CCleaner Was Compromised for a Month

I stopped updating CCleaner when they enabled system monitoring by default, and the direction they were heading with the paid version. I still use it to clear temp files without signing me out of certain websites though.
 
The article mentioned that the malware was inserted during compilation by the compiler. I am more interested to know what is the tool chain used in Piriform that caused this problem.
 
Luckily it was just the 32-bit version that was infected. If you had 5.33 installed on a 64-bit Windows then nothing has happened to your computer (uninstall or upgrade anyway of course). And even if you still run 32-bit Windows, the infection is in the main exe so uninstalling or upgrading to 5.34 removes the infection.
Oh and checking the md5 would've done nothing in this case, since it was the official installer that was infected.
 
Pandur said:
And even if you still run 32-bit Windows, the infection is in the main exe so uninstalling or upgrading to 5.34 removes the infection...
Click to expand...

you sure about that?...I heard the only way to get rid of the malware is a system restore or a complete Windows reinstall
 
Well I don't use CCleaner but some things I've downloaded want me to install it (Speccy, etc). But I do not.
 
Still use it but been thinking of switching for awhile now. Any recommendations?

Been using since 1.0 days. . . .
 
Jim Kim said:
When i get a flat tire I buy a new car.
Click to expand...

normally I would agree with you but in cases like this were malicious malware or viruses get installed, it's not always as simple as uninstalling the program
 
polonyc2 said:
you sure about that?...I heard the only way to get rid of the malware is a system restore or a complete Windows reinstall
Click to expand...
System restore can't not be the only way, but it can be the fastest way to resolve problems. To do it manually, you will need to identify every single affected files and processes, then restore them. This can take a long time and some files are dynamically generated and you may need to reinstall related programs.

In fact, if the restore point is dirty, not only will it not fix the problem, but making it worst.
 
thebufenator said:
It can be almost impossible to prove that all malware has been removed. Malware that has not been signatured will likely not be detected by any AV.
Click to expand...
Well then I guess we are all infected and there is no way of knowing. Happy computing.
 
Jim Kim said:
Well then I guess we are all infected and there is no way of knowing. Happy computing.
Click to expand...

Come on Holmes. Getting hit with something like this CCleaner malware is is kind of a big deal. Do you understand the resources that went into putting that malware there in the first place?

Is it too hard to be on the safe side here?
 
You know, it sure would be nice if they'd show the IPs of the source and CnC servers so I would know what to block on my firewall.
 
thebufenator said:
Come on Holmes. Getting hit with something like this CCleaner malware is is kind of a big deal. Do you understand the resources that went into putting that malware there in the first place?

Is it too hard to be on the safe side here?
Click to expand...
hey Sherlock, I understand supply side attacks. Whether it's NotPetya in the Ukraine or Shadowpad.
It's the wave of the future and I would continue to trust ccleaner even more so now. I just might not update everytime it pops up, but I never did that anyway.
If i was wanting the safe side I would not be using Microsoft Windows.
#LivingOnTheEdge
 
polonyc2 said:
you sure about that?...I heard the only way to get rid of the malware is a system restore or a complete Windows reinstall
Click to expand...
Yes I am sure. The malware is contained in the ccleaner.exe file. Get rid of that and you've removed the infection. No external processes were installed by this malware (for once). :)

You can also verify with regedit if you've been infected. CCleaner stores it's values in 'HKLM\SOFTWARE\Piriform\CCleaner'. If you've run the infected version, the malware itself stored some values in 'HKLM\SOFTWARE\Piriform\Agomo'. So if you have the second folder in your register, you've been infected. If not, you're in the clear!

And don't underestimate the fact that if you ran the 32-bit client of CCleaner, you've had a working backdoor on your computer for the last month or so. Information has been gathered and sent off to unknown parties.
 
Pandur said:
Yes I am sure. The malware is contained in the ccleaner.exe file. Get rid of that and you've removed the infection. No external processes were installed by this malware (for once). :)



And don't underestimate the fact that if you ran the 32-bit client of CCleaner, you've had a working backdoor on your computer for the last month or so. Information has been gathered and sent off to unknown parties.
Click to expand...

Those two sentences conflict. The initial infection may be known and limited, but you have no idea what it could have added since then. It was a working backdoor after all.......
 
There's a lot of craziness here including Piriform being bought out by Avast (the nagware Antivirus company) shortly before this happened. Its a pretty sophisticated attack vector but at least those using the 64 bit version of the program weren't exposed. Its too bad as Piriform utilities were pretty nice freeware, but going towards the buyout by Avast they started adding more stuff for the home user to purchase whereas the home users had full utilities for free more or less and it was the business versions that were the profit generator.

For those looking for a CCleaner replacement, let me suggest BleachBit (https://www.bleachbit.org/) . It is totally Free and Open Source and what CCleaner does - just remember to double check before you delete certain kinds of files, same as you would with CCleaner.
 
thebufenator said:
Those two sentences conflict. The initial infection may be known and limited, but you have no idea what it could have added since then. It was a working backdoor after all.......
Click to expand...
Yeah, except if you read the various articles about this infection. The malware gathered and sent information about your computer to a third party and opened a backdoor to your system as well. But there has been no registered secondary infections and the infrastructure meant for this purpose has been seized and taken offline.

What I meant with my second sentence is you could do yourself the favour and change your passwords and so on if you've been infected. And do run your favourite malware scanner etc. But so far there has not been any documented secondary infections through this backdoor. So people should relax a little and maybe put down the pitchforks, lighterfluid, tar and feathers and whatnot.
 
Pandur said:
Yeah, except if you read the various articles about this infection. The malware gathered and sent information about your computer to a third party and opened a backdoor to your system as well. But there has been no registered secondary infections and the infrastructure meant for this purpose has been seized and taken offline.

What I meant with my second sentence is you could do yourself the favour and change your passwords and so on if you've been infected. And do run your favourite malware scanner etc. But so far there has not been any documented secondary infections through this backdoor. So people should relax a little and maybe put down the pitchforks, lighterfluid, tar and feathers and whatnot.
Click to expand...

Ccleaner is all but useless anyway. In 99% of cases 99% of wasted hdd space is Windows updates and previous OS versions which Ccleaner can't touch anyway. This is the reason I never do anything business critical or personal banking on Windows.
 
I for one was not happy that Avast bought them. At one time Avast was a good product, but they too fell.

Avast use to be lean av that could scan files on windows boot. Now it's just overloaded "feature" crap.
 
Pandur said:
Yes I am sure. The malware is contained in the ccleaner.exe file. Get rid of that and you've removed the infection. No external processes were installed by this malware (for once). :)

You can also verify with regedit if you've been infected. CCleaner stores it's values in 'HKLM\SOFTWARE\Piriform\CCleaner'. If you've run the infected version, the malware itself stored some values in 'HKLM\SOFTWARE\Piriform\Agomo'. So if you have the second folder in your register, you've been infected. If not, you're in the clear!

And don't underestimate the fact that if you ran the 32-bit client of CCleaner, you've had a working backdoor on your computer for the last month or so. Information has been gathered and sent off to unknown parties.
Click to expand...


Except the CC malware was a backdoor that was used to download/install other malware.... So if that happened, removing CC will not fix your problem, and your machine is still compromised. I haven't seen any info on the other malware that was downloaded or how to clean that.
 
So, affected companies that have had their computers infected with the malicious version of CCleaner are strongly recommended to fully restore their systems from backup versions before the installation of the tainted security program.​

aw geez
 
You must log in or register to reply here.
Back
Top