Microsoft is now detecting the popular CCleaner Windows optimization and Registry cleaner program as a potentially unwanted application (PUA) in Microsoft Defender.
In 2019, Microsoft temporarily banned CCleaner on the Microsoft Community forums that caused links to the program to be censored when posted.
This ban was due to Microsoft’s general stance that Registry cleaners and system optimizers can do more harm than good on Windows systems.
Microsoft now detects CCleaner as a PUA
In a new threat entry added today to the Microsoft Security Intelligence site, Microsoft is now classifying CCleaner as a PUA:Win32/CCleaner threat.
This page does not provide any information as to why Microsoft is now classifying CCleaner as a PUP/PUA, but Microsoft has stated that they do not support Registry cleaners and that they should not be used.
“Some products such as registry cleaning utilities suggest that the registry needs regular maintenance or cleaning. However, serious issues can occur when you modify the registry incorrectly using these types of utilities. These issues might require users to reinstall the operating system due to instability. Microsoft cannot guarantee that these problems can be solved without a reinstallation of the Operating System as the extent of the changes made by registry cleaning utilities varies from application to application,” Microsoft states in a support bulletin from 2018.
Furthermore, Microsoft’s evaluation criteria state that displaying “misleading” or “inaccurate” claims about files and registry entries would cause a program to fall under the classification of a potentially unwanted program.
Software must not mislead or coerce you into making decisions about your device. This is considered behavior that limits your choices. In addition to the previous list, software that exhibits lack of choice might:
- Display exaggerated claims about your device’s health.
- Make misleading or inaccurate claims about files, registry entries, or other items on your device.
- Display claims in an alarming manner about your device’s health and require payment or certain actions in exchange for fixing the purported issues.
Microsoft has told BleepingComputer that this detection is only targeting the free version as it includes bundled “offers” for other software.
“Our potentially unwanted application protection aims to safeguard user productivity. We detect instances anytime software offers to install other software that is not developed by the same entity or not required for the software to run, no matter the third party,” Microsoft explained in a statement to BleepingComputer.
Piriform on the other hand has told BleepingComputer that they believe this is a false positive and trying to work with Microsoft to remove the detection.
“We discovered this classification on Tuesday, after reports from our customers of difficulties installing CCleaner with Windows Defender. We believe this is a “false positive” – we are in discussions with Microsoft and expect a resolution to this matter soon”
“We have noted that Windows Defender seems to be classifying the free version of CCleaner as “Potentially Unwanted Software” but not the paid versions. Also this classification does not seem to be due to any recent changes at our end, since Windows Defender is also flagging other Piriform software such as Recuva (which has not been updated for a while) in the same fashion.”
“It would also seem odd to describe Recuva – free file recovery software that a user would need to go to the effort of discovering on our website and downloading – as “potentially unwanted,” David Peterson, General Manager CCleaner, told BleepingComputer.