C:\program\ccleaner64.exe issues

[Bigmagic]

Windows 10. I am using the free version of Ccleaner that I use Paypal from time to time to help them with costs.

I have been using Ccleaner for several years with no issues, but in the last 4-5 days, I am getting messages in my notifications in the system tray (9-10 per day) that say:

"Windows Security, Virus & Threat protection, Unauthorized changes blocked."

It appears the blocked folder is;

"\Device\Harddisk0\DR0"

I have done several different scans and I am not finding any type of virus. I am wondering if the program has become corrupt. Perhaps I need to uninstall and reinstall it.

Does anyone have any suggestions?

[nukecad]

I'm not sure why you think this is a CCleaner issue?

Nothing that you say there indicates CCleaner, is there some other information that makes you think that it is?

Obviously something is trying to change something that your Windows security settings say it shouldn't.

Can you screenshot a clip of one of the notifications?

What are the several scans you have already done?

[rpethes]

[nukecad]

There does appear to be something going on with Controlled Folder Access for a very small number of users.

We now have 3 recent reports of similar notifications from CFA, which isn't a lot when you consider the number of CCleaner users that there are around the world but it is still puzzling.

I'll flag it to the staff to see if they can find why this may be happening for just a few users.

As it's only happening for a few users then it may be machine or Windows version/settings specific.

Could you say what make of machine you have and what Windows version/build you are running?

[rpethes]

Windows 10 Pro.  (Home built)

Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz   3.19 GHz

32.0 GB

64-bit operating system, x64-based processor

 

[rpethes]

Can you confirm that my screen shot (above) is indeed caused by CCleaner?  Should I approve this action?  Or could this be viral?

[nukecad]

It's unclear just what is causing some users to get this, or similar, notifications but Controlled Folder Access says/thinks that it is CCleaner64.exe

As only seems to have started recently (although there may be some older related reports)  then it has to be suspected that something had changed with either Windows Defender/Controlled Folder Access or with CCleaner itself.

One question that has been raised as a possible cause - Do you have "Skip User Account Control warning" enabled in CCleaners Advanced settings?
(If so then you could try turning it off to see if that stops the notifications).

It is very unlikely to be malware masquerading as CCleaner. (But of course some malwares do pretend to be genuine apps).
You should run regular scans with Defender or whichever AntiVirus you use anyway, I scan at least weekly with both Defender and Malwarebytes free version.

If you are concerned then I'd suggest temporarily uninstalling CCleaner, and seeing if the notifications stop.
If you still get the notification without CCleaner even being on the machine then it can't be CCleaner triggering it.

[nukecad]

Just to note that I can now replicate this here, and am doing a bit of testing to see if I can find exactly what is causing it.

CCleaner still runs fine for me despite the CFA warning, and TBH I'm not particulary worried about it just a bit puzzled as to why CFA is doing this.

[nukecad]

To add to the above:

This blocking behaviour by Controlled Folder Access is reproducable with every version of CCleaner that I have tried, right back to the 'Sunset' v5.64 for XP/Vista.

So it would definitely appear to be something in the Controlled Folder Access that has changed, and not something in CCleaner.

[Bigmagic]

3 hours ago, nukecad said:

To add to the above:

This blocking behaviour by Controlled Folder Access is reproducible with every version of CCleaner that I have tried, right back to the 'Sunset' v5.64 for XP/Vista.

So it would definitely appear to be something in the Controlled Folder Access that has changed, and not something in CCleaner.

If I go into Windows Security, Ransomware Protection, under; CFA, and the On/Off switch is switched to Off, I do not get the blocked message. If it is turned on then I do get the blocked message.

If the button is switched to Off, what can that do to any ransomware protection that I would otherwise have?

Also, I figured out that this did not start until my last Windows Update. I did a Restore to a point just before that update and the messages stopped. Then I had to restart my computer and those updates automatically reinstalled however, I am not getting the messages but that CFA button is turned off.

And yes, CCleaner works fine even with all of this so no, CCleaner is definitely not the issue.

[nukecad]

Well a restore point was further than I was going to try - but it does point up that it's CFA that has changed and not anything that CCleaner is doing.

As for the question as to whether you should have CFA/Windows Ransomware Protection on or off - it is off by default, you have to turn it on yourself. That says to me that Microsoft know it can frequently be wrong; otherwise it would be on by default.

Think about it logically, ransomware sounds scary  and makes headlimes - but it is targeted at big business not home users. Companies have the money to pay so they are the target.

If you have a backup of your files then you are not bothered about ransomware encrypting them, you simply clear the ransomwate and restore the backup.

But big companies do many transactions in a short space of time and physically their backup systems can"t keep up.