Portable CCleaner is not quite portable

[Alan_B]

SUMMARY

E:\Tools\Piriform\CC-401\CCleaner64.exe v4.1.0.4093 saves text to folder E:\Tools\Piriform\CC-401\

BUT HAS BROKEN

H:\Utils\CCleaner\CCleaner64.exe v3.16.0.1666 which now defaults to saving at

E:\Tools\Piriform\CC-401\ instead of H:\Utils\CCleaner\ which I think was its previous default.

 

I cannot remember the long and convoluted history of what has happened over the years with various Portable CCleaner versions in H:\Utils\CCleaner\

 

E:\Tools\Piriform\CC-401\ was created very recently and version v4.01.4093(64bit) was unzipped there,

and I think its only use was :-

for the creation of the Save to Text file Startup.txt under TOOLS / STARTUP

and under OPTIONS / ADVANCED to play with "Enable Windows Jump List Tasks" and to then Restore default settings.

 

I have now created D:\Test\CC_401\ and again selected E:\Downloads\NewFiles\ccsetup401.zip and double clicked,

and then instructed 7Zip to unzip to D:\Test\CC_401\

I launch this new instance of v4.01.4093(64bit) and Right click the Windows subheading Internet Explorer and select Analyze

It reports 11 files under 4 headings

I right click the 8 file group and select "Save to Text File..."

and it defaults to saving log.txt at E:\Tools\Piriform\CC-401\

(side note - that was dumb - its should have recognised the name was taken)

I click save and as expected it tells me that log.txt already exists and asks

Do you want to replace it?

I click NO

I change the name to log2.txt and again click save

and as expected it saved the file in the wrong folder on the wrong partition, i.e.

E:\Tools\Piriform\CC-401\

 

It seems as if my actions with the first instance of version 4.1 have modified the defaults for the operation of older instances and also the latest instance in another folder.

 

I truly hope that the portable versions are not cross-coupled via the registry.

In the past I have always evaluated the latest version against my personal approved version by Analyzing with one and then with the other,

and then comparing the results side-by-side to see if the new version found anything extra to clean (and if I thought the extra was safe)

 

Regards

Alan

[Andavari]

Possibly something inside of: ccleaner.ini

[Nergal]

please boil this down to a reasonable concise bug report

(pretend I'm 995 years younger than I am and explain this to a first grader )

 

note if this is about default "" location of saved reg files the default is %documents% after that it's last used location

Edited May 26, 2013 by Nergal

[Alan_B]

Very concisely - as is NOT my wont

 

HORROR OF HORRORS - REGISTRY DEPENDENCE CONFIRMATION :-

 

FINAL CONCLUSION :-

 

There is a special registry key/value,

and in its absence Portable CCleaner will Save to Text within the same folder that holds CCleaner.ini,

but in its presence it will instead Save to text to whatever location this registry item designates.

CCleaner version 3.16 never writes to this registry item and therefore this potential defect did not manifest itself.

CCleaner series 4 is a new ball-game and version 4.01 does create and write this registry item and thereby modify the operation of all versions , probably since series 3.

I also think that Skip UAC and possibly Jump List Tasks may be registry dependent.

 

TESTING PROCEDURE :-

 

To avoid influences from past history I did a Quick Format into FAT32 on an old FAT16 Flash Drive F:\

I launched 7ZIP on a fresh download of

E:\Downloads\NewFiles\Drivers\ccsetup401(1).zip

I selected all and unpacked to F:\

I launch F:\CCleaner64.exe and to keep it simple I decline "Intelligent Scan for Cookies"

Under the Windows Tab I right click the topmost heading, "Internet Explorer", and select "Analyze"

I right click on "0.13 MB to be removed. (Approximate size)" and select "Save to text file..."

CCleaner prepares to save log.txt to E:\Tools\Piriform\CC-401\

THAT IS SO WRONG

At this stage F:\CCleaner.ini holds

[Options]

UpdateKey=05/27/2013 09:05:49 AM

I change the name from log.txt to log3.tx and click Save and this produces

E:\Tools\Piriform\CC-401\log3.txt

 

I close CCleaner64.exe

F:\CCleaner.ini now holds

[Options]

UpdateKey=05/27/2013 09:05:49 AM

WINDOW_LEFT=-4

WINDOW_TOP=100

WINDOW_WIDTH=733

WINDOW_HEIGHT=524

WINDOW_MAX=0

 

I launch F:\CCleaner64.exe and this time I Save Text to

F:\log.txt,

and it complies and I close CCleaner64.exe again

F:\CCleaner.ini now holds

[Options]

 

Language=1033

WINDOW_LEFT=182

WINDOW_TOP=65

WINDOW_WIDTH=733

WINDOW_HEIGHT=524

WINDOW_MAX=0

UpdateKey=05/27/2013 10:12:21 AM

 

I launch CMD.EXE and invoke SET and cannot see any system variables that might influence CCleaner

To save time I issue the command

set | find "E:"

My display shows :-

 

C:\Users\Alan>set | find "E:"
TEMP=E:\Test\Temp
TMP=E:\Test\Temp

C:\Users\Alan>

Conclusion :-

 

Something terrible happened with E:\Tools\Piriform\CC-401\CCleaner.exe

and as a result any versions 4.01 and 3.16 were doomed to save text in that folder,

but now save to F:\

 

I launch my long trusted version 3.16 at H:\Utils\CCleaner\CCleaner64.exe and this now also wants to save to text in the destination F:\

I tell it to save to E:\Test\Temp\ and it complies

I close CCleaner.exe and it updates the time stamp on H:\Utils\CCleaner\CCleaner.ini,

but the only change to the INI contents are the WINDOWS_LEFT and WINDOWS_TOP values.

I again launch H:\Utils\CCleaner\CCleaner64.exe and it again defaults to using F:\ as its destination for "save to text..."

proving that version 3.16 does NOT write to the registry but it is influenced by the registry.

 

I retry F:\CCleaner64.exe and it still defaults to saving files at F:\

I retry E:\Tools\Piriform\CC-401\CCleaner64.exe and its default is also now F:\

Hence version 4.01 is not only influenced by the registry, but it also writes to the registry.

(or else there is something more mysterious such as Alternate Data Streams - which I hope to never encounter on a dark night)

 

Supplementary test - I safely removed F:\ and now version 3.16 cannot Save files to F:\ so it quietly (no errors) defaults to correctly using

H:\Utils\CCleaner\

 

N.B.

That rogue instance of E:\Tools\Piriform\CC-401\CCleaner64.exe has NOT been used to clean anything, only to :-

Analyze and save to text

Inspect (but not modify) Startup and save to next

Toggle the Jump List tasks and to then Restore Default Settings.

 

WEIRD ERROR

Version 4.01 did NOT have Skip UAC checked when I first ran it, but after toggling Jump Lists and then clicking the "Restore Default Settings" button it was checked.

Suggesting that "Skip UAC" is possibly influenced by what it finds in the registry instead of the INI file.

 

Incase you are interested, E:\Tools\Piriform\CC-401\log3.txt holds

ANALYSIS COMPLETE - (0.093 secs)

------------------------------------------------------------------------------------------

0.13 MB to be removed. (Approximate size)

------------------------------------------------------------------------------------------

 

Details of files to be deleted (Note: No files have been deleted yet)

------------------------------------------------------------------------------------------

Internet Explorer - Temporary Internet Files 80 KB 8 files

Internet Explorer - History 32 KB 1 files

Internet Explorer - Cookies 1 KB 1 files

Internet Explorer - Index.dat files 16 KB 1 files

------------------------------------------------------------------------------------------

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4IV22TW4\MG_en-gb[1].xml 1 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4IV22TW4\views[1] 4 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9DV488WR\172[1] 1 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9DV488WR\media_guide_16x16[1].png 1 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9DV488WR\mg4_wmp12_30x30_2[1].png 2 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3VMX5TR\AllServices[1].xml 1 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3VMX5TR\WMP47267697-9bd0-4102-a147-d43a73083bed[1]..jpg 71 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RE3HZ7HA\views[1] 2 KB

C:\Users\Alan\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013051620130517\index.dat 32 KB

C:\Users\Alan\AppData\Roaming\Microsoft\Windows\Cookies\HYPGXKW6.txt 1 KB

C:\Users\Alan\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat 16 KB

 

Regards

Alan

[Nergal]

concise that was not, however it did drive me to check the following in your testing method

pre-test can you confirm the existence of portable.dat in your f:\ ccleaner and the lack of existence of ANY registry entries related to ccleaner (it would be worth testing this in a clean VM).

 

Also I'm assuming this is cc free of which we speak

 

[Alan_B]

Yes, it is the Free version running under Windows 7 Ultimate + SP1

 

I confirm that 7zip unpacked onto F:\

Portable.dat

License.txt

CCleaner64.exe

CCleaner.exe

and the Lang folder.

 

I vaguely remember installing CCleaner to test some Bug report about CCleaner.

There may still be an obsolete registry key belonging to CCleaner

 

RegScanner from Nirsoft can find 37 references to CCleaner,

mostly they are Comodo security rules that tell Comodo I trust CCleaner

plus some BAGMUI and MUICACHE

 

and these SkipUAC keys

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{381F69DC-1AC6-4987-87B3-48E2A41E7CA5} Path REG_SZ 27/05/2013 13:18:42 17 \CCleanerSkipUAC
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleanerSkipUAC Id REG_SZ 27/05/2013 13:18:42 39 {381F69DC-1AC6-4987-87B3-48E2A41E7CA5}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleanerSkipUAC Index REG_DWORD 27/05/2013 13:18:42 4 0x00000003 (3) 

 

I am afraid that I am not currently able to set up a VM to test a clean system that has never experienced CCleaner.

 

I am happy to delete any Registry keys that you can tell me of that are used by the installed version of CCleaner, and to then retest.

 

I am very disappointed by CCleaner performing NON-Portable modifications to Windows Tasks and Registry for SkipUAC capability.

I just have zero use for SkipUAC - I never allowed UAC to have any control - it is fully disabled and never gets in my way.

 

I am surprised that Old Portable versions are controlled by registry settings that they have no control over.

I am surprised that Old Portable versions are unable to modify the INI file to remember a change to the "save to text" location

I am surprised that New Portable versions now write to the registry.

 

Regards

Alan

[Nergal]

Alan,are you seriously complaining that

1) you enabled UAC skipping, which is documented that it creates a Task to do this

2) a task is created by this feature which REQUIRES A TASK BE CREATED

 

if that's the only registry you have this is so far from a bug, and the way you presented this, you, personally, would have treated a different poster with a ton of patronization about.

 

Yes features such as skip UAC and (in pro version) Monitoring as well as run at startup will change the stealth of ccleaner (note it's the stealth not the portability which is changed)

 

As far as where to look, again you personally, oughtn't have to ask, but try hkcu\software for piriform or ccleaner hives as well as hklm\software

this thread makes me feel you're taking the ... with us. Yanking our chain as it were

 

Please note in my tests I can not recreate this with 4.01-4.02 Portable (other than of course the making of a task/startup entry when I ask it to)

Edited May 27, 2013 by Nergal

[Winapp2.ini]

My understanding for how portable applications are meant to be is not that they do not interact at all with the systems, but that they do not require installation into the system.

[Nergal]

my favorite definition is

http://www.portablefreeware.com/forums/viewtopic.php?t=1648

Edited May 27, 2013 by Nergal
changed link

[Winapp2.ini]

404 error nergal

[Nergal]

404 error nergal

fixed thanks

[Alan_B]

Alan,are you seriously complaining that

1) you enabled UAC skipping, which is documented that it creates a Task to do this

2) a task is created by this feature which REQUIRES A TASK BE CREATED

NO - I never enabled UAC skipping, nor the Jump List Tasks.

 

The Jump List Tasks was already enabled which 7zip unzipped the code,

and the UACSkip was checked by clicking the "Reset Default Settings",

from which I assume that when SkipUAC capability was added to 3.??? it was probably default for the benefit of the majority,

and when I first noticed this I knew that I had no need for it so I unchecked it,

and that new setting was NOT added to the INI but added to the registry,

and ever since whenever a later version has been unzipped to any folder that later version has used the setting in the registry.

 

As a purist I dislike portable software using the registry, but I have lived with worse and this is NOT the cause of this topic,

just a little grievance that I thought "Save Settings to INI" applied to everything and I am disappointed to find this is false.

 

If I visit a friend and plug in my flash drive to do a little maintenance,

is there a danger that I will find that HIS registry has configured my Portable CCleaner,

and set it to use 35 pass Gutman cleaning because my friend at some time took his computer to a corner shop that used an installed CCleaner and after use un-installed code but not registry keys ?

 

BUT - THIS IS NOT the focus of my topic.

 

As far as where to look, again you personally, oughtn't have to ask, but try hkcu\software for piriform or ccleaner hives as well as hklm\software

 

Please note in my tests I can not recreate this with 4.01-4.02 Portable (other than of course the making of a task/startup entry when I ask it to)

Thanks

I was searching HKCU and HKLM for ccleaner before I started the topic, and I posted only the relevant bits.

 

I thought about Piriform when I was having breakfast, and have found quite a 51 entries,

but none of them are Piriform Keys,

they are all Values where Comodo Keys store rule permissions that record my authorisation and trust of Pirifom tools,

and they only record Folder paths with the name Piriform on my portable software drives - nothing at all on drive C:\

 

I will now test CC 4.02 and report back

 

Regards

Alan

[Alan_B]

CONCISE PROOF OF CONCEPT Portable CCleaner is only semi-portable.

 

I created the folder E:\Test\CC\V1\ and unzipped into this 3 items from ccsetup402.zip

24/05/2013 10:03		 6,154,008 CCleaner64.exe
08/01/2013 07:04			 5,535 License.txt
26/11/2009 14:02			 10 portable.dat

I copy/created duplicates of E:\Test\CC\V1\ as

E:\Test\CC\V2\

E:\Test\CC\V3\

 

I launch E:\Test\CC\V2\CCleaner64.exe

click NO for cookies to keep

Right click the Windows sub-heading "Internet Explorer" and select Analyze

Right click "ANALYSIS COMPLETE - (0.113 secs)" and select "Save to text file..."

Replace destination E:\Test\CC\V1-123456789ABCD\123456789ABCDEF with E:\Test\CC\V2

and click "Save" and log.txt appears under E:\Test\CC\V2

I close CCleaner64 and ccleaner.ini is updated with window coordinates

 

I launch E:\Test\CC\V3\CCleaner64.exe

click NO for cookies to keep

Right click the Windows sub-heading "Internet Explorer" and select Analyze

Right click "ANALYSIS COMPLETE - (0.097 secs)" and select "Save to text file..."

Replace destination E:\Test\CC\V2 with E:\Test\CC\V3

and click "Save" and log.txt appears under E:\Test\CC\V3

I close CCleaner64 and ccleaner.ini is updated with window coordinates

 

I launch E:\Test\CC\V2\CCleaner64.exe

Right click the Windows sub-heading "Internet Explorer" and select Analyze

Right click "ANALYSIS COMPLETE ..." and select "Save to text file..."

The correct destination E:\Test\CC\V2 is forgotten - destroyed by previous Windows environment

Replace destination E:\Test\CC\V3 with E:\Test\CC\V2

and change output from log.txt to log2.txt and click "Save" and log.txt appears under E:\Test\CC\V2

I close CCleaner64 and ccleaner.ini is updated with window coordinates

 

I again launch E:\Test\CC\V2\CCleaner64.exe and find that, as expected "Save to Text" now defaults to using E:\Test\CC\V2\

 

END OF CONCISE PROOF OF CONCEPT

====================================================================================

SUPPLEMENTARY INFORMATION :-

 

The above proves that Portable CCleaner does NOT preserve the default in its own INI file,

but it uses something in the Windows Environment, possibly in the registry.

 

I copy/created a duplicates of E:\Test\CC\V1\ as E:\Test\CC\V1-123456789ABCD\

I created a new folder E:\Test\CC\V1-123456789ABCD\123456789ABCDEF\

 

After disconnecting the router and disabling my entire Comodo security suite to avoid it filling BAGS OF MUI etc.

I used Regshot to monitor the operation of E:\Test\CC\V1-123456789ABCD\CCleaner64.exe as it launched and saved text to

E:\Test\CC\V1-123456789ABCD\123456789ABCDEF\

and then I closed CCleaner and took the second Regshot and compared.

 

Regshot observed :-

----------------------------------

Keys added:4

----------------------------------

HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1433\ComDlg

HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1433\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}

HKU\S-1-5-21-4077350907-178761674-415728870-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1433\ComDlg

HKU\S-1-5-21-4077350907-178761674-415728870-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1433\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}

and

----------------------------------

Files [attributes?] modified:5

----------------------------------

C:\Users\Alan\AppData\Local\Microsoft\Windows\UsrClass.dat

C:\Users\Alan\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1

C:\Users\Alan\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb88c7754c3d58a4.customDestinations-ms

C:\Users\Alan\NTUSER.DAT

C:\Users\Alan\ntuser.dat.LOG1

plus tons of registry values that changed.

 

I copied fb88c7754c3d58a4.customDestinations-ms as fb88c7754c3d58a4 - Copy.customDestinations-ms.txt

It holds very many relevant fragments, such as :-

C C l e a n e r 6 4 . e x e

E_SAM_E E:\Test\CC\V1-123456789ABCD\CCleaner64.exe / A U T O * E : \ T e s t \ C C \ V 1 - 1 2 3 4 5 6 7 8 9 A B C D \ C C l e a n e r 6 4 . e x e q

R u n C C l e a n e r

E_SAM_E E:\Test\CC\V1-123456789ABCD\CCleaner64.exe / O P T I O N S * E : \ T e s t \ C C \ V 1 - 1 2 3 4 5 6 7 8 9 A B C D \ C C l e a n e r 6 4 . e x e e

I saw no evidence of any instance of either "ABCDEF" or "A B C D E F", so this file probably does not hold the log.txt destination, unless ROT13 encryption is used.

 

Nirsoft Regscanner searched for 123456789ABCDEF and found :-

 

28/05/2013 12:54:34 1 REG_BINARY 102 HKCR\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\3\5\7

28/05/2013 12:54:34 1 REG_BINARY 102 HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\3\5\7

28/05/2013 12:54:34 1 REG_BINARY 102 HKU\S-1-5-21-4077350907-178761674-415728870-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\3\5\7

28/05/2013 13:04:13 0 REG_BINARY 421 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

28/05/2013 13:04:13 0 REG_BINARY 421 HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

28/05/2013 13:04:13 15 REG_BINARY 473 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\txt

28/05/2013 13:04:13 15 REG_BINARY 473 HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\txt

28/05/2013 13:04:13 17 REG_BINARY 473 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*

28/05/2013 13:04:13 17 REG_BINARY 473 HKU\S-1-5-21-4077350907-178761674-415728870-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*

 

6 different ...\\ComDlg32\... registry keys hold values that record the log.txt destination,

and if I manually change the registy key contents I may prove this is the key that controls the Save to Text destination - or I might have Windows collapse about my knees.

They are NOT registry keys that are owned by Piriform or CCleaner,

but Windows may have linkages that relate ...\Recent\CustomDestinations\... with registry keys ...\ComDlg32\...

 

It should be noted that :-

The first three keys were created at 28/05/2013 12:54:34 when I used Windows Explorer to create folder 123456789ABCDEF

The last six keys were created at 28/05/2013 13:04:13 when CCleaner was closed and log.txt was created with time stamp ‎28 ‎May ‎2013, ‏‎13:04:13

E:\Test\CC\V1-123456789ABCD\ccleaner.ini was created at 28 ‎May ‎2013, ‏‎12:59:29 and modified when CCleaner closed at ‎28 ‎May ‎2013, ‏‎13:04:23

 

Regards

Alan