I am having a bit of trouble here at the insurance agency i work at, as well as thousands of other insurance agencys. when i run CCleaner it does someting to my screwdrivers client, the program that lets me print from terminal services. i have to reistall it after every CCleaner run. our agency management software, FileServerONLINE, sent out an email to all of its TS clients saying to discontinue using CCleaner. any help would be appreciated!

CCleaner.EXE is recognised (by the most efficient scanner of them all ) as a malware. How come???
I'm using this pearl since long time now and i really wanna know whats going on!

from http://www.sophos.com/virusinfo/analyses/malvbk.html
*************************************************
Mal/VB-K is a family of programs with characteristics typcial of malware.
Members of Mal/VB-K typcially attempt to download and execute code from remote websites.
*************************************************

i thought i should be able to get the right info from you guys before taking action. or should i ask Yahoo!

Respect for a fast reply

Safe

I have the feeling that this beautiful piece of software is going shareware

Please try not to post in other users topics.

Your particular question has been asked already

http://forum.piriform.com/index.php?showtopic=11038


http://forum.piriform.com/index.php?showtopic=11037

Sorry mate!
i'm sorry for my mistake.

Is this when running the cleaner or issues scanner? If possible would you be able to post a screenshot of the items its finding that are causing this to help pinpoint the problem?

(Also what version of CCleaner and Windows?)

We are having the same issue that sev reported back in 07/2007 with C Cleaner removing files needed by the program screwdriversV4 that have to do with Terminal Services.

It took almost a month to figure out that it was indeed C Cleaner that was causing the issue.

It's the Cleaner function that does it. It will do it even though it reports that it has no files to remove (which was determined after very specific testing).

Operating System: Windows XP Pro SP3

C Cleaner Version: Latest Version (to include all previous version for the last year)

Screwdrivers Version: 4.0.16.77 - (to include Screwdrivers versions 2+) Screwdrivers - Data Sheet

The issue occurs every time C Cleaner is ran and requires the user to re-install Screwdrivers to put back the needed Terminal Services files it needs to function.

The issue doesn't effect multiple user accounts on the system, just the account that ran it. In example, if one user runs it under their log (admin) in but other users do not (joe,mark, mary, susan) they don't experience the problem.

In our specific case all the users have administrative rights on the workstations and are members of domain on a windows 2003 RC2 server.

Testing of the issue has shown the following:
That C Cleaner if ran removes everything like it should and then lists nothing to delete because it was just run.
Then if ScrewDrivers is immediately reinstalled and then cleaner function to scan is done it then notes several file entries
[X:\Documents and Settings\userName\Local Settings\Application data\Microsoft\Terminal Server Client\Cache\bchache22.bmc & X:\Windows/system32/wbem/*.log]
Then if you setup exclusions for the "Terminal Server Client" & "wbem" folders so it doesn't dlete them it doesn't show in the list anymore (as it's suppose to)
However, then if you go ahead and run the cleaner function (even though it shows it has nothing to delete) it then still removes unknown files needed by ScrewDrivers to function properly.

I have tried excluding certain things that options are given for to see if they make a difference but it never does (you always have to reinstall ScrewDrivers).

C Cleaner is a great program and I would really like to be able to continue to use it on our work stations. With that said however, we can't if it continues to remove files needed by other programs on the system.

If anyone can tell a way to keep C Cleaner from deleting TSC specific files or a way to change the options to make it stop it would be greatly appreciated!

Hello Mark, and welcome to the forum.


Do you have Custom Files and Folders checked?

Cleaner > Windows > Advanced > Custom Files and Folders.

Heres a link to CCleaners Guide.

Look under Options > Exclude.

Also are you sure you're just running cleaner and not reg? My Terminal services Print (EOL Print yuck) gets eatin if I blindly reg clean (because the stupid programmer left it it default "yourapp" setting the 1d10t.)

I can't think what it would be deleting for screwdriver unless those things are in a temp folder (by the way I doubt that the webm or terminal cache is the place but maybe) Try and do a regshot (http://sourceforge.net/projects/regshot) next time you install and tell it to watch the whole "x" drive (where x is the x in your example above)

Thanks for the reply Fellas :-)

Jamin4U:

The default configuration from install is being used so the Advanced option is not checked.

I reviewed ccleanerbeginnersguide.com when I first started using C Cleaner over a year ago, thanks for the link anyways.

As I mentioned previously in troubleshooting this issue I have tried excluding files and folder based on what C Cleaner reports after doing a cleaning and then re-installing ScrewDrivers but that still doesn't remedy the problem.

Nergal:

I'm positive that the cleaner function is what is causing the issue. I'm the only one who runs the registry function which is done once a month as I'm the only one with enough knowledge to determine what it lists.

Registry clean I'm sure also would mess up screwdrivers but I haven't figured out how to get the Cleaner function from doing it yet to start looking into it.

I haven't been able to determine the files it is deleting that kills ScrewDrivers. The only two that the Cleaner function reports which it wants to remove after reinstalling is the two I already mentioned above. It's got to be removing additional files which is doesn't list because if you don't run it then screwdrivers works flawlessly.

This issue lies on the departments workstations and only effects the users who use RDC to connect to a remote secure server to input data.

I don't have a working test station to trouble shoot this issue. I'll schedule a time with one of the users and run regshot before the Cleaner function is ran (with Screwdrivers working) and then I'll do another snapshot and then post what it reports.

I'm not sure this will tell me anything though unless the Cleaner function actually does some behind the scenes deletion of files and registry (which has to be what is happening).

Further Testing Information Utilizing RegShot

Important Note: I only ran the the cleaner function NOT the registry function!

I took a registry shot of my system before screwdrivers was installed (for the very first time) and then a shot after it was installed and the compare output is listed in the zip file attached in the text file named :
Registry Changes Made When You Install Screwdrivers.txt

After that I ran C Cleaner but it was the first time being ran on the system so it found a gigs worth of stuff which it removed. I did confirm it listed the files I previous mentioned before in the deletion list which are listed below:

Files:
C:\Documents and Settings\marke\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\bcache22.bmc 20.0MB
C:\WINDOWS\system32\wbem\Logs\*.log


The change log between the registry shots was to big due to massive amount of stuff it removed so I repeated the process to get a smaller difference output.

I then reinstalled screwdrivers and took a registry shot again.

Then I ran the cleaner function again (Note: It didn't list the same files I mentioned above though).

Then I took another RegShot immediately after it which compare output is listed in the zip file attached in the text file named:
Difference of registry after c cleaner has been installed and the cleaner function was ran.txt

Upon a quick review of the changes made after C Cleaner's Clean function was ran it confirms it is deleting values/keys in the registry specific to TSC

Keys:
HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client\Default
HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client\Default\Addins
HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client\Default\Addins\SDFXP

Values:
HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client\Default\Addins\SDFXP\Name: "sdrdp5.dll"
HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client\Default\Addins\SDFXP\REMOTECONTROLPERSISTENT: 0x00000000

I have attached the two files mentioned above in a zip file for you to review Nergal.

Exclusion of the folder "Microsoft\Terminal Server Client" in prior testing didn't keep it from breaking ScrewDrivers. It just kept it from reporting the files listed above as marked for deletion.

I wonder if I do a registry HKU exclude for 'HKU\S-1-5-21-2279319253-3448354111-12331638-7142\Software\Microsoft\Terminal Server Client' if it won't break Screwdrivers anymore. I wish I could test it on this machine right now to find out but I can't (ugh!)

I asked if you had it checked because the guide states that it needs to be checked to exclude.

I don't exclude so I can't confirm this. Last night another member said that it doesn't need to be checked for exclude, only for include.

Its up to you if you want to give it a try.

Good Luck!

Thanks for the reply Jamin4u.

Indeed it doesn't need to checked to conduct an exclude. I don't recall the guide saying it but then again I read it thoroughly over a year ago.

I do recall that it needs to be checked for an include which is logical if you are doing any kind of custom include to remove files specific to the system. With that said however, for the purposes it is being used where I am having the issue there isn't any including being done.

I never have even had a need for conducting an exclude until this little problem raised it's ugly head.

Hopefully Negal can review what I posted for him and tell me if he thinks my suggestion just might resolve it.

Hi

I have 30 years experience creating software, and also identifying and fixing colleagues creations.

I suggest a few simple tests should be done by some-one to quickly identify what is going wrong.

DO NOT restart or reboot the computer during these tests.

1. Use CCleaner to purge the old files, and repeat until it finds nothing else to purge.

2. UN-check every option box under both the Windows Tab and the Applications Tab.

3. Close down CCleaner.

4. Install Screwdriver.

NOW Determine at which of the following stages an unfortunate file deletion occurs.
I suggest using Regshot to compare Before and After each stage.
Regshot will show all FILE changes and deletion deletions - most useful for this purpose,
it will also show any registry changes - but these are irrelevant for this purpose.

It MAY be useful to take and store on a different Drive a Snapshot hive / file "IMAGE 1" for subsequent comparison.

A) Launch CCleaner. Did Regshot show an immediate file loss ?

B) Check that all Windows and Application boxes remain unchecked.

C) Use Analyze. Did Regshot show an immediate file loss ?

D) Use "Run Cleaner". Did Regshot show an immediate file loss ?

Check every WINDOWS Tab option you normally use.

E) Use Analyze. If there are files to be cleaned, DO NOT CLEAN. Instead Uncheck the option boxes until Analyze can no longer find anything to clean. Did Regshot show an immediate file loss ?

F) Use "Run Cleaner". Did Regshot show an immediate file loss ?

Check every APPLICATION Tab option you normally use.

G) Use Analyze. If there are files to be cleaned, DO NOT CLEAN. Instead Uncheck the option boxes until Analyze can no longer find anything to clean. Did Regshot show an immediate file loss ?

H) Use "Run Cleaner". Did Regshot show an immediate file loss ?

Now is a good time to take and store a Snapshot hive / file "IMAGE 2", and compare with "IMAGE 1" incase something happened when configuration options were adjusted.

I) Run and then Close Screwdriver. Did Regshot show an immediate file loss ?
(Of course no files can be lost - unless a registry change we were not looking for has told Screwdriver to re-configure with self-destruction consequences.)

Assuming no files have been deleted or otherwise lost, then take a coffee break - you will need it !!!

FOR each and TAB (WINDOWS and APPLICATION) perform the following
{
FOR each and every option box in this TAB perform the following
{
Start Regshot to capture changes that are made :-
Use Analyze and take a screenshot / screendump of all the junk it WILL remove for this particular option;
Use Run Cleaner and take a screenshot / screendump of all the junk it HAS removed for this particular option;
Compare the "WILL remove" with the "HAS removed" lists;
Take second Regshot image to complete the capture of FILE changes made, and compare with the "WILL" and "HAS" lists;
}
NEXT option box
}
NEXT TAB

I said you would need a coffee break !!!

K) Run and then Close Screwdriver Did Regshot show an immediate file loss ?

Did ScrewDriver run correctly, or is it now crippled.

Hopefully you have now identified a particular set of option boxes that cripple screwdriver,
or alternatively you may have encountered some totally unexpected consequence to an innocuous mouse click that should not have deleted anything.

If Screwdriver still runs correctly, then perhaps POTENTIAL damage was inflicted,
e.g. some (deleted) files are only MARKED for deletion, which I believe requires a computer restart,

so NOW is the right time to reboot the computer, and re-test Screwdriver.

Hopefully the above should identify to CCleaner programmers what exactly needs to be fixed,
and will also show screwdriver users which option(s) to avoid until it is fixed.

Regards
Alan

Hi

I believe this thread should have a different title, and that it belongs in a different forum.

I only came here last night because I had 2 minutes to kill, and a "Your daily new posts digest ( Piriform Forums )" email intrigued me with what looked like being a rant about a despotic I.T. director placing an embargo against some Freeware just because he had the authority.

I suggest that a more appropriate forum is "CCleaner Bug Reporting",
and a more suitable title would attract the attention of many more experts,
AND ADDITIONALLY,
it might appear adjacent to other bug reports that have nothing to do with Screwdriver,
but could stem from the same root cause,
and this would automatically speed up the recognition and the correction of the problem.

Sorry, but I was too tired after a hard day, and failed to explain :-

You if you capture a REGSHOT Snapshot hive / file "IMAGE", it can be captured to the C:\,
but I always prefer to use a partition on an external drive to avoid having to remember during subsequent evaluation of various comparisons, that certain new files such as C:\IMAGE_2, C:\IMAGE_3, C:\IMAGE_etcetc do NOT appear as a result of the actions by software under investigation, but are the result of triggering REGSHOT many times between capturing C:\IMAGE_1 and C:\IMAGE_FINAL - it also cuts down some of the changes that System Restore or Comodo Firewall might detect and result in additional changes to the registry - which is more "changes" that REGSHOT faithfully reports, taking you further into the realm of "can't see the trees for the forest"

Regards
ALAN

Alan B:

Thanks for your very detailed outline of continue testing that needs to be done in order to determine the problem.

Unfortunately I only work a few hours each day for the department that has the issue and I have a very long 'to do' list. Thus troubleshooting this particular issue in depth as it requires to resolve it just isn't feasible right now.

With that said it's at the bottom of my low priority issue list though and if I ever get time to pursue it further I will follow what you posted and report back with my findings.

At this point the department will have to just discontinue use of C Cleaner or have to re-install screwdrivers after it is run each time.

I agree that my post should have been made elsewhere as you suggested. However, seeing how it has been posted about by someone else with exactly the same problem I figured it would be better to keep it in topic and post it on the same thread.

I'm going to notify the makers of screwdrivers so they are aware of the problem and hopefully they will log the hours to trouble shoot it further (I doubt it though).

Thanks for your input everyone, C Cleaner is great program and I recommend it (even though it has a problem with ScrewDrivers).

Hello,

I just want to add, that I too ran into this issue with Doris Insurance Systems software. They too use the Screwdriver along Vclient driver. Doris Insurance Systems told me to remove CCleaner from all the workstation and reinstall these two drivers.
Jeff

Mark,
I think you might be right

Sorry I wish this forum had a follow RSS that's why it's been a bit since I answered.

You're exactly the kinda of IT person I wish my friend who worked for Farmers had.

I'm not sure Why it's clearing Reg entries in cleaner :-?

Are you unchecking remote desktop in the applications tab?

EDIT Did testing and this is indeed what's up. In the Applications Tab the "Remote Desktop setting Removes the "HKU\{CENSORED}\Software\Microsoft\Terminal Server Client\Default Registry Folder anything under default is remove as well (and that is the addins that you list in your VERY HELPFUL regshot \Software\Microsoft\Terminal Server Client\Default\Addins)

so go a head and uncheck this mark

________________________________________________________________________________
___________________________________________________________
Developers/Moderators
one thing not removed from this registry and the Plain text Username Hints
HKU\{CENSORED}\Software\Microsoft\Terminal Server Client\UsernameHint

This key contains plain text (for security minded folk) Servers and Usernames and could, only with EXTREME amounts of multiple seperate DNS TS computer usage (such that a tech support might make), fill up.

Nergal

sgniht fo pot no era elpoep nehw ecin m'I eeS