CCleaner detected as potentially unwanted by Microsoft Defender

Microsoft’s Windows Defender (aka Microsoft Defender) is currently flagging CCleaner’s free version as a potentially unwanted application (PUA).

Popular system optimization tool CCleaner, developed by Piriform and initially released 16 years ago, is now owned by anti-virus vendor Avast. It is the go-to tool for users looking to delete unwanted files, programs and junk, and fix registry problems But it appears to have ran into some trouble with Microsoft, as the local anti-virus program is now detecting CCleaner’s free version as a potentially unwanted application.

Microsoft has always been critical of system optimization tools, encouraging users to avoid using programs that affect the registry in particular, but until now CCleaner seems to have been in the clear. But it appears that CCleaner’s installation has brought about Microsoft’s displeasure.

CCleaner detected as a PUA

The classification PUA is usually given to programs which are not necessarily harmful but may pose some risk to the computer’s security. Bundled programs often fall into this category because they install without explicit consent. Software bundling is mostly frowned upon by users as well, as the setup process does not properly inform the user about additional programs that will install. Thus, many anti-virus programs detect such programs and recommend users not keep them. And since CCleaner’s free installer comes with additional programs, Microsoft Defender is now detecting it as a PUA.

The installer for CCleaner’s free version comes with additional programs, all of which, it should be noted, are legitimate and safe to use. Bundled programs include Google Chrome, Google Toolbar, Avast Free Antivirus, AVG Antivirus Free. It is common knowledge, and Microsoft itself notes this, that these additional offers are optional. Any added program is visible during CCleaner’s setup, and users can opt out by unchecking a box. But it’s also a known fact that users tend to rush when installing programs and would not necessarily notice these bundled applications.

“While the bundled applications themselves are legitimate, bundling of software, especially products from other providers, can result in unexpected software activity that can negatively impact user experiences. To protect Windows users, Microsoft Defender Antivirus detects CCleaner installers that exhibit this behavior as potentially unwanted applications (PUA),” Microsoft’s malware encyclopedia page for CCleaner explains.

“Our potentially unwanted application protection aims to safeguard user productivity. We detect instances anytime software offers to install other software that is not developed by the same entity or not required for the software to run, no matter the third party,” Microsoft said to BleepingComputer.

When a user tries to install the free version of CCleaner, Microsoft Defender will halt the process to inform that the installer is detected as a PUA. But users are given a choice, either proceed with the installation or halt it. Because the paid version does not come with added programs, it is not detected as a PUA.

Bundling issue reportedly resolved

CCleaner’s Twitter account posted a brief statement explaining that they are in the process of engaging with Microsoft to resolve the issue.

“We surmise the issue appears to be around bundling, and we believe we have addressed this so that our product is now no longer flagged,” the statement reads.

It is yet to be clear how exactly the issue has been resolved, and whether Microsoft will stop detecting CCleaner as a PUA.