CCleaner and HIPS

[TomFace 539]

I went to install the latest version of CCleaner Slim 5.26 (from the CCleaner builds page) and got his HIPS notification. First time I ever got it (I do the same routine every time for CCleaner). I am using Win 7, ESS 10.0.386.0 HIPS is in Smart mode. All other HIPS settings are in default. Should I be seeing this?

 

Edited January 23, 2017 by TomFace

[itman 1,659]

Is this the portable ver. of CCleaner?

[TomFace 539]

No it's the "slim" version, installer, no toolbar (http://www.piriform.com/ccleaner/builds) .

[cyberhash 188]

I have the standard version 5.26.5937 installed and i don't have that reference in my registry (AutoConfigURL).

Quick google search shows a few references to browser hijacks. Maybe trying to force advertising in your browser  ???



 

[Marcos 5,074]

The operation reads "Delete from registry" so it might be ok. Not sure if it will be possible to confine asking for an action only for write attempts to that registry key in Smart HIPS mode, we'll see.

[TomFace 539]

I also posted the same question over at the Piriform Forum. They're checking on their end.

[ronnie 0]

I found that most Piriform products come with unwanted programs. If you open them it gives you the choice of accepting the unwanted programs or not just a matter of unticking the 2 boxes.

If you try some of their other products you will find the same problem with those as well.

I find that Eset is one of the few security programs that picks it up and warns you about it.

So well done Eset.

[itman 1,659]

CCleaner does have a few suspect aspects; at least the past versions I used did. One is hidden Internet connections using explorer.exe.

I believe that last time I used CCleaner, I received a similar registry modification alert from Emsisoft Antimalware that I was using at the time. And, this was generated from the portable version. I just blocked the activity with no adverse effects to CCleaner as best as I could determine.

[TomFace 539]

8 hours ago, ronnie said:

I found that most Piriform products come with unwanted programs. If you open them it gives you the choice of accepting the unwanted programs or not just a matter of unticking the 2 boxes.

If you try some of their other products you will find the same problem with those as well.

I find that Eset is one of the few security programs that picks it up and warns you about it.

So well done Eset.

There have been numerous discussions about CCleaner here in the past (few years) concerning the "unwanteds" and I do not believe the Slim version has what you refer to

. As I previously stated, this has never occurred before to me (at least in the past 4 years). This issue has now been referred to the developers at Piriform.

itman: Yes I did block the request and it (CCleaner) does seems to be functioning normally.

 

Edited January 24, 2017 by TomFace