Menu Close

Microsoft Explains Why Windows Defender is classifying CCleaner Installer as PUA

Apparently, Windows Defender in Windows 10 is classifying CCleaner Installer as Potentially Unwanted Application (PUA). And Windows 10 is locking other Piriform product installers such as Recuva, Defraggler, and Speccy from running. Microsoft has come up with an explanation of why it has flagged popular Cleaning tool as “PUA: Win32/CCleaner”.

CCleaner users rushed to report on Piriform forums that Windows Defender is reporting CCleaner as Potentially Unwanted App. You should note that the newly available PUA Protection feature in Windows 10 2004 enabled by default is causing this. The issue can also be seen reported on Reddit.

As of now, we can confirm CCleaner can be installed without any issues on Windows 10, but you’ll still see it being marked as PUA in Protection History.

On the other side, Windows Defender acts more aggressively on other products of Avast. If you download Speccy, Recuva, and Defraggler, their setup files will be locked but not removed, and you’ll receive an error:

” Windows cannot access the specified device, path, or file.  You may not have appropriate permission to access them”.

Microsoft said “bundling of software, especially products from other providers, can result in unexpected software activity that can negatively impact the user experiences. To protect Windows users, Microsoft Defender Antivirus detects CCleaner installers that exhibit this behavior as potentially unwanted applications (PUA)”.

For instance, it cites CCleaner bundling with Avast antivirus may disable Microsoft Defender Antivirus if the user opts into installation accidentally.

The company says CCleaner instalers use a Nullsoft plugin to offer different products during installation and comes bundled with following applications:

  • Google Toolbar,
  • Google Chrome
  • Avast Free Antivirus
  • AVG Free Antivirus

Microsoft reports how CCleaner installer with Nullsoft plugin offers unwanted applications.

This CCleaner installer uses a Nullsoft plugin to download a file named Microstub.exe from When it is launched, it provides a preselected option to install Avast Free Antivirus.

Some installers for the free version of CCleaner, also based on Nullsoft, include an installer for Google Chrome with the file name PF-Chrome-2019.exe. After installing Google Chrome, the installer sets the bundled application as the default web browser. Some variants of the same installer also add the Google Toolbar to Chrome as an extension.

The software giant says “exercise caution when installing software to avoid unwanted applications that came bundled with the installer”.

Read Original Article…