• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

SONAR "suspicious activity" by ccleaner64.exe?

Okay, what's going on...lol  CCleaner is a known good program.  So, as I'm sitting here minding my own business, why does SONAR feel it is "doing suspicious activity??"  Color me confused.  (All I did was run a LiveUpdate; CCleaner wasn't even open when I got the warning.  Also, I'm using CCleaner Free version 5.24.5841, and as far as I know, it shouldn't even be running in the background.  It isn't set to auto-update.)  Here's the stuff:

Replies

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Your CCleaner is out of date. Current version is 5.25.5902. Also newer versions of CCleaner have a monitoring option built in. Most likely this is on. Open CCleaner. Click on the options tab then click on monitoring. Turn off enable system monitoring and turn off active monitoring. I use CCleaner all the time and have no received the message you just got. If you click on more options in that Norton alert and can restore and exclude CCleaner. 

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Thanks.  I was already aware the "update number" was a little old, after I got the warning.  Once I saw that, I updated; although the version (version 5) is the same.  As you must be aware, Piriform "updates" CCleaner constantly (and I do mean constantly).

I have never had either my Update Automatically or Monitoring options "On," so I don't know what "background activity" CCleaner may have been doing.  I never check anything in the Monitoring tab, and the only option I select in the Settings tab is, "Add Open CCleaner... option to Recycle Bin context menu."

Considering that, it shouldn't have been doing anything in the background, should it?

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

CCleaner does not update automatically. It will however check for updates then lead you to the download site on Priiform. Did you check to see if CCleaner was running in the background? Did you check the options I described and see if monitoring was on? CCleaner updates about once a month. Mainly bug fixes which is good. 

Kudos1 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

No, it doesn't update automatically; but it can check for updates automatically (it's the fifth checkbox down in Settings).  That box is not checked in my CCleaner.  Also, I did not check to see if it was running the background, because I figured, "Why should it be running in the background?  I never used it today."

As I mentioned, automatic updating and/or monitoring were not checked (they never are, because I don't check them).

I agree that bug fixes are good.  I'm just saying, CCleaner does a lot of updates.  In fact, since version 5 came out in Nov 2014, there have been 25 updates.  That's a bunch!

I think I'm not going to take any action for a little while...and just wait and see if SONAR's "background activity" warning occurs again.  I just can't figure out why CCleaner should have been doing anything in the background.  Thanks.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

25 updates in 2 years comes out to about an update per month. Nothing abnormal about that. Especially when browsers such as Firefox or Chrome can update 2x a month. Piriform needs to keep up to date with current browsers to make sure that CCleaner is working properly. CCleaner monitoring is on by default under version 5. Hence why I said to be sure it is unchecked. See my screen shot. But it is definitely a false positive on Norton's behalf. Been using CCleaner all day and not one alert from Norton. Did you run Live Update recently? What happens when you open up CCleaner and click "run cleaner"?

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@Saganized:

Then, you may do the following:

Part 1:

1. If you're running a Windows 8+ computer, plz disable the Fast Startup temporarily.

2. Update your Norton via LU. Restart when ready.

3. Try reinstalling your CCleaner using the latest official setup file (64-bit?! If so, that's cool... ).

If your problem persists, plz read on...

Part 2:

1. Disable Norton's real-time protection as the admin user, temporarily. Remember to re-enable Auto-Protect & Smart Firewall later.

2. Re-download your 64-bit CCleaner and reinstall it later.

3. Disable the internet connection temporarily.

4. Exclude that 64 bit CCleaner in your Norton product.

5. Re-enable Norton protection -> turn on internet connection. Then check yr issue out.

6. Report a Suspected Erroneous Detection here: restore your 64-bit version of CCleaner > submit that exe to Symantec. Meantime, plz upload that exe to Virustotal.com for additional analysis.

For more info, you may Chat with Norton Support, later. Thx :)

Off-topic stuff: Sorry, but I cannot reproduce your issue (using ccsetup525 & 5.14.5493)

1. At first, the newly installed NS did not flag my download of ccsetup525.

2. I ran LU to update my NS, rebooted and, tried installing an older version of CCleaner (5.14.5493). Everything was fine.

Well, we may need extra info to address your issue here: plz hit the Locate button; have a close look at the Origin tab; tell us the exact Digital Signatures of that ccleaner64.exe. Thx again...

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

CCleaner is a known good program.  

Any reliable program can start to execute up bad actions and SONAR know this fact. Cool! But,sometimes, possible false positives.CCleaner - not crystal clear program: free and with PUP elements (as UTorrent) .

1) Update the CCleaner program. 2) It is important to understand that SONAR does not delete the program, it is blocked harm. There is a difference! CCleaner does not always bear the damage, but sometimes can make it, because PUP+free.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

What makes you say CCleaner is not a crystal clear program? It's obvious Sonar had a false positive. 20750065 does not understand that when CCleaner is running on a 64 bit system the process running is CCleaner64.exe. He might be running CCleaner portable also. Fast Startup has absolutely nothing to do with this. I wish people would stop rubber stamping such a good feature in Windows.
Kudos1 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

@Saganized:

my bad... I forgot to unhide file types and file name extensions... Anyway, my NS flagged nothing.

As to "Fast Startup" again, Tony Weiss too...

recommend that ...reboot your( Windows) system (without fast startup), and try the scan again. 

And see detailed insights here. Thx.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos1 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

I have been experiencing this problem too, intermittently, over the last week or so when I manually run Ccleaner. I have Ccleaner free V5.25.5902 (64-bit), NS 22.8.1.14 and up to date Win 10 with fast startup disabled.  My PC is re-booted daily. Most of the time Ccleaner completes fine; occasionally I get the Sonar warning. Have not figured out what conditions trigger the Sonar warning.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Rebooted or restarted? I have CCleaner 5.25.5902, NS 22.8.1.14 and Windows 10 Annivesary 1607 14393.576 and no issues with CCleaner and Sonar. I have this same setup on at least 20 machines. No issues. I even have Sonar on aggressive. 

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Restarted. I shut down overnight.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Are you using CCleaner portable by chance? Did you add special cleaning rule? Are all your CCleaner settings at the default? Have you ran Live Update lately? 

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Not using CCleaner portable and did not add any special cleaning rules. The targeted file is CCleaner64.exe, File Version 5.25.0.5902.  

Changed CCleaner settings: .I use Secure File Deletion - Simple Overwrite (1 pass) and I maintain a list of Cookies to Keep, which has not changed in several weeks, i.e. the list has been stable long before I started to see the Sonar alerts.  I variously use IE, FF and Chrome browsers. Otherwise I have not changed any settings.

I ran a manual LU when I first booted up the PC this morning. I usually do a manual LU daily.  Auto LU is working:I have had 5 so far today.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Been using CCleaner for years. Never had an issue with it.

Besides you have the option with detections by Norton to set them to Ask me, so Norton won't just delete them.

Windows 10 Home X 64 Norton Security Premium Current
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

PatsSoxBruins:
What makes you say CCleaner is not a crystal clear program? It's obvious Sonar had a false positive. 20750065 does not understand that when CCleaner is running on a 64 bit system the process running is CCleaner64.exe. He might be running CCleaner portable also. Fast Startup has absolutely nothing to do with this. I wish people would stop rubber stamping such a good feature in Windows.

PSB, despite what you say, Fast Start Up HAS caused issues for some people so we suggest it be disabled to at least see if it HAS caused an issue.

Our opinions are just as valid as yours, and you'd be well advised to take that on board.

Windows 10 Home X 64 Norton Security Premium Current
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Portable version of CCleaner vs. NS: NOTHING:

Then, @Saganized: plz disable the fast startup if you're using Win10, 8.1 or 8 - you can still reuse that feature later when your issue is addressed; Restore the deleted ccleaner64.exe from the Quarantine, then update your Norton client and, in the meantime, plz Report a Suspected Erroneous Detection if you can (recommended). Thx :)

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos1 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

Hello

If it wasn't an issue for some people, then this would not exist either.

Here is a link for turning off Fast Startup in Windows 10

http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html 

The instructions exist on eightforums.com also. These instructions weren't written for Symantec customers.

Of course it doesn't cause issues for everyone, but we have seen plenty of customers say that disabling that file fixed their issue. We offer it as a possibility.

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit Norton Core Security Plus 22.17.2.47 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Instead of rubber stamping"Disable Fast Startup" which is a feature on by default it's better to inform the user the difference between shutdown and restart. Most people think a restart is a shutdown. So when you tell them to disable fast startup it appears to fix the issue. A better approach would be to advise the user to do a system restart and not a shutdown. I have told several users this and it corrects the issue. Why disable a feature that has so many pros. I have 8 laptops of my own all with Windows 10 and Fast Startup on. 6 with Norton and 2 with Avast. No issues. I have about 20 family members computers all with the same Norton setup. No issues. I maintain hundreds of computers with the same setup. No issues. If the first step in diagnosing Norton is to disable a feature in Windows then Symantec needs to look into why. The beauty of Windows 10 is that from a cold boot or hibernation it's takes about 30 seconds. A restart can take 1-2 minutes. Microsoft did this to please Windows users who complained it took to long to boot. I play with and try every security product out there. I am a member of all the forums. This is the only forum which tells people on a regular basis to disable Fast Startup.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

PSB, again I say, we're all entitled to our opinion.

As I said in my previous post, it has caused issues for SOME readers.

Also FTR, we Gurus have been doing this for quite a while, and can only advise based on what we've experienced.

Again I refer you to peterweb's explanation which differentiates between the various functions.

https://community.norton.com/en/forums/windows-881-or-10-and-fast-start-...

Windows 10 Home X 64 Norton Security Premium Current
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Again a simple restart is fine. There is no need at all the rubber stamp every Norton issues by telling users to disable a feature which is built into Windows for a purpose. Heck while we are at it why don't we just tell people to disable UAC and Windows updates. I think Symantec should be looking on there end rather then pointing the fingers at Microsoft. I am a regular user of Kaspersky and Avast. No where in the forums is anyone constantly telling people to disable fast startup. Fast Startup ONLY affects system shutdown and hibernate. Restarts are NOT affected. So instead of disabling fast startup just tell members of the community to simply restart their pc's. If you continue to rubber stamp things then start telling people that your computer will no longer boot up fast when they disable fast startup. 

Keep in mind that disabling fast startup has nothing to do with a false positive from Sonar. Hence the rubber stamp.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Keep in mind that disabling fast startup has nothing to do with a false positive from Sonar. Hence the rubber stamp.

At no stage did I say it had, and again if you've read any of our posts, we HAVE suggested restarts on many occasions.

This is my last response regarding this topic.

Windows 10 Home X 64 Norton Security Premium Current
Kudos2 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

I am inclined to believe it is something that Ccleaner is doing.  This Alarm only started to appear with Ccleaner version 5.24 and continued with 5.25.   I reloaded version 5.20 and the alarms stopped.   Check out the screen save from Norton regarding the Sonar Alarm.   I think someone at Ccleaner left a piece of test programing in the production version of 5.24 & 5.25.   I love Ccleaner and am sure they will iron out this problem.  I wouldn't start changing my operation system just yet.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

It has absolutely nothing to due with suspicious activity from CCleaner. It's called a false positive on Nortons behalf. Funny thing is I can't duplicate it across hundreds machines. Either can others. In the past 90 days I have submitted at least 20 false positives to Symantec. It's getting out of control.

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

I believe your right.    I double checked it again several versions of ccleaner  and  sooner or later Sonar Alarmed on all of them...  

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@OldPhotoGuy: Would U plz tell me/us the site name or exact download resource (how did you get the flagged CCleaner)? And its Digital Signatures & SHA256@ Google VirusTotal.com? And, what the exact build of your Norton program? OS?

Thx.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Filename: ccleaner64.exe
Full Path: c:\program files\ccleaner\ccleaner64.exe
____________________________
____________________________

On computers as of
28/12/2016 at 6:48:32 PMLast Used
31/12/2016 at 1:47:24 PM

Startup Item
No

Launched
Yes

SONAR Protection monitors for suspicious program activity on your computer.
____________________________

ccleaner64.exe
Locate

Many Users
Hundreds of thousands of users in the Norton Community have used this file.

New
This file was released 18 days ago.

High
This file risk is high.

____________________________

Source: External Media  <---------------------------------------------------  NOT!!
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

 

I could be wrong but this may be because of Secure Delete (3 passes).  There is no "External Media" connected.

I'm calling it a false positive.

A little bit of knowledge is... well a little bit of knowledge.
Kudos2 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

I've just submitted ccleaner64.exe as a false positive to Symantec and I will update this thread when I hear back.

Cheers.

A little bit of knowledge is... well a little bit of knowledge.
Kudos1 Stats

Re: SONAR "suspicious activity" by ccleaner64.exe?

I've just submitted ccleaner64.exe as a false positive to Symantec and I will update this thread when I hear back.

(probably) It isn't BPE (Behavioral Policy Enforcement)-detection by SONAR (https://www.symantec.com/theme/star), it is BPL(Behavioral Policy Lockdown)-detection, therefore, not false positive and problem in CCleaner, because BPL - not heur detection - absolute blocking without heur-reason. We need to involve Symantec's engineers, because nothing is clear. 

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Krusty13:

I've just submitted ccleaner64.exe as a false positive to Symantec and I will update this thread when I hear back.

Cheers.

So far:

"We have been unable to reproduce the detection issue described in your submission. Our investigation shows that the software you submitted is known-good and as such does not trigger any detections.
A possible reason for this could be that the status of your software changed automatically between the time of your submission and now."

I have sent them a link to this thread and asked to investigate further.

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@K...13:

SO... We need that flagged exe, extra info (Digital Signatures & SHA256) and/or the exact resource you @Saganized & @OldPhotoGuy got the ccleaner64.exe. thx...

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Windows Professional Service Pack 1 (up to date)
Norton Version: 22.8.1.14
CCLeaner v5,25,5902 (64-Bit)Free Version
CCleaner downloaded from www.piriform.com/ccleaner/download/standard
Intel Core I5 CpUM 450 @ 2.40GHz 8.GB Ram, Intel graphics

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

OldPhotoGuy:

Windows Professional Service Pack 1 (up to date)
Norton Version: 22.8.1.14
CCLeaner v5,25,5902 (64-Bit)Free Version
CCleaner downloaded from www.piriform.com/ccleaner/download/standard
Intel Core I5 CpUM 450 @ 2.40GHz 8.GB Ram, Intel graphics

Hi,

I'm curious, do you have Secure Delete enabled in Settings?

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@OldPhotoGuy:

Then I did the below tests:

1. I redownloaded CCleaner via Chrome:

  • SHA256: a39560a9e8aedc5e11fb422d308f96678609b70ca361ce842d5f15ee2e142dcc
  • Detection ratio: 2 / 56

I ran LU to update NS to its latest build.

I can't still reproduce your deletion of CCleaner.

2. I used IDM to d/l CCleaner:

Nothing...

Thx for your info & feedback. :)

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

I got ANOTHER "warning" by SONAR.  CCleaner and NS are both up-to-date.  So, that was "the last straw"--something is broken, either with Norton Security SONAR or with CCleaner.  I'll leave it to Norton to "figure this out."  I sent in a False Positive report on SONAR ten minutes ago.  That's that.  Y'all have a Happy New Year.  Good night.

Clipboard info:

Filename: ccleaner64.exe
Full Path: c:\program files\ccleaner\ccleaner64.exe

____________________________

____________________________


On computers as of 
12/27/2016 at 12:24:37 PM

Last Used 
1/1/2017 at 12:31:30 AM

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


ccleaner64.exe
Locate


Many Users
Hundreds of thousands of users in the Norton Community have used this file.

New
This file was released 19 days ago.

High
This file risk is high.


____________________________


Source: External Media


____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available
 

Windows 10 Home, Version 1607, OS Build 14393.576

CCleaner v5.25.5902 (64-bit)

Norton Security 22.8.1.14

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@Saganized,

Do you have Secure Delete enabled in CCleaner settings?

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Just for everyone's info...my Fast Startup option has been OFF practically since I upgraded Windows 7 to 10.  (One of the first issues I encountered after upgrading involved disabling Fast Startup as a troubleshooting step, and since it worked, I just went ahead and left it OFF.  Leaving it OFF didn't seem to affect my startup times, anyway.)  

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Krusty13:

@Saganized,

Do you have Secure Delete enabled in CCleaner settings?

Can someone please answer this simple question?  It may assist in determining what's going on.

Thank you.

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

OldPhotoGuy, I'd say that's certainly a possibility.  In fact, that may be the answer...let's hope it is.  I sent a sample of ccleaner64.exe a little while ago; hopefully Norton can identify the fault and notify/work with Piriform to develop a "quick fix."  I'm gonna guess we'll see yet another CCleaner soon (so, make that 26 version 5 updates...LOL).

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Yes, I do:  Advanced Overwrite (3 passes).  Secure deletion is a good feature; and one of the best things about CCleaner, imo.  (Sorry about delayed reply, I turned off notifications for this thread...things were getting rather crazy lol)  

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Saganized:

Yes, I do:  Advanced Overwrite (3 passes).  Secure deletion is a good feature; and one of the best things about CCleaner, imo.  (Sorry about delayed reply, I turned off notifications for this thread...things were getting rather crazy lol)  

Cool!  That makes two of us.  I have notified Symantec that this may be relevant.

Thanks.

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Krusty13, you're welcome.  I apologize for taking so long; I haven't been "keeping up" with the thread.  I think I mentioned earlier that I turned off notifications for the thread; but actually, I don't remember doing that.  Must be my age lol    Anyway, thanks also for submitting the False Positive--I did that also, about an hour ago.  These things seem to crop up every now and then.  Sometimes they're CCleaner, sometimes they're a LiveUpdate, sometimes they're something else.  One thing is 100% certain:  "It's always something."    Happy New Year!

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Krusty13:
@Saganized,

Do you have Secure Delete enabled in CCleaner settings?

Can someone please answer this simple question?  It may assist in determining what's going on.

I have (and always had) Normal Delete enabled and never had the reported issue.

Happy New Year!

Windows 7 HP SP1 32-bit | Chrome 65.0.3325.146 | NS 22.12.1.15
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@K...13 & R_2:

1. By default, CCl did not use that option "Secure file deletion".

2. Then I enabled that "Secure file deletion (Slower)" + "Advanced Overwrite (3 passes)". Test shows that ccsetup523 worked well with NS.

And then, I overinstalled ccleaner with the latest version (5.25 at the time of commenting) using the default installation options. Nothing happened:

I did the above tests on VM. Does that matter?

Happy 2017...

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Yes,  I have always used "1 Pass secure deletion" with ccleaner.  That feature is Key to it's value. 

I have been using both products for well over 5 years.  Both are up to date.  Nothing in my setup has changed in the last month or so.  I noticed the SONAR warnings started about 10 days ago.   I have gone back and reloaded a number of the older versions of ccleaner and the Warnings still come out every so often.  NOT every time.   It can occur with or without any files in the trash and with or without Firefox being used.   Please note: the screen grab from Norton shows, the words "Testing Downloaded from Unknown"   Just FYI

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Thanks guys.  I've asked if someone can look into this issue but at this time of year it may not happen over night.

Secure Delete will wear out an SSD so on my laptops I only use Normal Delete and have not seen the SONAR block.  My new desktop has an HDD and I did enabled Secure Delete on it and this is the machine that did get the SONAR block as above.  For now I have disabled Secure Delete and have not seen a SONAR block since.

OldPhotoGuy,

That is weird!

I just check Security History on the desktop machine and sure enough, mine shows the same as your screenshot  -  "Testing Downloaded from Unknown"

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

No reason to enable secure delete for everyday use. Unless there is something you are trying to hide. Been using CCleaner since it came out. Always use "normal" file deletion. I have tried to duplicate this on about 20 machines now and I cannot. 

Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

@OldPhotoGuy:

default installation options (ccleaner 5.25 + google toolbar + right-click menu options) + "1 Pass secure deletion" (aka, "Simple Overwrite (1 pass)") vs. NS: nothing...

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Symantec are still unable to reproduce this issue.  Is anyone still seeing the SONAR block while running CCleaner?

Thank you.

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: SONAR "suspicious activity" by ccleaner64.exe?

Nope.Over 200 machines. No problems

This thread is closed from further comment. Please visit the forum to start a new thread.