{"id":15191,"date":"2020-07-30T12:06:21","date_gmt":"2020-07-30T10:06:21","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=15191"},"modified":"2024-10-05T22:59:51","modified_gmt":"2024-10-05T20:59:51","slug":"windows-defender-markiert-ccleaner-als-pup-teil-1","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/07\/30\/windows-defender-markiert-ccleaner-als-pup-teil-1\/","title":{"rendered":"Windows Defender flags CCleaner as PUP &#8211; Part 1"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" height=\"47\" align=\"left\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/2020\/07\/30\/windows-defender-markiert-ccleaner-als-pup-teil-1\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Microsoft's Defender integrated into Windows marks Piriform's CCleaner software as a potentially unwanted program (PUP, Potential Unwanted Program or Potential Unwanted App, PUA).<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg05.met.vgwort.de\/na\/f39ce665c7ea4408b75ea29b29589dbb\" alt=\"\" width=\"1\" height=\"1\" \/>In September 2019, I had mentioned in the German blog post <a href=\"https:\/\/www.borncity.com\/blog\/2019\/09\/25\/microsoft-setzt-den-ccleaner-domain-auf-die-black-list\/\">Microsoft setzt CCleaner-Domain [im MS Answers-Forum] auf die Black-List<\/a> that Microsoft had put Pirifom's optimization and cleaning software CCleaner on the list of unwanted programs. Specifically, the entire domain of Piriform was put on the blacklist. A few days later there was the back rowing when Microsoft removed the entry again..<\/p>\n<h2>They did it again: Defender blocks CCleaner<\/h2>\n<p>Various media have noticed &#8211; Microsoft has once again pulled the rip cord and classified the cleaner as a potentially unwanted program (PUP) via Windows Defender.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">Microsoft Flags CCleaner as Potentially Unwanted Application, Deletes Its Files <a href=\"https:\/\/t.co\/8AdYBIxOkE\">https:\/\/t.co\/8AdYBIxOkE<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/Microsoft?src=hash&amp;ref_src=twsrc%5Etfw\">#Microsoft<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/PUA?src=hash&amp;ref_src=twsrc%5Etfw\">#PUA<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/antivirus?src=hash&amp;ref_src=twsrc%5Etfw\">#antivirus<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/CCleaner?src=hash&amp;ref_src=twsrc%5Etfw\">#CCleaner<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/Avast?src=hash&amp;ref_src=twsrc%5Etfw\">#Avast<\/a><\/p>\n<p>\u2014 Bogdan Popa (@bgdftw) <a href=\"https:\/\/twitter.com\/bgdftw\/status\/1288568447878811648?ref_src=twsrc%5Etfw\">July 29, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On <a href=\"https:\/\/web.archive.org\/web\/20201004182948\/http:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=PUA:Win32\/CCleaner&amp;ThreatID=277099\" target=\"_blank\" rel=\"noopener noreferrer\">this Microsoft page<\/a> there is a note that Windows Defender now detects an unwanted program PUA:Win32\/CCleaner. The reason for this is as follows:<\/p>\n<blockquote><p>Certain installers for free and 14-day trial versions of CCleaner come with bundled applications, including applications that are not required by CCleaner or produced by the same publisher Piriform. While the bundled applications themselves are legitimate, bundling of software, especially products from other providers, can result in unexpected software activity that can negatively impact user experiences. To protect Windows users, Microsoft Defender Antivirus detects CCleaner installers that exhibit this behavior as <a href=\"https:\/\/docs.microsoft.com\/windows\/security\/threat-protection\/intelligence\/criteria#potentially-unwanted-application-pua\" target=\"_blank\" rel=\"noopener noreferrer\">potentially unwanted applications (PUA)<\/a>.<\/p><\/blockquote>\n<p>Martin Brinkhaus of ghacks.net put it in a nutshell in his tweet with the image of the installer: Piriform, which belong to Avast, also deliver the Avast antivirus software in a bundle with the test program.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">CCleaner lagged as potentially unwanted by Windows Defender <a href=\"https:\/\/twitter.com\/hashtag\/ccleaner?src=hash&amp;ref_src=twsrc%5Etfw\">#ccleaner<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/windows?src=hash&amp;ref_src=twsrc%5Etfw\">#windows<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/security?src=hash&amp;ref_src=twsrc%5Etfw\">#security<\/a><a href=\"https:\/\/t.co\/hec6TqtlQc\">https:\/\/t.co\/hec6TqtlQc<\/a> <a href=\"https:\/\/t.co\/edijcBk6aD\">pic.twitter.com\/edijcBk6aD<\/a><\/p>\n<p>\u2014 ghacksnews (@ghacks) <a href=\"https:\/\/twitter.com\/ghacks\/status\/1288705732293140480?ref_src=twsrc%5Etfw\">July 30, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Avast's attempt to bring its free antivirus solution with the Ccleaner to the user community has backfired. Microsoft then also writes:<\/p>\n<blockquote><p>PUA include CCleaner installers that have been found bundling the following applications. Note that these are normal applications that are not detected by Microsoft Defender Antivirus.<\/p>\n<ul>\n<li>Google Chrome<\/li>\n<li>Google Toolbar<\/li>\n<li>Avast Free Antivirus<\/li>\n<li>AVG Antivirus Free<\/li>\n<\/ul>\n<p>While the CCleaner installers do provide an option to opt out, some users can easily inadvertently install these bundled applications.<\/p><\/blockquote>\n<p>So the Google Toolbar and the Chrome browser are also installed with the CCleaner. Bleeping Computer has probably covered the story for the first time in <a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-now-detects-ccleaner-as-a-potentially-unwanted-application\/\" target=\"_blank\" rel=\"noopener noreferrer\">this article<\/a>. There are statements from Microsoft and Piriform. Piriform writes that the free version and Recuva are affected, but not the paid version. Let's see how long this ban lasts.<\/p>\n<h2>Background to the CCleaner<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg06.met.vgwort.de\/na\/b9081da5de6049729a73926d19d56977\" alt=\"\" width=\"1\" height=\"1\" \/>Cleaner is a free tool for cleaning up Windows &#8211; Wikipedia <a href=\"https:\/\/en.wikipedia.org\/wiki\/CCleaner\" target=\"_blank\" rel=\"noopener noreferrer\">writes here<\/a> about 'optimization'. Some hints on what is 'cleaned and optimized' can be found under <a href=\"https:\/\/www.askvg.com\/ccleaner-freeware-system-optimization-and-privacy-tool\/\">Askvg<\/a>. I don't like this part (I've met too many people in forums who have used it to clean their systems to the breaking point) and see CCleaner more as a kind of snake oil (not really necessary, but the tool is very popular among users).<\/p>\n<p><img decoding=\"async\" title=\"CCleaner\" src=\"https:\/\/i.imgur.com\/RUaEuGT.jpg\" alt=\"CCleaner\" \/><br \/>\n(Source: Talos)<\/p>\n<p>In my blog posts about the CCleaner (see link list at the end of the article), I advise you to keep your hands off this tool. But every user makes his own decision.<\/p>\n<p><strong>Similar articles<br \/>\n<\/strong>Chromium edge can prevent PUP downloads<br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/07\/19\/finger-weg-vom-ccleaner-5-59-7230-mit-ccleaner-browser\/\">Update to CCleaner 5.59.7230 installs CCleaner Browser PUP<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2017\/11\/19\/ccleaner-comes-mit-avast-pup\/\">CCleaner comes with AVAST PUP<\/a><br \/>\nPUP: AVIRA adds Aviara Launcher to paid version<a href=\"https:\/\/borncity.com\/win\/2020\/03\/05\/ccleaner-v5-64-7613-released\/\">CCleaner v5.64.7613 released<\/a><\/p>\n<p><a href=\"https:\/\/borncity.com\/win\/2020\/07\/30\/windows-defender-markiert-ccleaner-als-pup-teil-1\/\">Windows Defender flags CCleaner as PUP \u2013 Part 1<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/08\/03\/windows-defender-lscht-windows-hosts-datei-teil-2\/\">Defender flags Windows Hosts file as malicious \u2013 Part 2<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/08\/04\/defender-blocks-redirected-microsoft-hosts-entries-part-3\/\">Defender blocks redirected Microsoft hosts entries \u2013 Part 3<\/a><\/p>\n<p><a href=\"https:\/\/borncity.com\/win\/2017\/09\/18\/ccleaner-has-been-infected-with-malware\/\">CCleaner has been infected with malware<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2017\/11\/19\/ccleaner-comes-mit-avast-pup\/\">CCleaner comes mit AVAST PUP<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2018\/09\/12\/ccleaner-forces-update-from-v5-38-to-v5-46\/\">CCleaner forces update from v5.38 to v5.46<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2018\/08\/02\/avast-ccleaner-5-45-and-the-telemetry-thing\/\">AVAST CCleaner 5.45 and the telemetry thing<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2018\/08\/04\/ccleaner-5-45-pulled-and-other-peculiarities\/\">CCleaner 5.45 pulled and other peculiarities<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2018\/08\/31\/ccleaner-v-5-46-with-improved-data-settings\/\">CCleaner V 5.46 with improved data settings<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2018\/09\/12\/ccleaner-forces-update-from-v5-38-to-v5-46\/\">CCleaner forces update from v5.38 to v5.46<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/01\/21\/ccleaner-v5-52-6967-released\/\">CCleaner v5.52.6967 released<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/07\/19\/finger-weg-vom-ccleaner-5-59-7230-mit-ccleaner-browser\/\">Update to CCleaner 5.59.7230 installs CCleaner Browser PUP<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/08\/11\/ccleaner-v5-60-7307-released\/\">CCleaner v5.60.7307 released<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/03\/05\/ccleaner-v5-64-7613-released\/\">CCleaner v5.64.7613 released<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Microsoft's Defender integrated into Windows marks Piriform's CCleaner software as a potentially unwanted program (PUP, Potential Unwanted Program or Potential Unwanted App, PUA).<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547,2],"tags":[1041,773],"class_list":["post-15191","post","type-post","status-publish","format-standard","hentry","category-security","category-software","category-windows","tag-ccleaner","tag-defender"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/15191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=15191"}],"version-history":[{"count":2,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/15191\/revisions"}],"predecessor-version":[{"id":35902,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/15191\/revisions\/35902"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=15191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=15191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=15191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}