Ccleaner - block dll challenge

Has anyone found a way to block or prevent Ccleaner's gcapi.dll (Google Cloud API Interface) or maybe (Google Cloud Application Program Interface) from loading? I've been trying to figure out how for years but never figured it out. I can quarantine it but by then it's already loaded.

It's not a big deal but if someone knows or can work out how to prevent if from loading that would be great.

Related info:

WARNING: 5.83 portable includes secret dll - CCleaner - CCleaner Community Forums

@Callender


I use CCleaner v5.78 (free version)
I ran your Spy-the-Spy, and it found the same files.



Download CCleaner 5.78.8558 - Download - Filepuma.com


Scans clean locally and at Virustotal.

VirusTotal


I also added these lines to the HOSTS file...

0.0.0.0 ncc.avast.com
0.0.0.0 ncc.avast.com.edgesuite.net
0.0.0.0 license.piriform.com
0.0.0.0 ipm-provider.ff.avast.com
0.0.0.0 shepherd.ff.avast.com
0.0.0.0 ip-info.ff.avast.com
0.0.0.0 analytics.ff.avast.com

@Ghot

It's in all versions since CCleaner 3.01. Yes I have Ccleaner blocked in both Firewall and hosts file. It's not that much concern for me but blocking it would be great if possible.

Note: A file search by name won't find it because it loads in RAM.

Callender said:

@Ghot

It's in all versions since CCleaner 3.01. Yes I have Ccleaner blocked in both Firewall and hosts file. It's not that much concern for me but blocking it would be great if possible.

Note: A file search by name won't find it because it loads in RAM.

Yeah. I ran Spy-The-Spy and it found the same files.
I too have CCleaner blocked in my Bitdefender firewall.

Just tried 578



Anyway there's no sign of it actually making a connection.

Did you try blocking it with a group policy or using App locker?

Malneb said:

Did you try blocking it with a group policy or using App locker?

No. I don't know how. I don't think that App locker could be configured to block a dll with a randomly generated name.

Oh it appears at runtme? but its not there when the app is not running?

Malneb said:

Oh it appears at runtme? but its not there when the app is not running?

It's nowhere to be found except when Ccleaner launches and even then it isn't found in explorer even with all types of hidden files shown. It seems that it's created then instantly moved to RAM.

I would still try app locker it should work idk i have not blocked anything with it that happens after an app runs but as long is the path is correct it should work. When the dll appears it should block it.

i know you can wild card with /* so that means app locker does not need to know specifics. so if it comes with random names every time then just do the path of the dll and then do /*.dll on the end of the path.

I think past that then you would want to see what is loading the dll and potentially block that if it does not seem important after researching what is launching it.