CCleaner corrupting program files [Avira issue]

[Guest Andrei CCleaner]

Heya @ronster, please email our team at support@ccleaner.com so they could have a look over your current situation.

[AW7]

I'm very eager to hear any outcomes from this. All is stable for me now, but I'm still finding apps that no longer work, all modified at the same date and time last week when I ran CCleaner.

 

A

[ronster]

Hello everyone

The problems persist. I uninstalled and freshly installed CCleaner (version 6.02.9938). Then I did a custom clean. The result was that again many recently executed EXE files were modified (even the CCleaner.exe ). The files were changed when the program was deleting temporary files. Again, these EXE files were overwritten with all-spaces.

I was able to recover all the files because I had a fresh backup of my computer.

I emailed support as requested by Andrei and I'm excited to see how it goes (probably after the weekend).

Best regards
Ron

[nukecad]

It is very strange.

The fact that only the two of you, out of millions of CCleaner users, are seeing this is puzzling and an indication that there must be something different about, or installed on, your particular machines.

Once support have had a look specifically at your CCleaner for you then you may want to do as AW7 did and have an expert check your machine over for possible malware or other issues.
See the posts above for where to get that done for free.

[AW7]

I've just had a popup saying that defender has blocked some features of msedge.exe.exe on the network. Not sure what this is but it doesn't look good. I've sent a message to malwarebytes too

[nukecad]

A double ".exe.exe" like that always looks suspicious, as if something is trying to make you think it's the original app.

(It may just be Microsoft though, there a few mentions on the web about that particular popup and it may be related to an Edge update)???

I assume that you have PM'd AdvancedSetup to reopen your topic at Malwarebytes.

[AW7]

...yes I did straightaway. I thought you might be interested also, just in case it's relevant. Interesting that you mention an Edge update. I don't use Edge, but I did notice that it was using a lot of CPU on startup. I opened Edge and it mentioned that I was 'using the new version'. Looking again, it gives the version as 104.0.1293.47, and sure enough, there us an Edge subfolder with that name and today's date.

 

A

[Oreo]

Hey all, just came here to say I experienced the same thing. I've had to reinstall countless programs since last using CCleaner. They seemed to have been modified/corrupted when it was ran yesterday. This seems to have corrupted recently accessed programs. I've been able to recover mostly everything it's just a pain to have to reinstall programs again.

 

I'm using version 6.02.9938

Edited August 10, 2022 by Oreo

[nukecad]

Hi @Oreo

I've flagged your report up to the Piriform staff.

You may also want to email support@ccleaner.com about it as well, give them a link to this thread if you do.

[Oreo]

1 hour ago, nukecad said:

Hi @Oreo

I've flagged your report up to the Piriform staff.

You may also want to email support@ccleaner.com about it as well, give them a link to this thread if you do.

Just wanted to follow up. Another person I work with also experienced the same issue this morning.

[AW7]

Hmm, it's getting interesting. The latest from my side is that investigating the msedge.exe.exe issue has drawn a blank. The system seems to be clean and the only thing left is a clean install of windows.....which I feel reluctant to do. Just out of interest, what machine are you both using? I have problems on my HP Pavilion desktop

A

[nukecad]

11 hours ago, AW7 said:

 Just out of interest, what machine are you both using? I have problems on my HP Pavilion desktop

What machines and Windows versions (and antivirus) you are using may help to give a clue as to what may be going on, Especially if they all turn out to be the same.

That's usually the start of investigating something like this, and would be interesting to know to see if there is a 'quick' direction to start looking.

Other questions then come to mind, such as are your affected apps installed on C: or on another drive.
Then there's the questions of what other softwares you are all using, and the thousands of settings that could have been changed in Windows itself or other apps.
But once you get into those it all starts to get too detailed to follow on a forum, so it's usually best to work with support

[AW7]

Yeah, a bit like a needle in a haystack but as more of a user of computers rather than an expert it feels like some sort of conflict going on.

Right, my Desktop PC is HP Pavilion 24-a205na, i5-7400T

Windows 10 Home (preinstalled), up to date.

Avira Security (free version)

Malwarebytes (free version.....you see a trend here ;) )

All affected apps are installed on my C drive - SanDisk 128GB SSD. Nothing on my D drive (1TB generic SCSI HDD) seems to have been touched. There again, most apps end up on C: by default.

 

Affected programs,

Edge, Chrome, Firefox (never IE)

MS Word, Excel, PowerPoint, Teams

LibreOffice, OpenOffice

ExamDiff, Inkscape, Notepad++, DiffPdf

Pandat (software that I use for work) This requires the use of a HASP dongle.

That's all I remember now. I have had one trouble-free run with CC since the problems started.....I've parked it for now but it still runs in the background.

The other thing to note is that all the affected exe files show identical modification time and date stamp, presumably the time that I ran CC. I should also say that running CC on my old Acer laptop running Win8.1 has caused me no grief at all. Again, I probably won't run CC again until you/we find out what's going on.

Hope all this helps,

A

 

[hazelnut]

When you have CCleaner open and are going to do a custom clean, what do you have selected under the Windows tab at the top under.. System and.. Advanced?

[AW7]

...attached. All advanced settings unchecked.

[nukecad]

23 minutes ago, AW7 said:

The other thing to note is that all the affected exe files show identical modification time and date stamp, 

To me that sounds significant.

Thinking 'aloud' - If the exe's were being (extensively) modified then I would expect it to take time to resave them, seconds at least to save each one in the new form so they would/should have different timestamps for the modification(s).
So it sounds to me as if maybe something is being changed in the Windows file system, or the MFT, or ???,
(Which again makes me suspect that Registry Cleaning may be involved/behind it).

[AW7]

....but this happens without registry cleaning, just 'Custom Cleaning'. Actually, also on 'Health Check'. But yes, something happens all at the same time.

[hazelnut]

Perhaps when you have nothing better to do (  ) you could right click on each individual item in the left-hand column of the Windows tab and select analyse ..right-click on the results panel and save to text file.. and then right-click again on the item and select clean.

Then check your exe files.

[AW7]

I guess that this would be only for the items that I have checked, right? I'll see if I can find a bit of time in the morning.

[hazelnut]

2 minutes ago, AW7 said:

I guess that this would be only for the items that I have checked, right? 

Correct.

[nukecad]

Just another thought about the timestamps - how is your system clock in general? (I'm thinking about the CMOS battery).

PS. while Hazelnut's suggestion should help to narrow down just what section of the cleaning is causing the issue, (if you clean only one section at a time and then check the exes after each one to see if they have been modified), you'll be a good man if you do that testing knowing it will probably mean having to reinstall the affected exes again.

[AW7]

Well I think the clock is ok. How can I check? It sync's with Microsoft every day, doesn't it? But interesting that you mention clocks. I have found that I've had to reset my alarms...I have two or three go off during the day. They were still set in the 'clock' app but I had to save them all again to make them work. And now I see a message in the app that says 'Alarms will sound only when your PC is awake'...with a link to 'Change power settings'.......weird

I've saved all the installation files rather than have to hunt them down again so it's not too big a problem. The irritating thing would be to go through all the testing and nothing happens. But I'll try and make some time in the morning. It would be good to get to the bottom of this.

A

[hazelnut]

1 hour ago, nukecad said:

  (if you clean only one section at a time and then check the exes after each one to see if they have been modified), 

Not a section at a time... I mean each individual box AW7 has ticked

[AW7]

Sure. Should I do 'Applications' too?

[hazelnut]

13 minutes ago, AW7 said:

Sure. Should I do 'Applications' too?

If you get no results on Windows tab (I'm trying to save your brain here !!)