Author Topic: Avast detects ccleaner as malware  (Read 1284 times)

0 Members and 1 Guest are viewing this topic.

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Avast detects ccleaner as malware
« on: October 22, 2022, 09:09:52 PM »
Ok, this false positive issue is getting beyond ridiculous, since yesterday, avast "detects" the ccleaner 6.05 slim installer as malware. I already reported it using the false positives form and they still haven't fixed it!!!
I am REALLY SICK of avast false positives, but this time it just went too far.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 87447
  • No support PMs thanks
Re: Avast detects ccleaner as malware
« Reply #1 on: October 22, 2022, 09:20:46 PM »
You don't have a screenshot of the Avast alert, which might be helpful to the Avast Team.

Seems strange since ccleaner is in the Avast stable now.  However, using the 'ccleaner 6.05 slim installer' I don't know the source (and you don't say) might not be digitally signed and given what ccleaner does could be considered suspect.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.1.6049 (build 23.1.7883.774) UI 1.0.746/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #2 on: October 23, 2022, 08:46:13 PM »
it is the official installer, downloaded from the official site and digitally signed by piriform.
today, sunday 0ct 24, is still being flagged as "malware-gen"

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #3 on: October 23, 2022, 09:11:59 PM »
Here's the proof of what I'm saying.
(I renamed the file from ccsetup605_slim.exe to ccsetup605.exe, in case you're wondering)

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 87447
  • No support PMs thanks
Re: Avast detects ccleaner as malware
« Reply #4 on: October 23, 2022, 09:25:42 PM »
It is very unusual for a valid digitally signed file to get pinged.

As I mentioned a screenshot (thanks) may provide further information, the reason I suggested this is because of your comment "the ccleaner 6.05 slim installer as malware" the installer could have multiple files within and not just the actually installer.

You don't say how you reported it  ?
If using the - Reporting a Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php link.
Then you should get a response in a day or two.

Changing the file name shouldn't make a difference, if that change doesn't break the digital signing of the file and I don't know if that would be the case or not.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.1.6049 (build 23.1.7883.774) UI 1.0.746/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #5 on: October 23, 2022, 10:33:25 PM »
it is the official installer, downloaded from the official site and digitally signed by piriform.

The CCleaner web site shows 6.04 as the latest version.

September 20, 2022   
CCleaner v6.04       
Improved Health Check

                     
That's the version I got when I downloaded from

https://www.ccleaner.com/

on Oct 23 2022

Are you using a beta version?
« Last Edit: October 23, 2022, 10:38:28 PM by waking »

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #6 on: October 23, 2022, 10:49:23 PM »
MajorGeeks has a CCleaner Slim 6.05 and trying to download it
causes this block from AVG.

Trying to go to the description of that file on MajorGeeks
triggers an alert from Norton Safe web.

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #7 on: October 23, 2022, 11:17:53 PM »
Note that the CCleaner web site shows this:

CCleaner - Download Builds

Optimization and Cleaning

CCleaner Free (v6.04.10044) - Latest official release

Builds below are for system admins and advanced users.
They are not for distribution or mirroring.

CCleaner - Slim

CCleaner - Portable

Downloading CCleaner - Slim from that page on Oct 23 I get

ccsetup604_slim.exe

It downloads with no issues and scans clean with AVG.

So where the 6.05 version on MajorGeeks came from is a mystery.

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #8 on: October 23, 2022, 11:29:40 PM »
6.04 is tha latest version shown in the Version History also:

https://www.ccleaner.com/ccleaner/version-history

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #9 on: October 24, 2022, 12:01:35 AM »
yes, I reported it using the form, no response as of yet.
I know the name doesn't make A difference, I only clarified that I changed the name, but it is the original, unmodified file from the official site.

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #10 on: October 24, 2022, 12:03:37 AM »
Well, maybe they realized that there is a problem with the 6.05 installer and pulled it, but I got it from the official site.

Edit: now they finally fixed it (took them 3 days!!!!), it's no longer being flagged as of Oct 24 (19:05 UTC -3)
« Last Edit: October 24, 2022, 12:07:51 AM by jvidal »

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #11 on: October 24, 2022, 01:15:48 AM »
Interesting. I just tried the download from MajorGeeks again
and while the page says it's "CCleaner Slim 6.05" the download
that starts is version 6.04. And now I get no alerts from AVG
or Norton Safe Web. It looks like someone reverted the download
to 6.04 but didn't alter the title.

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #12 on: October 24, 2022, 02:42:50 AM »
if you want v6.05 use the direct link:

http://download.ccleaner.com/slim/ccsetup605_slim.exe

(which is now AGAIN flagged as "URL: Blacklist" by avast (it wasn't two hours ago)

instead of http://www.piriform.com/ccleaner/download/slim/downloadfile

So, to sum things up, now the File itself is clean, but the URL http://download.ccleaner.com/slim/ccsetup605_slim.exe is not.

Get your facts straight, avast people, for crying out loud!!!!
« Last Edit: October 24, 2022, 02:46:08 AM by jvidal »

Offline waking

  • Jr. Member
  • **
  • Posts: 35
Re: Avast detects ccleaner as malware
« Reply #13 on: October 24, 2022, 04:24:17 AM »
if you want v6.05 use the direct link:

http://download.ccleaner.com/slim/ccsetup605_slim.exe

(which is now AGAIN flagged as "URL: Blacklist" by avast (it wasn't two hours ago)

Yep. AVG blocks it.

Pasting that URL into Virus Total and forcing a rescan to get
the latest results, all (90?) products give it a green (clean)
rating. Sure looks like a false positive, doesn't it?

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Avast detects ccleaner as malware
« Reply #14 on: October 24, 2022, 06:29:01 AM »
avast is notorious for its false positives, I get dozens of those every week.

But the worst part here is that avast is flaggin files and URLs FROM ITS OWN COMPANY as malware. it is beyond absurd