Can't delete a stubborn registry value for CCleaner

[peter petersen]

I have uninstalled CCleaner, but take a look at the following key in the Windows 10-registry:
KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications

One of the subvalues is:
C:\Program Files\CCleaner\CCleaner64.exe
To delete that value is impossible.
Why does the uninstalled CCleaner leave it in the registry, og how do I get rid of it?
 

Edited August 19, 2020 by peter petersen

[nukecad]

The Defender registry entries will be protected so that malware can't alter/delete them.

'Controlled Folder Access' in Defender has always been a bit of a PITA.

When they first brought it out you couldn't even save anything unless you were using a Microsoft app (ie. Office).
Took me a few hours to work out why my (not Microsoft) word processor wouldn't save anything, I eventually worked out it was because the defender CFA wouldn't let it delete the previous .bak file to make a new one.

It looks like that registry entry is saying that CCleaner is one of the (not Microsoft) apps that is allowed to save and/or delete things.
It will be Windows that is keeping it there as an 'Allowed application'. It knows you have once had CCleaner installed so has added it to the allow list.

If you no longer have CCleaner the reg entry will maybe/probably be removed in the next Windows feature update? ( or maybe next Patch Tuesday?).
But maybe not - Microsoft programmers work in mysterious ways.

[peter petersen]

Thank you for the information.

[Andavari]

Windows Defender or possibly you allowed it as an allowed exception.

If you really want it gone off your system such as you have no plans to ever use CCleaner again open Windows Defender, and go into:
1. Virus & threat protection
2. Manage ransomware protection
3. Allow an app through Controlled folder access
4. Delete the offending file from the list (it should be in there). Done.

Note:
Don't remove anything that looks like it's built into Windows from the list such as chkdsk.exe, etc.

[peter petersen]

Thank you - now it's gone!