Jump to content
CCleaner Community Forums
Dave_Munday

CCleaner64 and Norton SONAR

Recommended Posts

I have used Norton Internet Security and CCleaner FREE for some years without problems.  I use secure 3-pass cleaning on CCleaner.  


Since updating CCleaner64.exe to v5.25.5902 (64-bit) I have received several SONAR responses that I suspected were FALSE POSITIVES.  These occurred on 23/12/2016 @ 10:24, 25/12/2016 @ 11:20, 25/12/2016 @ 22:30, 01/01/2017 @ 17:28, 02/01/2017 @ 14:10, 04/01/2017 @ 20:40 and 06/01/2017 @ 13:01 (all times GMT).  No Threat name was shown.  Subsequent running of CCleaner did not result in a SONAR report.


However, today (07/01/2017 @ 15:28) SONAR reported CCleaner64.exe again (see attached file) but showed the Threat name of "SONAR.cryptlk.AF!g12", a member of the cryptolocker family.  I noticed that SONAR responded whilst checking Google Chrome's cookies.  A subsequent run of CCleaner did not result in a SONAR report.


I have checked my computer and cleared all cookies from Chrome and Firefox, which I also use.  SONAR indicates that CCleaner64 contains malware.  I have also advised Norton of this report. 


 


post-78033-0-62414700-1483809092_thumb.png

Share this post


Link to post
Share on other sites

and in the meantime, add it to Nortons as an exclusion.

Share this post


Link to post
Share on other sites

  1. As stated in my original post, this has been reported as a potential False Positive to Norton.

I shall not add it as a Norton exclusion until I am assured that it is a False Positive.

Share this post


Link to post
Share on other sites

all-righty then.

no sweat, we probably thought you were after help but you must simply have been letting us know Norton's wasn't playing nicely with your CC.

Share this post


Link to post
Share on other sites

Prompt response from Norton's False Positive team.

 

"Our investigation shows that the software you submitted is known-good and as such does not trigger any detections ... A possible reason for this could be that the status of your software changed automatically between the time of your submission and now ... Please note that whitelisting can take up to 24 hours to take effect."

Share this post


Link to post
Share on other sites

Today 1-10-17, while running CCleaner Pro, I got the threat warning from Norton Security (for the first time).  Norton blocked "SONAR.cryptlk.AF!g12" in ccleaner64.exe as Serious Threat.  Based on Dave's post, I'm going to Allow it.

 

Win10 Pro 1607; CCleaner Pro 5.25.5902; Norton Security 22.8.1.14.

 

Thx, ChasBob

Share this post


Link to post
Share on other sites

Whilst Norton state that this is a known-good program, they are still investigating the cause of the SONAR report as several users have reported and continue to report the same issue; myself included.

Share this post


Link to post
Share on other sites

This problem appears to be resolved.  Ensure that your software (Norton LiveUpdate, CCleaner, etc.) is up-to-date.  CCleaner should not need to be added to Norton's list of exclusions.  Any further SONAR reports should be reported to Norton.

 

Blobbycat.  SONAR is Norton's heuristic and behavioural detector used to detect zero day exploits.  Gold star to Norton for detecting the issue and for resolving it!

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...