Avast antivirus installations from CCleaner installer

[nukecad]

Quote

Note from Piriform: We are actively seeking information from anyone who has had this issue. Please click here for further details.

--

First to say that in general I have no problem with bundled software offerings.
Bundled software is a way for developers to possibly make a bit of money to support their free products.

Normally my reaction to 'installed xxxx without my permission' type threads is 'well be more careful'.

But-

I have noticed that the new Avast/Chrome offering with CCleaner now appears to be using a sneaky tactic, which in my opinion is not acceptable.

The issue I have noticed is that the bundled offering in the CCleaner installer does not appear onscreen for a full 2 seconds after the install button is available.

This delay appears to be 'built in' - which is the problem.

If you are a quick worker then you could easily click the install button before the pre-selected offering is even on screen.

I can't decompile the installer to see if this is intentional, (but there was never this delay previously).

I had time on my hands and so tried some testing. On my laptop I have CC installers going back to v5.25.
(I don't have 533setup, for obvious reasons, and 534setup was blocked by the Security Centre).
The test was-

• Shutdown/Restart
• Run the CCsetup installer version
• Note the time for the bundled offer to appear
• Close the installer
• Restart and repeat for the previous installer version

The restart is needed because it's only the first run of the installer in each session that shows the delay.

Results
ccsetup532 and earlier showed between no delay and about 1/2 second delay to display the offering.
All installers since ccsetup535 showed 2 second plus delay to display the offering.
(Including todays re-issued 538 installer, which was about solving delays).

 

Whether this bundle offer delay is intentional or a result of changes made after the malware issues I'm not judging.

But having the install button available to click for a full 2 seconds before the pre-selected offer is even visible smacks of a PUM tactic.
(Some might go as far as saying a malware tactic).

Ok, you know the delay is there now, and not to click install until you can untick the offering.
But you only have to forget once, or be in a rush, and then you'll get an unwanted install of Avast/Chrome/google toolbar.
Or, dread the thought, the built in delay gets 'extended', so you think the offer is not coming.

PS. The 'not if you have already refused the offer in the last xyz days' seems to have been turned off as well, I had noticed that I'm getting it offered with every monthly update.

And yes, of course I know about the slim and portable builds, but that's not the point here.

It would be interesting if someone has time to repeat my tests to confirm/refute my findings.
For info. I'm on Windows 10 Home, v1709, build 16299.125

[Andavari]

6 minutes ago, nukecad said:

(but there was never this delay previously)

There was a delay before with the 3rd party Google offers, and supposedly they had to fix something in the installer if I'm remembering correctly. Although months (maybe it was years) after the fix some people still would get an unwanted Google software installation. It's the reason I've trained myself to not just click through any installer's anymore, I let them sit on screen up to 2 minutes even with trusted software because you can't even trust that.

If it's some form of delay rather that be intentional or not I haven't a clue as Piriform has never answered any public forum question about that in particular to my knowledge. However it's gone on long enough in the past with unwanted Google installations (and people claiming they'll never use CCleaner again because of it), so it's up to people to make their own minds up on what's actually going on -- even if we're told otherwise.

[nukecad]

Agreed, but it was my 'feeling' that the longer delay in displaying the bundle was a fairly recent (re)development.

Which is why I did that testing with the installer versions I had to hand, to check if it wasreal or just a subjective impression.
The result of that testing does seem to point to some change being made between v532 and v535.

Whether that's due to changes after the malware incident, or a deliberate change by Avast/Piriform I'm not judging (yet).

And there will always be those who just blithely click install without reading what offer is on their screen.

But if I was the developer I would be putting efforts into making sure that this delay did not happen.
(Simply change the code so that the install button is the last thing to load onscreen?)
After all, if the delay isn't there then you can't be suspected/accused of doing it deliberately.

[DennisD]

I've mentioned this delay (before the appearance of the option to opt out) a number of times over a number of years, and I can't see any legitimate reason for this to be still happening, so come to your own conclusions.

I've was caught out by it myself a number of years ago, which is the first time I kicked up about it. By not sorting this out the company aren't doing themselves any favours.

[Guest Stephen CCleaner]

This is not something we have seen internally. If you are experiencing this delay, we would appreciate some information so we can address the issue. If you would like to help, please do the following:

1. Restart your computer
2. Give your PC a couple of minutes to reach a 'resting state' after the restart
3. Run the installer, wait for the 'Install' button to appear and count the number of seconds between this point and when any offer appears.
4. Go to https://speedtest.net and run a test
5. Click on 'Result ID' and copy the URL
6. Post the following information here in the thread:

• Delay from 'Install' button appearing to offer appearing: e.g. "2 seconds"
• Offer shown: e.g. "Avast", "Chrome"
• Speedtest result: e.g. "https://www.speedtest.net/result/6899610942"
• What version of Windows: e.g. "Windows 10"
• Windows version info: e.g. "v1709, build 16299.125"
• Windows system architecture: e.g. "32-bit", "64-bit"
• CPU type and speed: e.g. "AMD Athlon II X4 640 Processor (4 CPUs), ~3.0GHz"
• Memory: e.g. "4096MB RAM"
• Antivirus solution: e.g. "Windows Defender", "Avira"

If enough of you do this, we will begin to see a pattern and we can get to the solution.

[nukecad]

As I started this thread then I'll go first.

Restarted, made sure everything had settled down (checked all was quiet in Task Manager).
Opened file explorer, let things settle down again.
Launched ccsetup538.exe (revised version 14/12/2017).

From install button showing to offfer showing (Chrome) was 2.5 seconds. (Stopwatch).

Speedtest.net results: Date 12/22/2017 2:41 PM GMT, Download 2.31 Mbps, Upload 1.01 Mbps, Latency 27 Ms, Server Distance ~50 mi

Windows 10 Home, v1709, build 16299.125, 64 bit.
Intel Celeron CPU N2840 @2.16GHz (Overclocks to 2.58).
4 GB RAM.
Windows Defender. Malwarebytes Anti Exploit stand alone is also running real time.

 

EDIT.
Because you asked for the speedtest I decided to run the test again after a restart, but this time switched the lapop to 'Flight Mode' to disable the web connection before running the installer.
Still got the 2+ second  delay in displaying the offer.

I'll relocate to a faster broadband connection and try again.

EDIT2

OK tried again but with a fibre BB connection this time.

Same 2.5 second lag from install button to offer being displayed.

Speedtest.net results: Date 12/22/2017 3:30 PM GMT, Download 54.40 Mbps, Upload 16.14 Mbps, Latency 34 Ms, Server Distance ~200 mi

All other specs the same as above. (Same laptop).

 

So that would seem to rule out the connection speed as a cause.

Any other testing/ logs you would like then please give a shout.

 

[nukecad]

C'mon guys and gals, especially the regulars here-

10- 15 minutes of your time to do Stephens test and give some feedback on this.

If nothing else it will show/disprove that there is in fact an issue.

And will also show whether the moans about unwanted installs may in fact currently be justified.
I, for one, am less inclined to say someone getting an unwanted install should have been more careful when it may be a programming issue.

[mta]

in Stephen's post (#5 - don't you love how we have to count them now we have no post numbering), all those steps can (should be) easily done in-house.
jump on a few employee PC's at Piriform and Avast offices and test it.

it's not a good look to have users do this.
there are already a few reporting and testing the issue and confirming there is a concern.

[Andavari]

nukecad while I'd like to test it I can't because if the Avast install were to slip through I'd have to restore from a full system disk image because something in Avast is incompatible with the Aladdin/Sentinel License Manager ("HASP License Manager") a form of DRM I suppose for a software installed on my system and has been since 2007/2008 meaning my system will become unbootable in normal Windows mode if I install Avast -- it's literally the only antivirus I've tried that has that particular issue.

The 3rd party installs getting through has been a known issue for years with  in the CCleaner Standard installer build. I guess just be glad they're now acknowledging it, and looking into it as an actual issue to resolve.

I however don't see allot of people attempting those instructions for the fact they may not want to risk an Avast install slipping through onto their system. Those instructions in my opinion would also require more diligence than what the baseline instructions imply -- I'd for one make a full system disk image beforehand to insure a 100% guaranteed way of fully getting rid of an unwanted installation, since even those antivirus uninstall utilities don't always remove 100% of the installation.

[login123]

Should point out that I normally don't install anything while connected to the net until after much checking.

But I have come to trust CCleaner over the years, recent problems notwithstanding, and anyway this system runs under Powershadow so all changes will go away after a restart. Not sure how this old system will help anybody but  here goes.  . . .

And the results are in!!

Offer for google toolbar delay time was zero, the offer showed immediately in the first installer window, with a box to uncheck.

It's been about an hour since and no other offers appeared.
Speedtest shows:  ping = 42 ms, download = 3.40 Mbps, upload = 0.49 Mbps.  Not going to post the URL. 
ccsetup538_v2.exe (I renamed it) phoned out to 151.101.0.64, aka ip-188-121-41-51.ip.secureserver.net, but that connection closed when I unticked the "View Release Notes" box. 
OS is Windows is XP Home Edition 32-bit SP3
CPU is AMD Athlon 64 X2 4800+
RAM is 4.00GB Dual-Channel DDR @ 198MHz (3-3-3-8) (3.31GB in use)
Antivirus is Avast

Edit:  Should point out that this result is consistent with every other time i tried the CCleaner installer, going back for years. 

Speccy phoned out to 188.121.41.51, didn't know it did that. 

 

[hazelnut]

Piriform has beta testers, it's those who should do this testing along with Piriform/Avast employees.

 

[nukecad]

I take the point about in-house beta testers and/or Piriform employees.
The problem with in house testing (of anything, not just software) is that it rarely mimics real life conditions successfully.
With software in-house testing is that is likely to be using up to date kit and OS, networked systems, with a decent reliable internet connection, tech savy testers, etc., etc.
Not exactly home user conditions.
If you want real end user testing then you have to have end users doing it on their old(er) kit, with variable broadband, and so on.

I'm less sure about the point that this test may give an unwanted install.
Nothing in the instructions says to actually install anything.
Just start the installer, time the delay, and close the installer without proceeding.

PS. As it stands we seem to be risking an unwanted install with every update anyway.

My thought about asking the forum regulars to participate was that Piriform/Avast may take a bit more notice of regular contributors, who know about the problem, than of a one time poster who has just come for a moan that they didn't pay attention to what they were doing.

Of course the choice is yours, if you are uncomfortable doing the test then don't do it.

[login123]

Well, it might provide a different perspective, so there is mine. 

Fwiw, when I checked in the program files folder, there was an exe called CCUpdate.exe. It is now renamed to CCUpdate._xe, and on restart it will be gone.  Because I like to manage my auto-updates pretty closely. 

I understand the reason for this new exe, I think, but it doesn't matter.

Where's the logic, eh?  An update caused CCleaner to be compromised, so we shall now schedule updates as part of the installation? 

A question, if I may.  I read somewhere about a scheduled task being created, but can't find one here on XP right now. 

IS there a scheduled task created? 

Thanks. 

[hazelnut]

16 minutes ago, login123 said:

Well, it might provide a different perspective, so there is mine. 

Fwiw, when I checked in the program files folder, there was an exe called CCUpdate.exe. It is now renamed to CCUpdate._xe, and on restart it will be gone.  Because I like to manage my auto-updates pretty closely. 

I understand the reason for this new exe, I think, but it doesn't matter.

Where's the logic, eh?  An update caused CCleaner to be compromised, so we shall now schedule updates as part of the installation? 

A question, if I may.  I read somewhere about a scheduled task being created, but can't find one here on XP right now. 

IS there a scheduled task created? 

Thanks. 

https://forum.piriform.com/topic/49069-new-emergency-updater-in-ccleaner-v536/

 

[mta]

@login123, it's a hidden task, so not listed in CC or MSCONFIG (from memory).
you have to go to Task Scheduler Library in Task Scheduler to see it.  (adjust accordingly for you XP dinosaurs)
I've put that auto-update feature down as a "justice has to be seen to be done" reaction.

 

@nukecad, sorry, I have to disagree.
a software companies testing methodology has to match as closely as possible their real world user environment.
although I believe the gang aren't used any more, we used to have a Beta Testers group on this forum who did this very sort of thing.

[login123]

Thanks.  I did go to task scheduler, didn't see it. Might have got it wrong, was in a hurry & had to stop, will try again later. 

PS:  Friend mta, remember that dinosaurs were here for about 165 million years, we've been around for what, about 1 percent of that? 

So there!

[mta]

ahh, but don't forget mutual friend login123 that said dinosaurs, as stated,  are now extinct, replaced via (bad) luck or fate with its successor and to the victor goes the spoils.

I know when Piriform first released that auto update task, it showed up in my Win10 with the Hidden box ticked.
maybe XP does things differently, I can't remember all those eons ago when I last had it.
(and I'm too lazy to fire up the VM to check it out, care factor and all that)

[hazelnut]

Is there not an ..Advanced... show hidden tasks thing in XP  scheduled tasks?

I was under the impression that Piriform outsourced their testing to a company (but I may have remembered that wrong) However I do agree with mta a software testing environment should be varied and not just consist of super dooper 32 gig i7 laptops with Win 10.

[mta]

29 minutes ago, hazelnut said:

...not just consist of super dooper 32 gig i7 laptops with Win 10.

so they should stop using the one golden laptop (that rules them all) and dust off the silver and bronze ones as well.

[Andavari]

On XP in particular setting a scheduled task yourself let alone some software installation attempting to set one will often fail -- even if your user account has Admin privileges.

[login123]

The original issue of a delayed installation just doesn't happen here, never has. 

Finally did read Hazelnuts links from the unnumbered post above. Those were informative, thank you Hazelnut.

Still not sure if this last installation created a new update task.  Don't think so, didn't find it.  Might have missed something.  In any case the last restart will have "reset" this system, so further checking must wait a bit. 

Automatic update won't happen here.  I will block it.  Not sure how, it isn't an issue yet, but I will.  

Mta, dinosaurs both organic and digital still live among us.  Birds and windows xp.   

 

 

[Guest Stephen CCleaner]

On 12/22/2017 at 15:04, nukecad said:

As I started this thread then I'll go first.

Restarted, made sure everything had settled down (checked all was quiet in Task Manager).
Opened file explorer, let things settle down again.
Launched ccsetup538.exe (revised version 14/12/2017).

From install button showing to offfer showing (Chrome) was 2.5 seconds. (Stopwatch).

Speedtest.net results: Date 12/22/2017 2:41 PM GMT, Download 2.31 Mbps, Upload 1.01 Mbps, Latency 27 Ms, Server Distance ~50 mi

Windows 10 Home, v1709, build 16299.125, 64 bit.
Intel Celeron CPU N2840 @2.16GHz (Overclocks to 2.58).
4 GB RAM.
Windows Defender. Malwarebytes Anti Exploit stand alone is also running real time.

 

EDIT.
Because you asked for the speedtest I decided to run the test again after a restart, but this time switched the lapop to 'Flight Mode' to disable the web connection before running the installer.
Still got the 2+ second  delay in displaying the offer.

I'll relocate to a faster broadband connection and try again.

EDIT2

OK tried again but with a fibre BB connection this time.

Same 2.5 second lag from install button to offer being displayed.

Speedtest.net results: Date 12/22/2017 3:30 PM GMT, Download 54.40 Mbps, Upload 16.14 Mbps, Latency 34 Ms, Server Distance ~200 mi

All other specs the same as above. (Same laptop).

 

So that would seem to rule out the connection speed as a cause.

Any other testing/ logs you would like then please give a shout.

 

Thank you very much for your contribution. Our testers can now recreate these exact conditions and try to reproduce. It would be useful to have some more examples to go on to speed up the process, but we will work with what we have.

If we assume your situation is not an anomaly, I agree this would allow us to rule out the speed/reliability of the connection as a cause, plus it confirms reproducibility on the latest Windows 10 update. It also allows us to systematically test against settings configurations of Defender and MalwareBytes.

Here are some potential causes we can test for:

• A Defender setting is blocking/delaying some aspect of the offer eligibility logic
• A Defender setting is blocking/delaying the request for offer content
• A MWB setting is blocking/delaying some aspect of the offer eligibility logic
• A MWB setting is blocking/delaying the request for offer content
• The conjunction of a Defender setting and a MWB setting is causing a problem
• A Windows system setting is blocking/delaying the request for offer content
• An IE/Edge/browser setting that is used in relation to downloading temporary internet files 
• The destination that the offer content is stored in is not the default system location and this has unforeseen consequences

Thanks in advance to anyone else experiencing this issue who can provide the information requested. A second and third set of data points will likely speed up the testing process considerably.

[Guest Stephen CCleaner]

Quote

When I installed an update to CCleaner, I saw the box for installing the "Avast" anti-virus just as I clicked the install option for CCleaner. It is checked by default. Well, it not only installed the Avast anti-virus software, but it disabled the Malwarebytes software I had which runs automatically on start up. I uninstalled the Avast software, but my Malwarebytes software would not come up. I finally checked the Services list, and I fould the Mawarebytes service had been disabled! I really think it takes a lot of nerve to install this anti-virus trial version on my PC, and disable something that I have running. And in a way that takes searching to see what is going on. Just my two cent's worth.

Reported in another thread by TheMe. Common trait: offer only appeared after a delay; MalwareBytes is installed and was running.

[nukecad]

On 02/01/2018 at 12:15, Stephen Piriform said:

If we assume your situation is not an anomaly, I agree this would allow us to rule out the speed/reliability of the connection as a cause, plus it confirms reproducibility on the latest Windows 10 update. It also allows us to systematically test against settings configurations of Defender and MalwareBytes.

Just to make clear that I am not running the full Malwarebytes3 in real time.

I am running Malwarebytes Anti Exploit stand alone perpetual beta which is a different, though related, programme.

It always used to be a seperate programme to Malwarebytes Antimalware, but the 2 programmes got merged with MB3.

 

When I get time I'll disable it and run the installer test again.

[Guest Stephen CCleaner]

3 hours ago, nukecad said:

Just to make clear that I am not running the full Malwarebytes3 in real time.

I am running Malwarebytes Anti Exploit stand alone perpetual beta which is a different, though related, programme.

It always used to be a seperate programme to Malwarebytes Antimalware, but the 2 programmes got merged with MB3.

 

When I get time I'll disable it and run the installer test again.

Thanks for the clarification, that's helpful.