CCleaner Browser suddenly appeared on my system

[unknwn]

So about two days ago suddenly I noticed CCleaner Browser appeared on my taskbar and has set itself as the default browser. CCleaner has been installed on my machine since 18/06/20 according to the install date and never ever have I accepted nor have I actively activated it to be installed. Why does this happen? I have been using CCleaner way back since 2004, but seeing it is now sneaking in Software without my approval or knowledge is a little bit alarming to say the least.

[nukecad]

Quote

Why does this happen?

The Browser has probably been installed when you installed/re-installed the new CCleaner version.

Just set whatever browser you normally use to be the default again. (And uninstall the CCleaner browser if you don't want it).

Although you may not believe it, you probably asked for the browser by mistake not realising that it was being offered.

There are a couple of ways I know of that can happen without you realising that you have asked for the Browser to install.

The first is from the CCleaner download page - when, in some browsers notably Firefox, you see an arrow 'tag' bouncing up and down in the top right corner saying 'Click here to install'.
If you try to click on that arrow itself you could hit the advertising banner underneath it and get taken to the download page for the Browser.
If you weren't paying attention you could think you were still downloading CCleaner and so click the download button there.

 

The second way it can happen is an occasional bug in the standard installer.
The standard installer shows you an 'offer' for another Piriform/Avast product with big blue 'Accept' and 'Decline' buttons, very occasionally the image for the offer doesn't load and you just see the two buttons - if you then click 'Accept' you will get whatever should have been showing as offered. (You should click 'Decline', but of course you have to know about the bug).
I've seen it happen a few times myself, and saw it again last Friday, I've told the staff that it's still happening occasionally.

 

 

[unknwn]

Like I have said I installed it a little over a year ago and just now the browser showed up. Actually I noticed it as I wanted to debug a project in Visual Studio, was still a bit sleepy but thought to myself this browser is not the correct one. So definitely not just installed and there is no way I cannot have seen it during that year. So you are 100% sure there is no way it could have installed it by itself?

[nukecad]

I'd never say 100% sure of anything like that.

One thing that I will note is that if you installed CCleaner a year ago and hadn't been updating it then it WILL have force updated itself.
This has been going on gradually for a couple of months to make sure that everyone who can be is up to date (Win XP/Vista have to stay on old versions): https://support.piriform.com/hc/en-us/articles/360052107891-Why-have-I-been-updated-to-CCleaner-v5-74-#why-have-i-been-updated-to-a-newer-version-of-ccleaner--0-0

We have had previous reports of the Browser 'installing itself'. (I've had a search and the last one I can find before yours was from January).

However when investigated it's usually been one of the above two causes, or likely that the user has clicked through something on a webpage (or a pop-up?) quickly without reading and accepted the Browser as an offer that way.

If it was something that happened regularly, without user intervention (mistake?), then we would see a lot more such reports.

CCleaner does have a habit of offering things in pop-ups, (which often annoys some users).

It can be annoying to get something you didn't want (I once got Chrome browser installed by not paying attention to what I was clicking).
It's easy enough to reset your default browser and uninstall the CCleaner Browser.

[nukecad]

That was timely, I was just doing some testing and uninstalled/reinstalled CCleaner.

I realise that you say you hadn't installed again yourself, but this may help show others how it could happen.

This is the offer screen that I was refering to above.
You can see that if the graphic was missing (as it is in my screenshot above) and you just clicked 'Accept' without seeing what you were Accepting then you would get the browser, and it would set itself as default because you couldn't see that little tickbox to untick it.

[RobLive]

Same here, neither have I reinstalled ccleaner, installed a new version or agreed to anything that is related to ccleaner. The browser just appeared in the taskbar 2 weeks ago.

The handling with the consumer on such a sensitive program and topic on the computer is extremely questionable!

[Dave CCleaner]

There's a bit in this thread to respond to - so please bear with me while I try to cover them all.

CCleaner Browser can only be installed on your system in one of two ways:

• A user goes to https://www.ccleaner.com/ccleaner/browser (via one of a variety of methods), reads about CCleaner Browser, and clicks through to download and install.
• Clicking on "Accept" in an installer or post-update offer.

CCleaner and its automatic updates absolutely do not sideload anything.  For free users, there may be an large-format offer appearing after the update (for CCleaner Browser or something else) but this has to be "Accept"ed in order for anything to happen.

@nukecad's strange-looking swirly loading screen where the offer graphic doesn't appear, but only the Accept/Decline buttons, is an exceptionally rare bug, but one that QA has finally been able to reproduce after torturing some test machines.  It has been confirmed that due to the different rendering methods involved, this does not impact the offers presented after an automatic update, but only for new installs and manual updates where a fresh installer is downloaded.  Even though the offers display properly for 99.9% of users, that's still thousands of users every week on whom we are not making the best first impression (since in the absence of other information, malice will always be assumed) and we are looking at getting this 100% bulletproofed in an upcoming release.

On 21/06/2021 at 08:01, nukecad said:

when you see an arrow 'tag' bouncing up and down in the top right corner saying 'Click here to install' that's actually to install the Browser refered to in the banner across the page.

By way of correction, note that the bouncing arrow on the CCleaner download page is actually pointing to the CCleaner installer that you just downloaded so that you can open it from your browser downloads status bar.  In some browsers this will be pointing to bottom left of your window:

Although in Firefox, recent downloads are kept in the top right instead:

This may lead to some confusion for Firefox users as to what exactly they are being prompted to click on, but note that inadvertently clicking on that CCleaner Browser banner will not actually download anything.  If you hover over it, you will see that it actually points to the CCleaner Browser product information page https://www.ccleaner.com/ccleaner/browser.

 

Back to @unknwn and @RobLive: from your description of events, if you have been running an old version of CCleaner (sounds like CC5.67 or earlier?) without any updates that would have brought you to an offer then it sounds like CCleaner Browser may have been installed quite some time ago, never used, and then "woken up" by its own patch update system - although that would not explain why it would suddenly become the default browser.

If you still have CCleaner Browser installed, could I trouble you for some followup information please?

If you go to to the three dots in the top right, Help and About CCleaner Browser > About CCleaner Browser (or just jump straight to secure://settings/help) and pull up "Diagnostic Information", and copy out the browser_version and uid information for me, we may be able to sleuth what happened for you.

 

 

 

[nukecad]

Thanks @Dave CCleaner

I fully accept your correction about the 'bouncing arrow' when downloading CCleaner, and have edited the post accordingly.

I was going from the following which I have observed in the past (I've now tested it some more):
In Firefox if you are late in clicking on the arrow tag, or click where it has just bounced from, then you actually click the Browser banner and get taken to the page to download the browser.
(You don't actually have to click the blue 'Download Free' button in that banner, it's a graphic and not an actual button and clicking anywhere on the banner will take you to the browser dowload page - maybe that could be changed to an actual button).
The unobservant may then think they are still downloading CCleaner and so click the green 'Free Download' button for the browser as well.
Admittedly though that still shouldn't install the browser, just download the installer.

Can I aslo point out that that arrow can have another glitch in Firefox; if the menubar has had other add-on icons loaded.

As you can see here, on my Firefox it's pointing to Malwarebytes Browser Guard rather than the download icon.
(If I didn't have the Browser Guard add-on it would be pointing at AdBlock).

[unknwn]

@Dave CCleaner No I have uninstalled it same with ccleaner. I did make a memory dump of ccleaner with WinDbg and exported the assembly code and gonna check over the weekend if it sided loaded anything.

Sorry but it's very strange to me how an application would be dormant for over a year and suddenly pops to live. I keep my pc very clean and only have a handful of stuff installed for work. Check my installed applications on a weekly basis to track what is installed and what can be removed. For example SDK's I no longer need. Besides that I only have Visual Studio and Visual Studio Code and Chrome installed on this machine. Literally only a development machine.