Any regedit hacks for Ccleaner portable version, 6.23?

NooNoo · 1 Week Ago

Looking to

1) Stop it from trying to connect through the internet

2) Would like to remove 'Registry' tab and 'Easy Clean' tab. (Knowing if there's a regedit for removing sub tabs would be awesome, never found a way yet).

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\CCleaner

That's where I've made some headway.

Before I even run Ccleaner for the first time, I make sure to have a firewall rule blocking oubound.

Curious as to what (Cfg)PC (Cfg)PE string values are (I tried installed version and saw those, was just curious).

idgat · 1 Week Ago

NooNoo said:

Looking to

1) Stop it from trying to connect through the internet

2) Would like to remove 'Registry' tab and 'Easy Clean' tab. (Knowing if there's a regedit for removing sub tabs would be awesome, never found a way yet).

Simple, stop using it. The credibility and veracity of ccleaner has been serious degraded since it was taken over by a company whose main claim to fame was less than reputable anti-malware software.

Spyware and mining are rampant.

EDIT And when you uninstall it, make sure you use the full facilities of a reputable software removal program, such as RevoUninstaller. Using Windows uninstall, or ccleaner's own removal option, will most certainly leave traces.

Callender · 1 Week Ago

NooNoo said:

Looking to

1) Stop it from trying to connect through the internet

Block in whatever firewall you are using and add these to your HOSTS file.

Code:

0.0.0.0 ncc.avast.com
0.0.0.0 ncc.avast.com.edgesuite.net
0.0.0.0 license.piriform.com
0.0.0.0 ipm-provider.ff.avast.com
0.0.0.0 shepherd.ff.avast.com
0.0.0.0 ip-info.ff.avast.com
0.0.0.0 analytics.ff.avast.com
0.0.0.0 uib.ff.avast.com
0.0.0.0 analytics.ns1.ff.avast.com

NooNoo said:

2) Would like to remove 'Registry' tab and 'Easy Clean' tab. (Knowing if there's a regedit for removing sub tabs would be awesome, never found a way yet).

Remove "Easy Clean" - not possible as they've changed newer builds. It was possible in older builds. You can choose to save Ccleaner settings to .ini file and make Custom Clean the default.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\CCleaner

That's where I've made some headway.

Before I even run Ccleaner for the first time, I make sure to have a firewall rule blocking oubound.

Curious as to what (Cfg)PC (Cfg)PE string values are (I tried installed version and saw those, was just curious).

RE: (Cfg)PC (Cfg)PE string values

I don't see them. However I remove some components by deleting the .dll files so maybe that is why. On launch I see:

Any regedit hacks for Ccleaner portable version, 6.23?-ccleaner-home.jpg

I never worked out how to remove registry cleaner but I never use that component anyway.

I use these imported via running a batch file via a shortcut to launch Ccleaner because (for me) some of these hacks don't stick.

NOTE: Two registry key locations.

[HKEY_LOCAL_MACHINE\SOFTWARE\Piriform]
[HKEY_CURRENT_USER\Software\Piriform]

Code:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Piriform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\CCleaner]
"GD"="35a7238d-eeff-4816-b9a8-fba55115e495"
@="C:\\Program Files\\CCleaner"
"UpdateAuto"="0"
"UpdateCheck"="0"
"CheckTrialOffer"="0"
"(Cfg)GetIpmForTrial"="0"
"(Cfg)SoftwareUpdater"="0"
"(Cfg)SoftwareUpdaterIpm"="0"
"Monitoring"="0"
"HelpImproveCCleaner"="0"
"SystemMonitoring"="0"
"(Cfg)QuickClean"="0"
"(Cfg)HealthCheck"="0"

Code:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Piriform]
[HKEY_CURRENT_USER\Software\Piriform\CCleaner]
"RunICS"="0"
"Brandover"="0"
"Language"="1033"
"Monitoring"="0"
"HelpImproveCCleaner"="0"
"SystemMonitoring"="0"
"UpdateAuto"="0"
"UpdateCheck"="0"
"CheckTrialOffer"="0"
"(Cfg)QuickClean"="0"
"(Cfg)HealthCheck"="0"
"(Cfg)GetIpmForTrial"="0"
"(Cfg)SoftwareUpdater"="0"
"(Cfg)SoftwareUpdaterIpm"="0

Berton · 1 Week Ago

I use only the Portable version of CCleaner [originally called CrapCleaner] but did see a new computer come with the antivirus that also included the installed CCleaner, uninstalled both as the client used a different/better program.

NooNoo · 1 Week Ago

If anyone can help remove 'Registry' tab or 'Easy Clean' tab through regedit, let me know.

- - - Updated - - -

idgat said:

Simple, stop using it. The credibility and veracity of ccleaner has been serious degraded since it was taken over by a company whose main claim to fame was less than reputable anti-malware software.

Spyware and mining are rampant.

EDIT And when you uninstall it, make sure you use the full facilities of a reputable software removal program, such as RevoUninstaller. Using Windows uninstall, or ccleaner's own removal option, will most certainly leave traces.

It gets rid of all the logs in different places (using winapp2.ini), it securely deletes my recycle bin with 1-3 pass (w/e I choose) & it whitelist cookies not to be deleted.

Yet to find a program that can do all of that & still be as small as CCleaner Portable is. The installer version is horrendous, but the portable (after deleting the extra stuff before running) is perfectly fine.

100% don't like bleachbit either. Last time I tried it, didn't even have cookie whitelist. Just because it's open source everyone chooses it, lol.

Berton · 1 Week Ago

Since the portable versions don't install on the computer most of what I see in the Registry is the location of the downloaded file on different drives I've plugged into the computer and used File Explorer to read the folders on the drives, sort of an index. There's nothing to uninstall, just use Safely Remove to unplug the drive it's on and go. Any editing of it the program would have to be done on the drive it's on.
PortableApps.com Platform Features | PortableApps.com

NooNoo · 1 Week Ago

When Opened to Custom Clean, two connections are made (on port 80, the IP address to connect can change, port 443 stays the same):

104.103.68.113 - port 80
104.103.68.73 - port 80

23.207.41.41 - port 443

When using the context menu "run ccleaner" Recycle Bin, only one connection is attempted, on port 80 (one of the two IP addresses above). I tried this multiple times and so far it's only tried to connect to 104.103.68.73

When clicking on the tab Easy Clean (or when selecting to open to tab), an additional connection is made to:

34.111.24.1 - port 443

After closing and reopening for a while, I waited a bit longer between times and got a new IP address:

199.232.146.172 - Fastly

I think this is the licensing verification website, to check if I have a verified license, not 100% sure. I think that though because that IP address never came up over hours, just once.

I also changed dump reporting to 0 one time to get a new file, unp31106044868866574i-unhandled.mdmp
Lots of jargon but going through it as a text file seeing if there's any info on there.

TWO THINGS:

1) What to put in regedit to remove either the 'Registry' tab or the 'Easy Clean' tab?

2) Is there any way to stop those two connections being made on 'Custom Clean' tab?

Callender · 1 Week Ago

I do see connection attempts which fail due to hosts file block.

Any regedit hacks for Ccleaner portable version, 6.23?-system-informer.jpg

From memory there is a ccleaner emergency update scheduled task that could be deleted.

Any regedit hacks for Ccleaner portable version, 6.23?-privacy.jpg

Any regedit hacks for Ccleaner portable version, 6.23?-updates.jpg

Callender · 1 Week Ago

RE: Easy Clean' tab

The only way to remove that is to use an old version of Ccleaner and apply the registry hacks.

Code:

https://download.ccleaner.com/slim/ccsetup578_slim.exe

Then you'd need to add the newer cleaning rules that will be missing via winapp2.ini or edit it and write your own.

Malneb · 1 Week Ago

You could also use group policy file execution blocking and Applocker polices for some of this too its an option but the above stuff should suffice. If you want to go as far as stopping certain things running when ccleaner runs,

like there might be some telemetry related dll or something that you can stop from running you would have to monitor the app to know though. I don't use it so i am not sure what it loads. You could even use something as simple as system explorer and see if it loads anything basic and block it that way as it will write a reg entry to block it for you.