CCleaner partially disables SpywareBlaster protection of Firefox, redux

[akaArturoK]

I use CCleaner Professional on Windows 10. Searching the forum, I found this problem had occurred a few years ago, but the solution proposed then does not work now. Problem: After several hours of Firefox use, I think CCleaner is unblocking some cookies that SpywareBlaster has blocked. It is notable that the cookies unblocked each time proceed through SpywareBlaster's list alphabetically not randomly, and the alphabetic process continues over system shutdown/reboots. For example, on one day cookie Lop.com(25) gets unblocked and then the next day cookie Lop.com(26) gets unblocked. For me, this has been going on for months and I have eliminated many possible culprits, narrowing down, I think, to CCleaner. Please correct me if wrong. The old solution was to uncheck "Site Preferences" in Firefox's cleaning options. Well, that has never been checked in my installation. Nor is it checked for Firefox (or any other browser) in CCleaner. I am step-by-step disabling CCleaner's automatic executions to see if the problem goes away. Please let me know if there is a known solution. My instinct is that there is a range/boundary error somewhere, but that is just a guess.

[nukecad]

CCleaner does not 'block' or 'allow' anything, it is a junk cleaner and not a security application.
CCleaner removes junk files - temporary files, logfiles, etc. - that are no longer needed by your computer.

The fact that the number added to 'Lop.com' keeps increasing means that it is a the same as an existing file/cookie called 'Lop.com'.
Which indicates that as Spywareblaster is blocking each one LOP keeps creating new ones, (each one with a higher number), which Spywareblaster then blocks again.
So what you are seeing with the increasing numbers is simply Spywareblaster doing it's job properly.

LOP.com , or 'Open Search Web', is malware that is installed on Microsoft Windows.
Basically it's a browser hijacker, and you should remove it from your computer.
Here is a more detailed explanation of what it is:
http://www.pchell.com/support/opensearchweb.shtml

You may not see the hijacked webpage as shown in that article if Spywareblaster is blocking it's cookies.

We cannot give one-to-one malware removal help on this forum, but can direct you elsewhere.
In the case of LOP then, as said in the above article, a scan with Malwarebytes will normally be able to remove it.
You can download Malwarebytes 4 from the official website here: https://www.malwarebytes.com/premium/
The free download is a 14 day trial of the full, real time protection, version, - after 14 days it reverts to 'manual scan only' mode unless you buy a subscription.

You may also want to get your computer fully checked over for free by their malware removal experts,
If you do then start here and follow the instructions carefully: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

[akaArturoK]

Thank you Nukecad. I forgot to mention something that may negate your conclusion. Note that CCleaner does deal with cookies as part of its cleanup routine, and therefore must have access to whatever system-maintained list that SpywareBlaster acts upon. When the behavior I described began, the cookies being unblocked were earlier alphabetically than LOP. The LOP was just an example of the weird behavior that cookies that SpywareBlaster has blacklisted are being unblocked and that ones later in the alphabet are blocked later. No particular cookie is immune as far as I can tell. LOP does not appear actually to be on my system; it's just in SpywareBlaster's blacklist. I am not 100% sure the problem is with CCleaner, though, and I have turned off all automatic cleanings under the Smart Clean settings to see if that is part of the problem. Thank you for mentioning MalwareBytes which I have used for years.

[nukecad]

Again - CCleaner does not 'deal with' cookies other than deleting them if/when you tell it to.

However I think I may have found what could be causing your issue, and you are not the only one seeing this behaviour.

Wilders Security host the 'official' BrightFort/Spywareblaster forum and this thread there is about unprotected cookies suddenly appearing in Spywareblaster:

https://www.wilderssecurity.com/threads/persistent-new-unprotected-cookies-ad-in-firefox-browser.429707/

A reponse there by the BrightFort moderator on 17 June indicates that it seems to be a bug in Firefox itself that is causing the issue, but there has been no update from them since.
 

Quote

There appears to be a bug in the latest version of Firefox. We're investigating to try to determine whether it's just a UI bug, or it impacts behavior, but regardless - it seems fairly easy to get Firefox into a weird state where using its own UI to edit the Cookie Permissions doesn't load any changes you make after a restart of the browser.

Whether the Firefox bug is the only issue impacting what you're seeing, or whether there's also a conflict with another tool (like Spybot) incorrectly messing with the same files (or trying to "clean" profile data), is something that remains to be seen.

So we'll do some more digging on this. If it's something we can work around in SB we'll of course do that, if not we'll reach out to Firefox with a bug report and a proposed patch.

 

[hazelnut]

@akaArturoK

Note there is a new version (Version 6) of Spyware blaster which has just been released.

https://www.wilderssecurity.com/threads/spywareblaster-6-0-released-microsoft-edge-brave-vivaldi-windows-10-and-more.431613/

New in this version:
-Enhanced Windows 10 support
-Microsoft Edge (Chromium) support
-Brave support
-Vivaldi support
-Enhanced Mozilla Firefox support
-Improved high-DPI display support
-Improved support for the latest versions of Google Chrome.
-Improved support for the latest versions of Mozilla Firefox.
-Numerous other bug fixes, optimizations, and tweaks.