F.Secure Safe blocks Ccleaner

kirppi

I've been wondering why F-S is blocking Ccleaner when starting pc. Is there some reason?

Ukko

Hello,

 

Sorry for my reply. I'm also only F-Secure user (their home solutions).

 

I did use recent CCleaner but not with its autorun (or so). With such experience -> F-Secure did not block it (during launch CCleaner for use it manually). I will try to re-check with one of my systems about other configurations (later).

Maybe it is good to explain a little be more -> does there visible any F-Secure prompts (or under ""rightclick F-Secure tray-picture ->> "Recent events" under visible tray-menu ->> Strings about block-event) with detection-name or explanation words (reason for block)?

 

Additionally, there was such story:

https://community.f-secure.com/t5/F-Secure-SAFE/CCleaner-5-33-carried-malware/m-p/99043

 

So, it is good to re-check that your experience is about up-to-date CCleaner and is not about trouble-build (as example).

 

Thanks!

kirppi

Thank you for your reply.

Yes, I can find all those blockings in the list. Blocking started in the end of december. Looks like F-S is classifying Ccleaner as a PUA. Propably it's best not to use it anymore.

Have a nice day!

 

Ukko

Hello,

 

Sorry for my large reply!

 

Not sure that it is expected situation that CCleaner is marked as PUA (at least, with common meanings).

There is F-Secure Policy about PUA. And with your experience -> detection may be something like false positive detection (at least, with already installed CCleaner).

---

I tried next steps with one of my systems (with installed F-Secure SAFE beta/technology-preview):

>> Downloaded CCleaner installer from their piriform website.

>> I installed CCleaner (5.39.6399) with their default settings and configuration.

>> Restarted system (Windows 7 32bit);

>> And... I did not receive any prompts about block.

 

So, maybe your experience with specific additions (or with certain system; or with certain CCleaner build or so). Also, if it is possible to manage such events in the list -> so, maybe possible to see which executable is blocked and then transfer it to F-Secure Labs with description about (detection-name/situation). Then -> F-Secure Labs with abilities to doublecheck it and to create some advices.

 

Additionally, I think that it is OK to use it (both) further too. With meanings that it is good to use F-Secure SAFE (even if some false-positive detections are there). It is possible to use F-Secure SAS as steps to inform F-Secure Labs. 

Or otherwise it is still can be OK to use CCleaner (if needed). Except some of potential points and meanings. For example, I still use it with some of systems (recent and up-to-date CCleaner builds)

---

Thanks!