CCleaner v5.33 32-bit compromised

John_Gray

Announcement on the Piriform website, of interest to those who run CCleaner.

S0litaire

https://www.bleepingcomputer.com/news/security/ccleaner-compromised-to-distribute-malware-for-almost-a-month/

justaquestion

And equally as worrying is this from the Bleeping computer link page given above is to quote
"Security researchers are now investigating other malware campaigns that appear to have been carried out from Avast's infrastructre, including a Locky ransomware distribution campaign*

spud17

Thanks.
On Friday I reinstalled Win 10 on an old 32bit netbook and have CCleaner 5.33.6162. :eek::eek:
Malwarebytes is clear.
Best scanner to use???
Or could easily do another reinstall.

buglawton

Ryanair, Equifax, Avast... They're all on a bit of a roll, who next?

AlecEiffel

So my V5.32.6129 64bit version is totally safe (from this at least)? Seems I last updated in July!

[Deleted User]

Since the sell out to a dodgy AV company, and now it's bundled with malware, is the end for the ever popular CCleaner as we know it?

I've been an avid user of CCleaner since early 2005, may it long rest in peace.

esuhl

spud17 wrote: »

Thanks.
On Friday I reinstalled Win 10 on an old 32bit netbook and have CCleaner 5.33.6162. :eek::eek:
Malwarebytes is clear.
Best scanner to use???
Or could easily do another reinstall.

Apparently the malware was part of the CCleaner executable and doesn't replicate itself. Simply uninstalling CCleaner (or installing the latest unaffected version) should be enough to get rid of the malware.

So they say... :-/

esuhl

Deleted_User wrote: »

I've been an avid user of CCleaner since early 2005, may it long rest in peace.

I use BleachBit in GNU/Linux, which does a similar thing. There's a Windows version too, if you're looking for an alternative to CCleaner:

https://www.bleachbit.org/download/windows

chunter

Before the stampede starts and people get crushed trying to get out through the doors, has anyone even been infected by this?

Deary me. No wonder the Empire's gone.

[Deleted User]

chunter wrote: »

Before the stampede starts and people get crushed trying to get out through the doors, has anyone even been infected by this?

Deary me. No wonder the Empire's gone.

No because luckily I was still using v5.32 but that's not the point. It doesn't matter if it personally affects you or not, it's still calling home to a remote server without the user's knowledge and uploading info about you.