CCleaner list of Registry problems

Topic

New Reply

I ran CCleaner and got list of problems in the registry which I hesitate to allow CCleaner to ‘just’ fix …..
I’ve copied the items into a text file…..S/A

1. Which registry entries are safe to remove using CCleaner …..???
2. What’s the best (easiest) way to create a ‘file back-up’ for the items…..???…..One that will give me the ability to ‘restore’ any that I shouldn’t have removed…
3. Should I work through the items by ‘name’—-ie: all Silverlight, all AVG..etc….???

Can someone help me……… Any / All help greatly appreciated……Thank you

Reply | Quote

Replies

Hiya.

As a safety precaution, I recommend most users unchecking the top 3 or 4 items in CCleaners Registry list. Cleaning/fixing the Registry is best left alone until/if you hit a problem with something like an install that’s failing and the error message/log suggests an old Registry entry could be at fault.

Having said that, it looks like you should be fine to remove all but the Unused File Extensions – which aren’t going to be a problem anyway. Always save a backup .reg file of each CCleaner Registry run when it prompts you to, just in case (if you’ve not hit an issue within ~30 days, you should be safe to delete it).

While you’re cleaning up, I suggest you use the AVG Removal tool to ensure there are no further dregs left – unless you have moved on to a more recent/different version of AVG: http://www.avg.com/us-en/utilities

Have you scanned with MalwareBytes (http://www.malwarebytes.org/) recently? There’s a trace of iSearch showing, it could be part of a malware toolbar/search hijacker.

Reply | Quote

Satrow…….Thank you for your reply…..
No, I haven’t used MalwareBytes before….Will look into it….As well as the AVG Removal tool….
Re saving a backup .reg file ….To clarify—You’re saying 1–once I click the ‘fix it’ button, I’ll be prompted to save a backup which will be some kind of ‘vault’ which stores the items—thus, I don’t need to create a separate ‘back-up’ of some kind….2– I can either restore to the registry if need be…or….2–Delete from the vault after ’30 days’…..Right….???

Reply | Quote

I see you have AVG2014 (Free), according to your sig., don’t use the AVG Removal tool unless you want to do a complete AVG reinstall

Install MalwareBytes (don’t select the Trial install, only the basic free version is needed), update it and run the Quick scan (it’s much faster than a full scan and is 95%+ as effective at picking up details of interest, in my experience. Don’t remove everything found, save the log and copy/paste it in a reply here, someone will check it over for you.

Yes, CCleaner will prompt you to save a backup of the Registry, save it in your documents folder. If you hit problems afterwards, you can simply double-click the file to restore (the majority of – there are some that may silently fail due to incorrect permissions – rare, usually entries created during Windows’ install) the entries.

@George: I suggest you look over your CCleaner settings again, I suspect that 2x of those unchecked entries are unchecked for the wrong reasons

Reply | Quote

Hi Satrow……I ran CCleaner ‘Fix It’ on all items other than Unused File Extensions as you suggested…..

Before getting into the results—FYI—-There are 2 (Windows) User Accounts set up on this computer (mine and hubby’s)….. I ran CCleaner scans on each account….I compared each item by item—-Most of the items were identical….

The scan you reviewed was from my user account….

After doing the ‘Fix It’ under my user account , I ran a new CCleaner scan on each account……
——————————
There’s now one new item on my user account…..

Invalid class reference WormRadar.com IESiteBlocker.NavFilter HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

————————————-

Here’s what’s on my husband’s user account now…..I assume I can run “Fix It’ on 8 of the 9 items on his user account…..That will leave the same ‘WormRadar’ in question……

Application Paths Issue C:WindowsTEMP{A12FD72E-2AC0-4420-831F-18CDD5667A22}.exe HKCUSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsCompatibility AssistantPersisted
Application Paths Issue C:WindowsTEMP{98D4788A-4C3C-4559-8F52-83ED7783C0EC}.exe HKCUSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsCompatibility AssistantPersisted
Application Paths Issue C:WindowsTEMP{7E1D88BE-9DC6-419D-8D46-E0FD0453C739}.exe HKCUSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsCompatibility AssistantPersisted
Application Paths Issue C:WindowsTEMP{FBE48384-8B44-48BA-99BD-F2BEB497D721}.exe HKCUSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsCompatibility AssistantPersisted
Invalid class reference WormRadar.com IESiteBlocker.NavFilter HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Invalid file reference .current – C:Program FilesAVGAVG2012Soundsscan_rs_alert.wav HKCUAppEventsSchemesAppsavgtrayavgtrayRSAlert.current
Invalid file reference .current – C:Program FilesAVGAVG2012Soundsscan_finish_threat_found.wav HKCUAppEventsSchemesAppsavgtrayavgtrayScanFinishedThreatFound.current
Invalid file reference .current – C:Program FilesAVGAVG2012Soundsupdate_end_fail.wav HKCUAppEventsSchemesAppsavgtrayavgtrayUpdEndFail.current
Invalid file reference .current – C:Program FilesAVGAVG2012Soundsscan_os_alert.wav HKCUAppEventsSchemesAppsavgtrayavgtrayWSAlert.current
—————————-
I haven’t done anything yet with MalWareBytes…..

Thank you in advance for all your help on this…..

Reply | Quote

Hi VWDRV1, these are the settings I use & have never had a problem.

36227-RR
Click image to enlarge it.

Reply | Quote

Hi VWDRV1, these are the settings I use & have never had a problem.

I DO check the MUI Cache box on the Registry Cleaner dialog box. I allow it to be cleaned since the MUI for some reason prevents my getting into some of my WordPerfect and QuattroPro documents. I believe that Windows (I use Vista) locks the files as “open” when in fact they are just listed in the MUI. I may be wrong, but that is the conclusion that I have reached, and it works for me.

Reply | Quote

I DO check the MUI Cache box on the Registry Cleaner dialog box. I allow it to be cleaned since the MUI for some reason prevents my getting into some of my WordPerfect and QuattroPro documents. I believe that Windows (I use Vista) locks the files as “open” when in fact they are just listed in the MUI. I may be wrong, but that is the conclusion that I have reached, and it works for me.

What works for you may not work for the thread starter as it depends on how each individual’s pc is set up & installed.

Reply | Quote

Roderunner……Thank you…..Will follow that…

Reply | Quote

Satrow…..OK, will review everything in detail to be sure I follow your instructions…..Thank you / Thank you…..I really appreciate your help….

Reply | Quote

in my experience. Don’t remove everything found

In my experience with MalwareBytes, I always remove everything found and have never run into a problem. As far as I’m concerned, PUP should stand for “Probably Unwanted Programs” instead of “Potentially Unwanted Programs”.

Jerry

Reply | Quote

When it comes to unwanted toolbars, as this is likely to be, the best route is to find the uninstaller and start the removal process there. It also gives the user a better chance of understanding what to watch for in the future to avoid these situations.

My experience suggests diagnosis first, extreme cases of action first can lead to a non-bootable computer.

Potentially or Probably? That would need some valid data like a discussion with the user(s) and details of the PC’s history to decide, otherwise, like heuristics, it’s just guesswork.

Reply | Quote

When it comes to unwanted toolbars, as this is likely to be, the best route is to find the uninstaller and start the removal process there. It also gives the user a better chance of understanding what to watch for in the future to avoid these situations.

My experience suggests diagnosis first, extreme cases of action first can lead to a non-bootable computer.

Potentially or Probably? That would need some valid data like a discussion with the user(s) and details of the PC’s history to decide, otherwise, like heuristics, it’s just guesswork.

The most common complaints I see are search hijacks even though unwanted toolbars are present as well in most cases. I agree checking for an uninstall is the first step but I always run Malwarebytes afterwards. It has never left me with an unbootable computer. In rare cases it does not cure the infection but never an unbootable situation. As I stated, I have yet to find any of what Malwarebytes finds is actually wanted by my clients so that qualifies as Probably rather than Possibly and not guesswork in my mind.

Jerry

Reply | Quote

I ran CCleaner and got list of problems in the registry which I hesitate to allow CCleaner to ‘just’ fix …..
I’ve copied the items into a text file…..S/A

1. Which registry entries are safe to remove using CCleaner …..???
2. What’s the best (easiest) way to create a ‘file back-up’ for the items…..???…..One that will give me the ability to ‘restore’ any that I shouldn’t have removed…
3. Should I work through the items by ‘name’—-ie: all Silverlight, all AVG..etc….???

Can someone help me……… Any / All help greatly appreciated……Thank you

Not knowing what to remove is the very best rational I can think of for just leaving the whole registry cleaning thing alone.

*Newer OS’s like Vista through to W8.1 just don’t need the kind of routine registry cleaning that older OS’s did.
*A registry tool’s own “restore” feature can be notoriously unreliable.
*If you do not have a problem with your system, especially newer systems, leave well enough alone.

…But if you must tinker with registry cleaners, make certain you have an up to date operating system image to restore if things go south.

Reply | Quote

Yes, it’s safe to remove all those entries on both accounts.

The WormRadar is invalid – it’s no longer installed, probably removed by AVG as it’s considered bad, a browser redirect.

Reply | Quote

OK—Will remove them…..Then will be proceeding to MalWareBytes……One question about MalWareBytes—–Should I continue to post in this thread or should I start a new thread…..???…..Thank you

Reply | Quote

Continue here, it’s easier to keep track of the history if it’s all together.

Reply | Quote

I ran ‘MWB’ scan on each user account…….Results are the same….6 items reported—
———-
Malwarebytes Anti-Malware 1.75.0.1300
http://www.malwarebytes.org

Database version: v2014.02.16.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Carol :: BIRL-PC [administrator]

2/16/2014 7:01:39 AM
MBAM-log-2014-02-16 (07-12-20).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 234437
Time elapsed: 8 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLMSOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (PUP.Optional.FunWebProducts.A) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:Program FilesFunWebProductsInstallr (PUP.Optional.FunWebProducts.A) -> No action taken.
C:Program FilesFunWebProductsInstallr1.bin (PUP.Optional.FunWebProducts.A) -> No action taken.
C:Program FilesFunWebProductsInstallr1.binchrome (PUP.Optional.FunWebProducts.A) -> No action taken.
C:Program FilesFunWebProductsInstallr2.bin (PUP.Optional.FunWebProducts.A) -> No action taken.
C:Program FilesFunWebProductsInstallr2.binchrome (PUP.Optional.FunWebProducts.A) -> No action taken.

Files Detected: 0
(No malicious items detected)

(end)
———

Will wait for further instructions…..***No rush— I may have to log off soon (back on tomorrow morn)…..

For future reference, can I limit scan using just 1 user account….???

Thank you …..

Reply | Quote

The FunWebProducts registry entries are in common areas to all profiles, removing them from within one profile should also remove them from all others.

I would first try to track down and uninstall the software via (Add/Remove) Programs in Control Panel, once done, reboot and then scan again for remnants, CCleaner should be enough: http://www.funwebproducts.com/uninstall.html

Reply | Quote

Hi Satrow….No indication of FunWebProducts in either Control Panel (Add/Remove) programs or CCleaner list of programs….Guess I’ll have to use the uninstall link you provided…..Will report back if further questions/problems……Thanks again for all your help…

Reply | Quote

When you ran Malwarebytes, did you place a check next to all the items it found and click on delete?

Jerry

Reply | Quote

Hi jwitalka…..No—I didn’t delete anything…..I ran the scan and reported findings in this thread for further instructions…..

Reply | Quote

Then rerun Malwarebytes, check everything it finds, click on delete to remove the infection.

Jerry

Reply | Quote

There’s no infection, Jerry, just a leftover in the Registry and some empty folders.

Reply | Quote

You’re right Andy. It still would be a good idea to clean it up to prevent it from showing on future Malwarebytes scans even though it shouldn’t affect PC performance.

Jerry

Reply | Quote

Satrow and jwitalka…..I think you’re saying—I don’t have to D/L and run the FunWeb Un-installer from the link you (Satrow) provided….Right….???…..The only thing I need to do is (after running a new MWB scan)—- have MWB remove the items…..Right….???

Please clarify….Thank you

Reply | Quote

Yes, it looks like the items (empty folders: C:Program FilesFunWebProductsInstallr * and Registry entry: HKLMSOFTWAREMicrosoftWindowsCurrentVersionExt PreApproved{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} ) can be safely removed manually or via MBAM, without leaving anything behind.

Reply | Quote

Ran new MWB scan….Removed (quarantined) all 6 items……Thank you very much for helping me with all this….I very much appreciate it…

Reply | Quote

Agreed.

Jerry

Reply | Quote

No worries, you did a good safe cleanup.

Reply | Quote

Hi
To remove unwanted programs etc. I use a tool like IObit uninstaller.
It can scan the registry for leftfovers the normal uninstall programs don’t remove.
Gunnar

Reply | Quote

Hi,

I can only endorse what Clint says about not messing in the Registry unless you really know what you’re doing. Otherwise you will most likely cause many more problems than you solve.

Although CCleaner is one of the few clean-up tools I recommend and even though its Registry backups usually do work, that will only apply if you actually managed to get the system started again!

If you must dabble with the Registry cleaning section of CC never tick the box for ‘Missing/Shared DLLs’ as removing DLLs that are supposedly no longer required is a classic way to throw a spanner in the works. Other sections to beware of are: Unused file extensions, ActiveX and class issues, Type libraries, Fonts. For those who are brave enough to proceed with the other sections, it is best to only tick one box at a time (to reduce the number of ‘problems’ found by the scan) and then only tick to remove entries found for programs you are ABSOLUTELY CERTAIN have been previously uninstalled.

A far better way to keep your Registry, and application data folders, shipshape is to do your uninstalling with the free version of Revo Uninstaller – but it’s important to only set it on ‘Moderate’. Sadly, the free version of Revo only works on 32bit programs but it’s much better than just using the manufacturer’s un-installer – you’ll find uninstalling something like McAfee or AVG with Revo a bit of an eye-opener!

Remember the Golden Rule: If it ain’t broke, don’t fix it.

Cheers, Chris

Reply | Quote

i agree it’s best to err on the side of caution, especially where the Windows Registry is concerned. CCleaner, however, is about the safest cleanup/tuneup tool i’ve ever come across. At home, we’ve been using CCleaner for many years on our Windows XP machines, then Windows 7, and now Windows 8/8.1. Both PCs and laptops have benefitted from using CCleaner. Also, i can’t count how many times various friends have asked me to check their computer which was “running slow” or was “messed up” or “takes forever to boot up”. Invariably, running CCleaner’s main cleaner, followed by the CCleaner Registry cleaner, followed by a defrag produced a major improvement in how their systems ran. Of course, some needed attention to viruses, malware, etc. using different tools. But CCleaner itself is about as safe a system cleaner as you’re likely to find. Other more aggressive tools, particularly other registry cleaners, always seem to delete something that “breaks” an installed program or causes hiccups in how Windows works. So, by all means err on the side of caution and trust CCleaner to be a prudent cleaning tool.

Reply | Quote

I used to recommend Revo Uninstaller until I read in Kim Komando’s Newsletter about Geek Uninstaller .

This program is free. It doesn’t really act like an installed program, and it is portable. Geek Uninstaller can do Forced Uninstalls and works on 64-bit programs. You can use it from a Flash Drive or just let it sit on your desktop. It doesn’t work with Windows 8 Metro style Apps. Geek Uninstaller does as good a job of Registry cleanup as Revo, if not better, as it can clean up 64-bit Registry areas.

-- rc primak

Reply | Quote

That’s why we need to keep our PC simple. My friend has a lot of programs in his PC, CCleaner simply obliterates his registry

Reply | Quote