After installing Google Chrome, the installer sets the bundled application as the default web browser.

Some installers for the free version of CCleaner, also based on Nullsoft, include an installer for Google Chrome with the file name PF-Chrome-2019.exe. Existing antivirus software, including Microsoft Defender Antivirus, might be turned off or uninstalled during this process. If users choose to continue, the bundled antivirus product installs in the background. This CCleaner installer uses a Nullsoft plugin to download a file named Microstub.exe from . When it is launched, it provides a preselected option to install Avast Free Antivirus. While Avast is also from Piriform, the rest of these bundled software are not. They are designed to offer additional software bundled with the applications developed by Piriform, including Google Chrome, Google Toolbar, Avast Free Antivirus, and AVG Antivirus Free.

These installers can be downloaded from various locations including the Piriform website. Some instances of these installers are detected as the following: While these installers do provide an option to opt out, some users can easily inadvertently install these bundled applications. Note that these are normal applications that are not detected by Microsoft Defender Antivirus.

The installers detected as PUA include installers of CCleaner, Defraggler, Recuva, and Speccy that have been found bundling the following applications. To protect Windows users, Microsoft Defender Antivirus detects installers for Piriform applications that exhibit this behavior as potentially unwanted applications (PUA).

While the bundled applications themselves are legitimate, bundling of software, especially products from other providers, can result in unexpected software activity that can negatively impact user experiences. Certain installers for free and 14-day trial versions of CCleaner, Defraggler, Recuva, and Speccy come with bundled applications, including applications that are not required or developed by the same publisher Piriform.

Ccleaner piriform malware