CCleaner corrupting program files [Avira issue]

[AW7]

Hi there,

I've been a happy CCleaner user for many years, but over the past couple of days, CCleaner has been corrupting program files after I've been cleaning out junk files and emptying the recycle bin (a weekly task along with backup). Subsequently, I've not been able to use browsers such as MS Edge, Chrome nor FireFox, and other programs such as MSTeams, LibreOffice...... even CCleaner itself on one occasion, have been left as 'corrupted'. Reinstallation of the applications is necessary. I am running Windows 10. Anyone else had a similar experience? I'm afraid it has rendered CCleaner useless for me and have removed it.

[nukecad]

Not seeing anything like that.

Are you using the registry cleaner?

Did you install the optional update that came out last week?

Or are you even on the Insider Loop? (They just got a preview version of 22H2).

[AW7]

Thanks for the reply. Generally yes, I use the registry cleaner as well, but the last two 'test runs' just using cleaning out junk files still resulted in currupted exe files. I use the latest version, 6.02. I use it on my ole laptop running windows 8.1 with no problem. It may well be that CCleaner is masking another problem, or causing another problem to manifest itself. 

[nukecad]

As you are having problems with multiple unconnected apps then it would tend to indicate that something else is going on.

CCleaner wouldn't touch .exe files, but the Registry Cleaner could mess up a reg entry for one which is why I asked.
It would be highly unusual though for it to mess up a bunch of them at once.
I suggest that you stop using the reg cleaner anyway, it isn't necessary on anything above Windows 7 see the PS below.

Just to be extra sure it's not CCleaner though are you using Health Check or Custom Clean?
Have you used the Driver Updater or Software Updater?

I think your best course is to get your machine checked over, just in case you have malware or a virus.
We are not allowed to do that on here, but we can recommend certain places that will do it for free.

You can get one-to-one help from trained experts at any one of the following sites. Which one you choose is up to you.:

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/
https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-help/
http://www.geekstogo.com/forum/forum/37-virus-spyware-malware-removal/
https://forum.avast.com/index.php?topic=53253.0

They all have experts who specialse malware removal, but will check a computer thoroughly for other problems as well, they will take you through things step-by-step.
Be sure to do what they say and only what they say until they give you the all clear.
Only use one help/removal service at once, trying to use 2 at once will interfere one with the other and they will know.

PS. You shouldn't really use the Registry Cleaner unless you have a problem, see this:

 

 

[AW7]

....thanks once again. Generally, I use custom clean but I have also used Health Check, with the same results. The exe files are obviously tampered with as the corrupted files have the same modified time stamp. I have just run Malwarebytes in safe mode with no detections.

 

If and when I get to the bottom of this I'll post here.

 

Many thanks for your time and advice.

Andy

[nukecad]

1 hour ago, AW7 said:

If and when I get to the bottom of this I'll post here.

That would be interesting to see.

It's a diverse range of apps to be being tampered with, and if something is modifying multiple exe's themselves and at the same times then it is very strange.
(A software updater tool might update more than one at a similar time, though that shouldn't corrupt them).

You have to suspect either a glitch in Windows itself, or possibly malware.

EDIT - I see that you have already posted at Malwarebytes, let them take a look at the logs and see what may be happening.

[AW7]

....everything is stable now. It was the cleaning process that somehow corrupted the files, or at least initiated the problem that led to the files being corrupted. I've run Malwarebytes and Farbar, both of which found nothing, and I've sent the log files on. It's sounding like a windows issue; maybe something a system restore would sort out.

 

More when I hear back from Malwarebytes,

 

A

[hazelnut]

@AW7

I would suggest you run Dism in command prompt. (as admin of course and be online)

Dism /Online /Cleanup-Image /RestoreHealth 
 

And then run System File  Check  afterwards (in cmd as admin)

SFC / scannow

[nukecad]

As AW7 is working with a Malwarebytes expert, and has already sent them logs, he shouldn't realy be doing anything other than what they ask until he gets the all clear from them.

[AW7]

...yes, I'll hang on and see what they say, as much out of curtesy as anything, as I've already contacted them, but I think looking into windows is probably the way forward. 

[nukecad]

I've just sat down in the pub and a thought struck me.

I see you have a uni email.

Is this a university machine, maybe an endpoint on a uni network, and if so  are the affected softwares ones that were installed by the university or using a uni licence?

If it's a network endpoint then CCleaner home version might well be removing some logfile or similar that the uni's servers need to be there to recognise the apps as being valid.

Anyway lets see what MB come up with.

[AW7]

...well no, it's one of these 'email address for life' accounts that I use as a postmaster to hide my personal email address. I left University many centuries ago.

Enjoy the beer! ..... Bluebird?

 

A

[nukecad]

Know what you mean. I use a gmail automatically forwarded to my own domain email address.

I usually drink Sam Smiths Sovereign, but we got a bad barrel in the last delivery and they only deliver over here from Tadcaster every 2 weeks. (The dray horses  get knackered coming through the mountains, LOL).

So it's Worthies (or even John Smiths) until Wednesday or Thursday.

[AW7]

....well, I've heard from MB and there seems to be no evidence of malware. They gave me a few bits of advice regarding browser settings, but I can't see these being an issue as it's not only browsers that are affected. I've run dism as suggested and no issues were reported. So it's all a mystery really. I suppose the next step is to download and install CC again and see if I still have the problem...

[hazelnut]

3 minutes ago, AW7 said:

....well, I've heard from MB and there seems to be no evidence of malware. They gave me a few bits of advice regarding browser settings, but I can't see these being an issue as it's not only browsers that are affected. I've run dism as suggested and no issues were reported. So it's all a mystery really. I suppose the next step is to download and install CC again and see if I still have the problem...

Did you do a System File Check as well?

[AW7]

Yes, 'Windows Resource Protection did not find any integrity violations'. 

[hazelnut]

54 minutes ago, AW7 said:

Yes, 'Windows Resource Protection did not find any integrity violations'. 

Great 

[nukecad]

At least you know for sure that your machine is clean and it's not malware causing the issue.

Obviously if CCleaner was breaking exe's then this forum, and the rest of the web, would be full of complaints.

So  it's difficult to tell just what is going on for you.

I assume you had downloaded CCleaner from the official page, but just in case try downloading a new installer from here: https://www.ccleaner.com/ccleaner/builds
(Many of us use the 'Slim' installer there, it's the same CCleaner but the installer doesn't offer you other softwares).

Other thoughts:
Possibly a failing disc? Have you tried running chkdsk.

You say that all the modified exes show the same modified time stamp.
Can you correlate that time stamp to when something in particular was happening? ie. do they coincide with when you ran CCleaner, or with a Windows Update, or an antivirus scan, or some other event.

Of course if removing CCleaner stops it happening then your quick solution is obvious, stop using CCleaner.
But it would be interesting to know just what the underlying cause was/is.

[hazelnut]

As well as nukecad's suggestions also look at Reliability monitor as that sometimes will show the reason.

Press Windows  start flag and then  immediately type Reliability Monitor and run it. You can click on any warning shown for info.

[AW7]

I've downloaded CC again (the full free version from the website), installed and run a custom clean.......all is fine. My browsers are accessible, no corrupted exe files. It's a total mystery but at least all seems to be well. Could my previous version of CC been corrupted somehow? Anyway, all's fine now. 

I'll keep monitoring the situation and I'll report any more issues....hopefully there won't be any, but thanks for all your help and support. As someone who only uses these things for a living it's nice to know there are friendly experts on hand just a few clicks away.

 

cheers Andy

[nukecad]

Could your previous download have been corrupted?

Not in a way that would affect multiple exe files but nothing else, a corrupted install would almost certainly crash if you tried to run it - unless you got it from a dodgy  site and it had been specifically modified to do so. (Never say never, strange hackers are out there).

Did you carry out any of the steps that AdvancedSetup recommended with the push notifications and cleaning up the Chrome?

He knows his stuff, even if he no longer recommends CCleaner. (That's fair enough it used to be a 'go to' recommendation from those experts but the newer features in CCleaner don't sit well with them).

[AW7]

...no, I've not gone that far. If I was still seeing the problem then that would be my next step, but as I said, at the moment, all seems to be well. The only other thing I've noticed is that the alarms I have set in windows no longer seem to work. I've reset a couple to see what happens.

 

A

[ronster]

Hi all

I'm experiencing the same issues.

After a Custom Clean with CCleaner, some EXE files are corrupted. The files are still there, but the content has been overwritten with spaces. The sizes of the files seems to be the original file sizes of the specific exe file.

It affects many major applications: Excel/Word, VLC Player, Defraggler, ... The list is long. I have to reinstall every single application.

My system: Windows 10 with all updates, Ccleaner latest version (auto-updates). No malware, no virus.

DISM and SFC don't help. The SSD is fully functional, no errors there.

Maybe we can find an explanation for that.

Greetings
Ron

[AW7]

Hmm, interesting. Have you tried uninstalling CCleaner and reinstalling? Seemed to work for me, though I have been advised by Malwarebytes moderators to run Microsoft Safety Scanner.

 

A

[nukecad]

Hi @ronster,

Interesting to see a second report of this very odd behaviour.

I'll flag it up for the staff/developers to take a closer look at.