False positive ?

[tommy456 12]

https://www.virustotal.com/gui/file/4171e40d58845cbd4b1506a0f44d0c0dde2e1e05a78398b756d762db33d555b3/detection

 

https://community.ccleaner.com/topic/58108-virus-caught-by-eset-false-positive-from-eset-and-mcafee/

Edited April 29, 2020 by tommy456

[Piano 0]

I had the same report this afternoon. Using CCleaner 5.66.

[Marcos 5,070]

I'd recommend reporting it to Ikarus. The file is not detected by ESET.

[tommy456 12]

But it is  eset deletes it has done several times today , i wouldn't of bothered reporting it otherwise, i have better things to do , i wont bother in future

 

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
29/04/2020 18:24:59;Real-time file system protection;file;C:\Program Files\CCleaner\CCleaner64.exe;Suspicious Object;cleaned by deleting;Asus-PC\Admin;Event occurred on a new file created by the application: E:\INSTALLERS\ccsetup566_slim.exe (B1B114E4D59BE9136EEB46A4C4F057442E7415F7).;4627B9C1B8CC3218121CB358042D35B74B7D496E;27/04/2020 13:07:50

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
29/04/2020 16:08:52;Real-time file system protection;file;C:\Program Files\CCleaner\CCleaner.exe;a variant of Generik.BERVPHT trojan;cleaned by deleting;Asus-PC\Admin;Event occurred on a file modified by the application: E:\INSTALLERS\ccsetup566_slim.exe (B1B114E4D59BE9136EEB46A4C4F057442E7415F7).;C6393C2ABEA0C3EDA4771729D092ED013EF8AD88;27/04/2020 13:07:46

 

Edited April 29, 2020 by tommy456

[itman 1,659]

Also posted here: https://forum.eset.com/topic/23432-latest-ccleaner-false-positive/

[itman 1,659]

According to the CCleaner forum, the issue has been resolved:

Quote

According to VT, the Eset and McAfee false positive flagging that was there an hour ago has now gone. Hopefully this should be reflected...

Recommended by Dave CCleaner

 

Edited April 29, 2020 by itman

[Marcos 5,070]

Should not be detected now:

Log
Scanned disks, folders and files: C:\!test
C:\!test\CCleaner.exe » EMB » Resource[296][0] - is OK
C:\!test\CCleaner64.exe » EMB » Resource[296][0] - is OK

However, we indeed partly detected CCleaner as a potentially unsafe application. This detection is disabled by default.

[Super_Spartan 56]

28 minutes ago, Marcos said:

Should not be detected now:

Log
Scanned disks, folders and files: C:\!test
C:\!test\CCleaner.exe » EMB » Resource[296][0] - is OK
C:\!test\CCleaner64.exe » EMB » Resource[296][0] - is OK

However, we indeed partly detected CCleaner as a potentially unsafe application. This detection is disabled by default.

I updated my virus signature and it's still being detected

 

Detection Engine: 21247 (20200429)
Rapid Response module: 16159 (20200429)
Update module: 1021 (20200218)
Antivirus and antispyware scanner module: 1561 (20200326)
Advanced heuristics module: 1198 (20200316)
Archive support module: 1301 (20200403)
Cleaner module: 1208 (20200319)
Anti-Stealth support module: 1161 (20200306)
ESET SysInspector module: 1276 (20200217)
Translation support module: 1796 (20200421)
HIPS support module: 1388 (20200331)
Internet protection module: 1395 (20200331)
Database module: 1110 (20190827)
Configuration module (39): 1866 (20200401)
LiveGrid communication module: 1061 (20200402)
Specialized cleaner module: 1014 (20200129)
Rootkit detection and cleaning module: 1019 (20170825)
Network protection module: 1682 (20190801)
Script scanner module: 1070 (20200406)
Cryptographic protocol support module: 1042 (20200227)
Deep behavioral inspection support module: 1091 (20200211)
Advanced Machine Learning module: 1058 (20200401)
Telemetry module: 1059 (20200204)
Security Center integration module: 1020.1 (20200313)

 

[Marcos 5,070]

Do you have LiveGrid enabled? Did you scan the files not more than a few minutes ago? If you reboot the machine and re-scan the files, are they still detected as Suspicious object? If so, could you provide SHA1 of the detected files to make sure they are same as those that I have?

[Casca_Longinus 0]

2 hours ago, Piano said:

I had the same report this afternoon. Using CCleaner 5.66.

[KB3503] Special detections?

Just had something pop up from ESET and it deleted my CCleaner. Something about Live Grid.  Um... what?

Sorry, I'm a military guy and have no idea what any of this means exactly. I just know I want to be able to run CC cleaner without ESET automatically deleting it from my PC without my permission. 

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
4/29/2020 2:02:40 PM;Startup scanner;file;c:\program files\ccleaner\ccleaner.exe;Suspicious Object;cleaned by deleting;;;C6393C2ABEA0C3EDA4771729D092ED013EF8AD88;4/27/2020 7:07:46 AM

4/29/2020 2:02:42 PM;Startup scanner;file;c:\program files\ccleaner\ccleaner64.exe;Suspicious Object;cleaned by deleting;;;4627B9C1B8CC3218121CB358042D35B74B7D496E;4/27/2020 7:07:50 AM
 

 

Edited April 29, 2020 by Casca_Longinus

[tommy456 12]

mine just got deleted because of live grid though the log points to the start up scanner

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
29/04/2020 19:59:53;Startup scanner;file;c:\program files\ccleaner\ccleaner64.exe;Suspicious Object;cleaned by deleting;;;4627B9C1B8CC3218121CB358042D35B74B7D496E;27/04/2020 13:07:50

 

[Marcos 5,070]

10 minutes ago, tommy456 said:

mine just got deleted because of live grid though the log points to the start up scanner

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
29/04/2020 19:59:53;Startup scanner;file;c:\program files\ccleaner\ccleaner64.exe;Suspicious Object;cleaned by deleting;;;4627B9C1B8CC3218121CB358042D35B74B7D496E;27/04/2020 13:07:50

 

That's really strange, 19:59 is your local time which I assume is GMT+1, ie. 20:59 CEST. I scanned the files at 20:13 CEST.

If you download the CloudCar test file, is it detected as Suspicious object? http://amtso.eicar.org/cloudcar.exe

[MidoseitoAkage 0]

Now I can't install ccleaner anymore. Like he detect as a suspicious object for not reason. Do something,

Edited April 29, 2020 by MidoseitoAkage

[Marcos 5,070]

1 minute ago, MidoseitoAkage said:

Now I can't install ccleaner anymore. Like he detect as a suspicious object for not reason. Do something,

It was unblocked about 2 hours ago. Is the test file CloudCar on the link above detected?

[MidoseitoAkage 0]

Still, ESET block it for not reason and I can't install the app again because of that.

[tommy456 12]

Yes it's detected i have excluded the  c cleaner file from detection

Edited April 29, 2020 by tommy456

[Marcos 5,070]

Does restarting the machine make a difference?

[MidoseitoAkage 0]

I restart the computer and guess what ? Eset didn't detect Ccleaner as a suspicious objet. In other word, I feel relieved that it no longer detects as a threat.

[Super_Spartan 56]

1 hour ago, Marcos said:

Do you have LiveGrid enabled? Did you scan the files not more than a few minutes ago? If you reboot the machine and re-scan the files, are they still detected as Suspicious object? If so, could you provide SHA1 of the detected files to make sure they are same as those that I have?

I have LiveGrid enabled, it's fine now after a reboot. Thanks.

[MikeyOT 0]

Thank you to everyone who helped clear this up. I am a happy bunny again!

[peteyt 393]

15 hours ago, Marcos said:

Should not be detected now:

Log
Scanned disks, folders and files: C:\!test
C:\!test\CCleaner.exe » EMB » Resource[296][0] - is OK
C:\!test\CCleaner64.exe » EMB » Resource[296][0] - is OK

However, we indeed partly detected CCleaner as a potentially unsafe application. This detection is disabled by default.

I don't use Ccleaner anymore due to past issues and privacy concerns however I noticed on their forum one of the mods mentions it shouldn't be classed as a PUA anymore as for over a year it has stopped adding I believe they said it was a Google toolbar.

Not sure if this is true, if that was the only thing that classed it as a PUA