our temp directories.
dont have lightroom or illustrator. What is concerning is finding the pfBL.dll in the temp directory. When looking at the file it says piriform. Also these requests are only coming from two machines . If I reinstall ccleaner on another machine Im 99.9% sure I see it requesting ccupdate10.cab
just did a wireshark and the requested URL is /tools/ccleaner/update/ccupdate10.cab @ akaami. ccleaner is uninstalled per the uninstaller. so something is going on.
Yes requests are being made, even though all Piriform products are uninstalled Here is an imgur link to the wireshark'd traffic https://imgur.com/a/BzdMm5P
Doing more research, disabling Background Intelligent Transfer Service, stops this from happening. Some job from ccleaner is stuck in BITS is my guess right now
More research. Finding the below powershell command. Feel confident I found the problem. Note we DONT HAVE AVAST/AVG installed
Searched the c: drive for CCupdate.exe, no hits. There is no schedule task, as when I disabled scheduled tasks, the job still ran. Cleaning out the BITS entries has resolved the issue.
CCleaner uninstall DOES NOT remove these entries from the BITS client. In addition when looking at the user that created AvEmUpdate BITS task, I came across one created by a standard user and another create by nt authority . What I am doing for now, is stopping the BITS service and removing the qmgr files. This removes EVERYTHING from the BITS service and stops this from happening. It is concerning that we found this and now we are searching our entire network for this condition.